Stack exhaustion parsing a JSON file

[gaa-cifasis]

Hi,

A crash caused by stack exhaustion parsing a JSON was found. It affects, at least version 2.5 as well as the last git revision (and maybe others). To reproduce using jshon:

$ python -c 'print "["*100000' > test.json
$ gdb --args ./jshon -F test.json
...
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff4e50645 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.0

(gdb) bt 20
#0  0x00007ffff4e50645 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.0
#1  0x00007ffff4e53b7d in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.0
#2  0x00007ffff4e60443 in malloc () from /usr/lib/x86_64-linux-gnu/libasan.so.0
#3  0x000000000040c422 in jsonp_malloc (size=48) at memory.c:24
#4  0x000000000040f196 in json_array () at value.c:325
#5  0x000000000040afd0 in parse_array (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:746
#6  0x000000000040b4b2 in parse_value (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:830
#7  0x000000000040b064 in parse_array (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:755
#8  0x000000000040b4b2 in parse_value (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:830
#9  0x000000000040b064 in parse_array (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:755
#10 0x000000000040b4b2 in parse_value (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:830
#11 0x000000000040b064 in parse_array (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:755
#12 0x000000000040b4b2 in parse_value (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:830
#13 0x000000000040b064 in parse_array (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:755
#14 0x000000000040b4b2 in parse_value (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:830
#15 0x000000000040b064 in parse_array (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:755
#16 0x000000000040b4b2 in parse_value (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:830
#17 0x000000000040b064 in parse_array (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:755
#18 0x000000000040b4b2 in parse_value (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:830
#19 0x000000000040b064 in parse_array (lex=0x7fffffffe110, flags=0, error=0x7fffffffe2e0) at load.c:755
(More stack frames follow...)

[dev-zzo]

This is caused due to an unlimited parsing depth when parsing JSON arrays; this allows the parse_value() -> parse_array() -> parse_value() chain to grow without limit. To that end, a similar effect may be achieved via objects, using a patter of {"a": repeated 1000s, triggering the parse_value() -> parse_object() -> parse_value() chain.

[gaa-cifasis]

To that end, a similar effect may be achieved via objects, using a patter of {"a": repeated 1000s, triggering the parse_value() -> parse_object() -> parse_value() chain.

Indeed. It takes a less than 100kb json file to crash the library, which is bad if you are receiving untrusted inputs. Is there any plans to limit the parsing depth?

[dev-zzo]

I have no idea since I'm not the maintainer. I think I could throw a patch together to fix the root cause, though.

[dev-zzo]

The fix is in pull request #283.

[akheron]

Fixed in #284

[junovitch]

Hi folks. We have reports on FreeBSD that the change in #284 causes a regression on large flat JSON files. The report is https://bugs.FreeBSD.org/209492.

Any recommendations?

[dev-zzo]

@junovitch would be awesome if you could a) open a separate issue with b) a sample attached for testing and c) link to the exact patch applied by FreeBSD.