ccan: add json_escape_len in json_out_addstrn
What the developer wrote
Authored by Sangbida Chaudhuri
ccan: add json_escape_len in json_out_addstrn
What changed, and why it matters
This is a one-line fix in a helper library that builds JSON output. The function json_out_addstrn is supposed to add a string of a specific length, but it was escaping the entire string using a function that ignores the requested length. This could cause a string that contains bytes beyond the intended length to be incorrectly included in JSON output, potentially leaking nearby memory or producing malformed JSON. The patch makes the escaping respect the intended length.
Review all call sites of json_out_addstrn in Core Lightning to determine whether any pass buffers that are not NUL-terminated or where 'len' is shorter than strlen(str). If such call sites exist, assess them for possible memory disclosure or JSON injection. Apply the patch and include it in the next release.
Security signals we found
Out-of-bounds read risk: json_escape(NULL, str) reads past the intended length if the buffer is not NUL-terminated or contains embedded NULs
Potential information disclosure: escaped output could include unintended adjacent memory bytes
JSON correctness issue: emitted string length may not match caller's declared length
Fix is minimal and targeted, consistent with a bug/security patch
Evidence from the diff
In ccan/ccan/json_out/json_out.c, json_out_addstrn() takes an explicit length parameter ‘len’ and is meant to add exactly that many bytes as a JSON string. When escaping is needed, the original code called json_escape(NULL, str), which treats ‘str’ as a NUL-terminated string and escapes the whole thing, ignoring ‘len’. The patch changes this to json_escape_len(NULL, str, len), which escapes only the first ‘len’ bytes. This prevents out-of-bounds reads and ensures the emitted JSON matches the caller’s intent. The downstream impact in Core Lightning depends on whether any caller passes non-NUL-terminated or length-bounded buffers containing characters requiring escaping.
Changed components
ccan/ccan/json_out/json_out.cjson_out_addstrn functionCore Lightning JSON output generationInspect captured patch +1 / −1
diff --git a/ccan/ccan/json_out/json_out.c b/ccan/ccan/json_out/json_out.c
index 9e371343..915d525e 100644
--- a/ccan/ccan/json_out/json_out.c
+++ b/ccan/ccan/json_out/json_out.c
@@ -306,7 +306,7 @@ bool json_out_addstrn(struct json_out *jout,
struct json_escape *e;
if (json_escape_needed(str, len)) {
- e = json_escape(NULL, str);
+ e = json_escape_len(NULL, str, len);
str = e->s;
len = strlen(str);
} else
Why this scored 49/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.