Fix several bugs

There's a total of 12 bugs fixed, among which are NULL dereferences,
double-frees, buffer overflows, and memory leaks.

Author: Zer0-One

src/decode.c

@@ -136,20 +136,27 @@ uint8_t* tmj_zlib_decompress(const uint8_t* data, size_t data_size, size_t* deco
                 if (stream.avail_out != 0) {
                     logmsg(TMJ_LOG_ERR, "Decode (zlib): No progress possible");
 
+                    free(out);
+
                     return NULL;
                 }
 
                 logmsg(TMJ_LOG_DEBUG, "Decode (zlib): Z_BUF_ERROR");
             case Z_OK:
                 logmsg(TMJ_LOG_DEBUG, "Decode (zlib): inflate OK");
 
-                out = realloc(out, INFLATE_BLOCK_SIZE * realloc_scale);
-                if (out == NULL) {
+                void* tmp = realloc(out, INFLATE_BLOCK_SIZE * realloc_scale);
+
+                if (tmp == NULL) {
                     logmsg(TMJ_LOG_ERR, "Decode (zlib): Unable to grow inflate output buffer, the system is out memory");
 
+                    free(out);
+
                     return NULL;
                 }
 
+                out = tmp;
+
                 stream.avail_out = INFLATE_BLOCK_SIZE;
 
                 stream.next_out = out + stream.total_out;
@@ -381,6 +388,10 @@ size_t b64_decode_size(const char* data) {
 
     size_t len = strlen(data);
 
+    if (len == 0) {
+        return 0;
+    }
+
     size_t ret = len / 4 * 3;
 
     // Check to see if the last 2 characters are padding bytes
@@ -485,6 +496,13 @@ char* tmj_b64_encode(uint8_t* data, size_t size) {
 
     size_t enc_size = b64_encoded_size(size);
     char* out = malloc(enc_size + 1);
+
+    if (out == NULL) {
+        logmsg(TMJ_LOG_ERR, "Encode (b64): Unable to allocate output buffer, the system is out of memory");
+
+        return NULL;
+    }
+
     out[enc_size] = '\0';
 
     for (size_t i = 0, j = 0; i < size; i += 3, j += 4) {

src/map.c

@@ -42,7 +42,7 @@ Property* unpack_properties(json_t* properties) {
         int unpk = json_unpack_ex(property,
                 &error,
                 0,
-                "{s:s, s?s, s?s, s:o}",
+                "{s:s, s:s, s?s, s:o}",
                 "name",
                 &ret[idx].name,
                 "type",
@@ -60,8 +60,7 @@ Property* unpack_properties(json_t* properties) {
             return NULL;
         }
 
-        // note: string is default type, so missing field means string
-        if (ret[idx].type == NULL || strcmp(ret[idx].type, "string") == 0) {
+        if (strcmp(ret[idx].type, "string") == 0) {
             unpk = json_unpack_ex(value, &error, 0, "s", &ret[idx].value_string);
 
             if (unpk == -1) {
@@ -86,7 +85,7 @@ Property* unpack_properties(json_t* properties) {
         }
 
         if (strcmp(ret[idx].type, "float") == 0) {
-            unpk = json_unpack_ex(value, &error, 0, "i", &ret[idx].value_float);
+            unpk = json_unpack_ex(value, &error, 0, "F", &ret[idx].value_float);
 
             if (unpk == -1) {
                 logmsg(TMJ_LOG_ERR, "Unable to unpack float value from property, %s at line %d column %d", error.text, error.line, error.column);
@@ -260,6 +259,8 @@ Object* unpack_objects(json_t* objects) {
 
     if (!json_is_array(objects)) {
         logmsg(TMJ_LOG_ERR, "'objects' must be an array");
+
+        return NULL;
     }
 
     json_error_t error;
@@ -332,6 +333,8 @@ Object* unpack_objects(json_t* objects) {
         if (unpk == -1) {
             logmsg(TMJ_LOG_ERR, "Unable to unpack object, %s at line %d column %d", error.text, error.line, error.column);
 
+            free(ret);
+
             return NULL;
         }
 
@@ -1077,14 +1080,14 @@ Map* map_load_json(json_t* root, const char* path) {
                 goto fail_tilesets;
             }
         }
-
-        map->tileset_count = tileset_count;
     }
 
