Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for issue #282 #284

Merged
merged 1 commit into from May 3, 2016
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Fix for issue #282
The fix limits recursion depths when parsing arrays and objects.
The limit is configurable via the `JSON_PARSER_MAX_DEPTH` setting
within `jansson_config.h` and is set by default to 2048.

Update the RFC conformance document to note the limit; the RFC
allows limits to be set by the implementation so nothing has
actually changed w.r.t. conformance state.

Reported by Gustavo Grieco.
  • Loading branch information
dev-zzo committed May 3, 2016
commit 64ce0ad3731ebd77e02897b07920eadd0e2cc318
4 changes: 4 additions & 0 deletions android/jansson_config.h
Expand Up @@ -36,4 +36,8 @@
otherwise to 0. */
#define JSON_HAVE_LOCALECONV 0

/* Maximum recursion depth for parsing JSON input.
This limits the depth of e.g. array-within-array constructions. */
#define JSON_PARSER_MAX_DEPTH 2048

#endif
4 changes: 4 additions & 0 deletions cmake/jansson_config.h.cmake
Expand Up @@ -60,5 +60,9 @@
#define JSON_HAVE_LOCALECONV @JSON_HAVE_LOCALECONV@


/* Maximum recursion depth for parsing JSON input.
This limits the depth of e.g. array-within-array constructions. */
#define JSON_PARSER_MAX_DEPTH 2048


#endif
10 changes: 10 additions & 0 deletions doc/conformance.rst
Expand Up @@ -108,3 +108,13 @@ types, ``long double``, etc. Obviously, shorter types like ``short``,
are implicitly handled via the ordinary C type coercion rules (subject
to overflow semantics). Also, no support or hooks are provided for any
supplemental "bignum" type add-on packages.

Depth of nested values
----------------------

To avoid stack exhaustion, Jansson currently limits the nesting depth
for arrays and objects to a certain value (default: 2048), defined as
a macro ``JSON_PARSER_MAX_DEPTH`` within ``jansson_config.h``.

The limit is allowed to be set by the RFC; there is no recommended value
or required minimum depth to be supported.
4 changes: 4 additions & 0 deletions src/jansson_config.h.in
Expand Up @@ -36,4 +36,8 @@
otherwise to 0. */
#define JSON_HAVE_LOCALECONV @json_have_localeconv@

/* Maximum recursion depth for parsing JSON input.
This limits the depth of e.g. array-within-array constructions. */
#define JSON_PARSER_MAX_DEPTH 2048

#endif
10 changes: 10 additions & 0 deletions src/load.c
Expand Up @@ -62,6 +62,7 @@ typedef struct {
stream_t stream;
strbuffer_t saved_text;
size_t flags;
size_t depth;
int token;
union {
struct {
Expand Down Expand Up @@ -803,6 +804,12 @@ static json_t *parse_value(lex_t *lex, size_t flags, json_error_t *error)
{
json_t *json;

lex->depth++;
if(lex->depth > JSON_PARSER_MAX_DEPTH) {
error_set(error, lex, "maximum parsing depth reached");
return NULL;
}

switch(lex->token) {
case TOKEN_STRING: {
const char *value = lex->value.string.val;
Expand Down Expand Up @@ -865,13 +872,16 @@ static json_t *parse_value(lex_t *lex, size_t flags, json_error_t *error)
if(!json)
return NULL;

lex->depth--;
return json;
}

static json_t *parse_json(lex_t *lex, size_t flags, json_error_t *error)
{
json_t *result;

lex->depth = 0;

lex_scan(lex, error);
if(!(flags & JSON_DECODE_ANY)) {
if(lex->token != '[' && lex->token != '{') {
Expand Down
2 changes: 2 additions & 0 deletions test/suites/invalid/recursion-depth/error
@@ -0,0 +1,2 @@
1 2049 2049
maximum parsing depth reached near '['
1 change: 1 addition & 0 deletions test/suites/invalid/recursion-depth/input

Large diffs are not rendered by default.