defend against excessive recursion in json::load #326
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Passing a deeply nested JSON structure to json::load leads to a crash due to stack overflow. We handle this now gracefully by limiting the maximum nesting depth to 10,000. Test case: https://github.com/nst/JSONTestSuite/blob/master/test_parsing/n_structure_100000_opening_arrays.json
The-EDev
approved these changes
Jan 25, 2022
There was a problem hiding this comment.
Everything seems to be in order, but I would still appreciate a 2nd review just to be absolutely sure that nothing else would be affected.
On a separate note, it might be worth testing Crow against the linked JSON tests, or possibly incorporating them into Crow's own tests.
|
I have run the whole test suite, of course. The parser does mostly fine, it accepts some cases that it should not and it rejects a few corner cases that will most likely never happen in practice. I was mostly interested in potential crashes, as these are really dangerous with untrusted input. With this commit all test files can be read without crashing. I plan to use a fuzzer to check for further potential crash issues. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Passing a deeply nested JSON structure to json::load leads to a crash
due to stack overflow. We handle this now gracefully by limiting the
maximum nesting depth to 10,000.
Test case:
https://github.com/nst/JSONTestSuite/blob/master/test_parsing/n_structure_100000_opening_arrays.json