# Reference: https://github.com/json-c/json-c/pull/585

	${RM} ${STAGEDIR}${PREFIX}/include/json-c/config.h

--- CMakeLists.txt.orig	2020-05-14 09:41:45 UTC

+++ CMakeLists.txt

@@ -7,7 +7,7 @@ if(POLICY CMP0048)

 endif()

 # JSON-C library is C only project.

-project(json-c LANGUAGES C VERSION 0.14)

+project(json-c LANGUAGES C VERSION 0.14.99)

 # If we've got 3.0 then it's good, let's provide support. Otherwise, leave it be.

 if(POLICY CMP0038)

@@ -65,6 +65,7 @@ include(GNUInstallDirs)

 include(CMakePackageConfigHelpers)

 option(BUILD_SHARED_LIBS  "Default to building shared libraries" ON)

+option(BUILD_STATIC_LIBS  "Default to building static libraries" ON)

 # Generate a release merge and test it to verify the correctness of republishing the package.

 ADD_CUSTOM_TARGET(distcheck

@@ -108,6 +109,7 @@ check_include_files("stdlib.h;stdarg.h;string.h;float.

 check_include_file(unistd.h         HAVE_UNISTD_H)

 check_include_file(sys/types.h      HAVE_SYS_TYPES_H)

+check_include_file(sys/resource.h   HAVE_SYS_RESOURCE_H) # for getrusage

 check_include_file("dlfcn.h"        HAVE_DLFCN_H)

 check_include_file("endian.h"       HAVE_ENDIAN_H)

@@ -165,6 +167,9 @@ endif()

 if (HAVE_SYSLOG_H)

     check_symbol_exists(vsyslog     "syslog.h" HAVE_VSYSLOG)

 endif()

+if (HAVE_SYS_RESOURCE_H)

+    check_symbol_exists(getrusage   "sys/resource.h" HAVE_GETRUSAGE)

+endif()

 check_symbol_exists(strtoll     "stdlib.h" HAVE_STRTOLL)

 check_symbol_exists(strtoull    "stdlib.h" HAVE_STRTOULL)

@@ -299,7 +304,7 @@ if ($ENV{VALGRIND})

 endif()

 set(JSON_C_PUBLIC_HEADERS

-    ${PROJECT_BINARY_DIR}/config.h

+    # Note: config.h is _not_ included here

     ${PROJECT_BINARY_DIR}/json_config.h

     ${PROJECT_SOURCE_DIR}/json.h

@@ -383,7 +388,7 @@ add_library(${PROJECT_NAME}

 set_target_properties(${PROJECT_NAME} PROPERTIES

     VERSION 5.0.0

     SOVERSION 5)

-

+list(APPEND CMAKE_TARGETS ${PROJECT_NAME})

 # If json-c is used as subroject it set to target correct interface -I flags and allow

 # to build external target without extra include_directories(...)

 target_include_directories(${PROJECT_NAME}

@@ -392,7 +397,35 @@ target_include_directories(${PROJECT_NAME}

         $<BUILD_INTERFACE:${PROJECT_BINARY_DIR}>

 )

-install(TARGETS ${PROJECT_NAME}

+# Allow to build static and shared libraries at the same time

+if (BUILD_STATIC_LIBS AND BUILD_SHARED_LIBS)

+    set(STATIC_LIB ${PROJECT_NAME}-static)

+    add_library(${STATIC_LIB} STATIC

+        ${JSON_C_SOURCES}

+        ${JSON_C_HEADERS}

+    )

+

+    # rename the static library

+    if (NOT MSVC)

+    set_target_properties(${STATIC_LIB} PROPERTIES

+        OUTPUT_NAME ${PROJECT_NAME}

+    )

+    endif()

+    list(APPEND CMAKE_TARGETS ${STATIC_LIB})

+endif ()

+

+# Always create new install dirs with 0755 permissions, regardless of umask

+set(CMAKE_INSTALL_DEFAULT_DIRECTORY_PERMISSIONS

+	OWNER_READ

+	OWNER_WRITE

+	OWNER_EXECUTE

+	GROUP_READ

+	GROUP_EXECUTE

+	WORLD_READ

+	WORLD_EXECUTE

+   )

+

+install(TARGETS ${CMAKE_TARGETS}

     EXPORT ${PROJECT_NAME}-targets

     RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}

     LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}

--- cmake-configure.orig	2020-05-14 09:42:45 UTC

+++ cmake-configure

@@ -1,87 +1 @@

-#!/bin/bash

-

-# Wrapper around cmake to emulate useful options

-# from the previous autoconf-based configure script.

