Zephyr JSON - json_obj_encode_buf accesses the wrong address with nested arrays

[Yury Morgunov]

There was a problem converting the structure to JSON.
I have two structures

struct test_nested {
	const char *test_string2;
	int addition_array[9];
	size_t addition_array_len;
};

struct test_struct {
	struct test_nested some_nested_struct[16];
	size_t some_nested_struct_len;
};

And their description:

static const struct json_obj_descr nested_descr[] = {
	JSON_OBJ_DESCR_PRIM(struct test_nested, test_string2, JSON_TOK_STRING),
	JSON_OBJ_DESCR_ARRAY(struct test_nested, addition_array, 9, addition_array_len, JSON_TOK_NUMBER),
};

static const struct json_obj_descr test_descr[] = {
	JSON_OBJ_DESCR_OBJ_ARRAY(struct test_struct, some_nested_struct, 16, some_nested_struct_len, nested_descr, ARRAY_SIZE(nested_descr)),
};

I create a structure and initialize:

struct test_struct ts = {
		.some_nested_struct[0] = {
				.test_string2 = "Hello bug2",
				.addition_array[0] = 54,
				.addition_array[1] = 4354,
				.addition_array[2] = 5454,
				.addition_array[3] = 544,
				.addition_array[4] = 546,
				.addition_array_len = 5,
		},
		.some_nested_struct[1] = {
				.test_string2 = "Hello bug3",
				.addition_array[0] = 654,
				.addition_array[1] = 7698,
				.addition_array[2] = 890,
				.addition_array[3] = 890,
				.addition_array_len = 4,
		},
		.some_nested_struct_len = 2,
};

Code for getting JSON:

char buffer[1024];
ssize_t  ret = json_obj_encode_buf(test_descr, ARRAY_SIZE(test_descr), &ts, buffer, sizeof(buffer));

Using this structure, the json_obj_encode_buf function tries to access an inaccessible address.
This happens when the second element is processed .some_nested_struct [1]
I think that the offset of the address is not calculated correctly, which ultimately leads to the overwriting of the pointer.

This problem disappears when I remove the test_string2 from the structure.

Can anyone repeat this? Suddenly I'm not working with memory correctly

[Yury Morgunov]

After going through the library with the debugger, I saw that addition_array_len was ignored after converting the first element of test_struct.

Because of this, it turns out that when trying to process test_string2 from the second element of the test_struct array, the program does not refer to the string address, but to addition_array_len. addition_array_len is 5 so the program thinks that the line is at address 5 and breaks