SECURITY ISSUE: Buffer overflow in parseStringValue

[kennu]

There is a buffer overflow in the function

aws-iot-device-sdk-embedded-C/src/aws_iot_json_utils.c

Line 187 in 28b21ea

IoT_Error_t parseStringValue(char *buf, const char *jsonString, jsmntok_t *token) {

It copies data to destination buf without checking buf size. This will potentially cause serious security problems on IoT devices when arbitrary JSON data is processed.

[aggarg]

Hello @kennu,

Thank you for reporting your observation. We are looking into it.

Regards,
Gaurav

[lt72]

This has now been resolved with changes #152 and #155. Please use release v3.0.0 (https://github.com/aws/aws-iot-device-sdk-embedded-C/tree/v3.0.0) to acquire the changes and refer to appropriate section in the README for details.