-

-RUNDIR=$(dirname "$0")

-RUNDIR=$(cd "$RUNDIR" && pwd)

-CURDIR=$(pwd)

-

-FLAGS=()

-

-usage()

-{

-	exitval="$1"

-	errmsg="$2"

-

-	if [ $exitval -ne 0 ] ; then

-		exec 1>&2

-	fi

-	if [ ! -z "$errmsg" ] ; then

-		echo "ERROR: $errmsg" 1>&2

-	fi

-	cat <<EOF

-$0 [<configure_options>] [-- [<cmake options>]]

-  --prefix=PREFIX         install architecture-independent files in PREFIX

-  --enable-threading      Enable code to support partly multi-threaded use

-  --enable-rdrand         Enable RDRAND Hardware RNG Hash Seed generation on

-                          supported x86/x64 platforms.

-  --enable-shared         build shared libraries [default=yes]

-  --enable-static         build static libraries [default=yes]

-  --disable-Bsymbolic     Avoid linking with -Bsymbolic-function

-  --disable-werror        Avoid treating compiler warnings as fatal errors

-

-EOF

-	exit

-}

-

-if [ "$CURDIR" = "$RUNDIR" ] ; then

-	usage 1 "Please mkdir some other build directory, and run this script from there."

-fi

-

-if ! cmake --version ; then

-	usage 1 "Unable to find a working cmake, please be sure you have it installed and on your PATH"

-fi

-

-while [ $# -gt 0 ] ; do

-	case "$1" in

-	-h|--help)

-		usage 0

-		;;

-	--prefix)

-		FLAGS+=(-DCMAKE_INSTALL_PREFIX="$2")

-		shift

-		;;

-	--enable-threading)

-		FLAGS+=(-DENABLE_THREADING=ON)

-		;;

-	--enable-rdrand)

-		FLAGS+=(-DENABLE_RDRAND=ON)

-		;;

-	--enable-shared)

-		FLAGS+=(-DBUILD_SHARED_LIBS=ON)

-		;;

-	--enable-static)

-		FLAGS+=(-DBUILD_SHARED_LIBS=OFF)

-		;;

-	--disable-Bsymbolic)

-		FLAGS+=(-DDISABLE_BSYMBOLIC=ON)

-		;;

-	--disable-werror)

-		FLAGS+=(-DDISABLE_WERROR=ON)

-		;;

-	--)

-		shift

-		break

-		;;

-	-*)

-		usage 1 "Unknown arguments: $*"

-		;;

-	*)

-		break

-		;;

-	esac

-	shift

-done

-

-exec cmake "${FLAGS[@]}" "$@" "${RUNDIR}"

+cmake-configure

--- cmake/config.h.in.orig	2020-05-14 09:44:39 UTC

+++ cmake/config.h.in

@@ -1,4 +1,3 @@

-/* config.h.in.  Generated from configure.ac by autoheader.  */

 /* Enable RDRAND Hardware RNG Hash Seed */

 #cmakedefine ENABLE_RDRAND "@ENABLE_RDRAND@"

@@ -54,6 +53,9 @@

 /* Define to 1 if you have the <sys/param.h> header file. */

 #cmakedefine HAVE_SYS_PARAM_H @HAVE_SYS_PARAM_H@

+/* Define to 1 if you have the <sys/resource.h> header file. */

+#cmakedefine HAVE_SYS_RESOURCE_H

+

 /* Define to 1 if you have the <sys/stat.h> header file. */

 #cmakedefine HAVE_SYS_STAT_H

@@ -134,6 +136,9 @@

 /* Define to 1 if you have the `vsyslog' function. */

 #cmakedefine HAVE_VSYSLOG @HAVE_VSYSLOG@

+

+/* Define if you have the `getrusage' function. */

+#cmakedefine HAVE_GETRUSAGE

 #cmakedefine HAVE_STRTOLL

 #if !defined(HAVE_STRTOLL)

From 099016b7e8d70a6d5dd814e788bba08d33d48426 Mon Sep 17 00:00:00 2001

From: Tobias Stoeckmann <tobias@stoeckmann.org>

Date: Mon, 4 May 2020 19:41:16 +0200

Subject: [PATCH 1/3] Protect array_list_del_idx against size_t overflow.

If the assignment of stop overflows due to idx and count being

larger than SIZE_T_MAX in sum, out of boundary access could happen.

It takes invalid usage of this function for this to happen, but

I decided to add this check so array_list_del_idx is as safe against

bad usage as the other arraylist functions.

---

 arraylist.c | 3 +++

 1 file changed, 3 insertions(+)

diff --git a/arraylist.c b/arraylist.c

index 12ad8af6d3..e5524aca75 100644

--- arraylist.c

+++ arraylist.c

@@ -136,6 +136,9 @@ int array_list_del_idx(struct array_list *arr, size_t idx, size_t count)

 {

 	size_t i, stop;

+	/* Avoid overflow in calculation with large indices. */

+	if (idx > SIZE_T_MAX - count)

+		return -1;

 	stop = idx + count;

 	if (idx >= arr->length || stop > arr->length)

 		return -1;

From 77d935b7ae7871a1940cd827e850e6063044ec45 Mon Sep 17 00:00:00 2001

From: Tobias Stoeckmann <tobias@stoeckmann.org>

Date: Mon, 4 May 2020 19:46:45 +0200

Subject: [PATCH 2/3] Prevent division by zero in linkhash.