+    map->tileset_count = tileset_count;
+
     return map;
 
 fail_tilesets:
-    tilesets_free(map->tilesets, map->tileset_count);
+    tilesets_free(map->tilesets, idx);
 
 fail_layers:
     layers_free(map->layers, map->layer_count);

src/tileset.c

@@ -151,7 +151,7 @@ int unpack_tileset(json_t* tileset, Tileset* ret) {
                 "{s:b, s:b, s:b, s:b}",
                 "hflip",
                 &ret->transformations->hflip,
-                "vfilp",
+                "vflip",
                 &ret->transformations->vflip,
                 "rotate",
                 &ret->transformations->rotate,
@@ -487,14 +487,25 @@ int unpack_tileset(json_t* tileset, Tileset* ret) {
                     goto fail_tiles;
                 }
 
+                if (json_array_size(terrain) > 4) {
+                    logmsg(TMJ_LOG_ERR,
+                            "Unable to unpack tileset[%s]->tiles[%d]->terrain, terrain cannot be more than 4 elements",
+                            ret->name,
+                            ret->tiles[idx].id);
+
+                    goto fail_tiles;
+                }
+
                 size_t idx2 = 0;
                 json_t* terrain_idx = NULL;
 
                 json_array_foreach(terrain, idx2, terrain_idx) {
                     if (!json_is_integer(terrain_idx)) {
                         logmsg(TMJ_LOG_ERR,
                                 "Unable to unpack tileset[%s]->tiles[%d]->terrain, terrain must be an array of "
-                                "integers");
+                                "integers",
+                                ret->name,
+                                ret->tiles[idx].id);
 
                         goto fail_tiles;
                     }

src/tmj.def

@@ -1,18 +1,3 @@
 EXPORTS
-    tmj_map_loadf
-    tmj_map_load
-    tmj_tileset_loadf
-    tmj_tileset_load
-    tmj_map_free
-    tmj_tileset_free
-    tmj_log_regcb
-    TMJ_VERSION_MAJOR
-    TMJ_VERSION_MINOR
-    TMJ_VERSION_PATCH
-    TMJ_VERSION
-    tmj_decode_layer
-    tmj_zstd_decompress
-    tmj_zlib_decompress
-    tmj_zlib_compress
-    tmj_b64_decode
-    tmj_b64_encode
+tmj_map_loadf tmj_map_load tmj_tileset_loadf tmj_tileset_load tmj_map_free tmj_tileset_free tmj_log_regcb TMJ_VERSION_MAJOR TMJ_VERSION_MINOR
+        TMJ_VERSION_PATCH TMJ_VERSION tmj_decode_layer tmj_zstd_decompress tmj_zlib_decompress tmj_zlib_compress tmj_b64_decode tmj_b64_encode

src/tmj.sym

@@ -1,6 +1,7 @@
 {
-    global:
-        tmj_*;
-        TMJ_*;
-    local: *;
+global:
+    tmj_*;
+    TMJ_*;
+local:
+    *;
 };

src/util.c

@@ -33,6 +33,13 @@ uint32_t* tmj_decode_layer(const char* data, const char* encoding, const char* c
 
     if (strlen(compression) == 0) {
         dat2 = malloc(dsize);
+
+        if (dat2 == NULL) {
+            logmsg(TMJ_LOG_ERR, "Could not allocate buffer for decoded layer data, the system is out of memory");
+
+            goto fail;
+        }
+
         memcpy(dat2, dat, dsize);
         dsize2 = dsize;
     }
@@ -41,7 +48,7 @@ uint32_t* tmj_decode_layer(const char* data, const char* encoding, const char* c
 #ifndef LIBTMJ_ZLIB
         logmsg(TMJ_LOG_ERR, "Layer data encoded with %s, but libtmj was not compiled with %s support", compression, compression);
 
-        return NULL;
+        goto fail;
 #endif
 // This ifdef is only here to shut up the compiler warnings
 #ifdef LIBTMJ_ZLIB
@@ -53,7 +60,7 @@ uint32_t* tmj_decode_layer(const char* data, const char* encoding, const char* c
 #ifndef LIBTMJ_ZSTD
         logmsg(TMJ_LOG_ERR, "Layer data encoded with zstd, but libtmj was not compiled with zstd support");
 
-        return NULL;
+        goto fail;
 #endif
 #ifdef LIBTMJ_ZSTD
         dat2 = tmj_zstd_decompress(dat, dsize, &dsize2);
@@ -63,14 +70,16 @@ uint32_t* tmj_decode_layer(const char* data, const char* encoding, const char* c
     if (dat2 == NULL) {
         logmsg(TMJ_LOG_ERR, "Unable to decompress %s encoded layer data", compression);
 
-        free(dat);
-
-        return NULL;
+        goto fail;
     }
 
     free(dat);
 
     *size = dsize2 / 4;
 
     return (uint32_t*)dat2;
+
+fail:
+    free(dat);
+    return NULL;
 }