If a linkhash with a size of zero is created, then modulo operations

are prone to division by zero operations.

Purely protective measure against bad usage.

---

 linkhash.c | 3 +++

 1 file changed, 3 insertions(+)

diff --git a/linkhash.c b/linkhash.c

index 7ea58c0abf..f05cc38030 100644

--- linkhash.c

+++ linkhash.c

@@ -12,6 +12,7 @@

 #include "config.h"

+#include <assert.h>

 #include <limits.h>

 #include <stdarg.h>

 #include <stddef.h>

@@ -499,6 +500,8 @@ struct lh_table *lh_table_new(int size, lh_entry_free_fn *free_fn, lh_hash_fn *h

 	int i;

 	struct lh_table *t;

+	/* Allocate space for elements to avoid divisions by zero. */

+	assert(size > 0);

 	t = (struct lh_table *)calloc(1, sizeof(struct lh_table));

 	if (!t)

 		return NULL;

From d07b91014986900a3a75f306d302e13e005e9d67 Mon Sep 17 00:00:00 2001

From: Tobias Stoeckmann <tobias@stoeckmann.org>

Date: Mon, 4 May 2020 19:47:25 +0200

Subject: [PATCH 3/3] Fix integer overflows.

The data structures linkhash and printbuf are limited to 2 GB in size

due to a signed integer being used to track their current size.

If too much data is added, then size variable can overflow, which is

an undefined behaviour in C programming language.

Assuming that a signed int overflow just leads to a negative value,

like it happens on many sytems (Linux i686/amd64 with gcc), then

printbuf is vulnerable to an out of boundary write on 64 bit systems.

---

 linkhash.c |  7 +++++--

 printbuf.c | 19 ++++++++++++++++---

 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/linkhash.c b/linkhash.c

index f05cc38030..51e90b13a2 100644

--- linkhash.c

+++ linkhash.c

@@ -580,9 +580,12 @@ int lh_table_insert_w_hash(struct lh_table *t, const void *k, const void *v, con

 {

 	unsigned long n;

-	if (t->count >= t->size * LH_LOAD_FACTOR)

-		if (lh_table_resize(t, t->size * 2) != 0)

+	if (t->count >= t->size * LH_LOAD_FACTOR) {

+		/* Avoid signed integer overflow with large tables. */

+		int new_size = INT_MAX / 2 < t->size ? t->size * 2 : INT_MAX;

+		if (t->size == INT_MAX || lh_table_resize(t, new_size) != 0)

 			return -1;

+	}

 	n = h % t->size;

diff --git a/printbuf.c b/printbuf.c

index 976c12dde5..00822fac4f 100644

--- printbuf.c

+++ printbuf.c

@@ -15,6 +15,7 @@

 #include "config.h"

+#include <limits.h>

 #include <stdio.h>

 #include <stdlib.h>

 #include <string.h>

@@ -65,10 +66,16 @@ static int printbuf_extend(struct printbuf *p, int min_size)

 	if (p->size >= min_size)

 		return 0;

-

-	new_size = p->size * 2;

-	if (new_size < min_size + 8)

+	/* Prevent signed integer overflows with large buffers. */

+	if (min_size > INT_MAX - 8)

+		return -1;

+	if (p->size > INT_MAX / 2)

 		new_size = min_size + 8;

+	else {

+		new_size = p->size * 2;

+		if (new_size < min_size + 8)

+			new_size = min_size + 8;

+	}

 #ifdef PRINTBUF_DEBUG

 	MC_DEBUG("printbuf_memappend: realloc "

 	         "bpos=%d min_size=%d old_size=%d new_size=%d\n",

@@ -83,6 +90,9 @@ static int printbuf_extend(struct printbuf *p, int min_size)

 int printbuf_memappend(struct printbuf *p, const char *buf, int size)

 {

+	/* Prevent signed integer overflows with large buffers. */

+	if (size > INT_MAX - p->bpos - 1)

+		return -1;

 	if (p->size <= p->bpos + size + 1)

 	{

 		if (printbuf_extend(p, p->bpos + size + 1) < 0)

@@ -100,6 +110,9 @@ int printbuf_memset(struct printbuf *pb, int offset, int charvalue, int len)

 	if (offset == -1)

 		offset = pb->bpos;

+	/* Prevent signed integer overflows with large buffers. */

+	if (len > INT_MAX - offset)

+		return -1;

 	size_needed = offset + len;

 	if (pb->size < size_needed)

 	{

include/json-c/json_types.h

lib/cmake/json-c/json-c-config.cmake

lib/cmake/json-c/json-c-targets-%%CMAKE_BUILD_TYPE%%.cmake

lib/cmake/json-c/json-c-targets.cmake