Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

infinite loop in Delete #188

Closed
wangcong15 opened this issue Mar 9, 2020 · 3 comments
Closed

infinite loop in Delete #188

wangcong15 opened this issue Mar 9, 2020 · 3 comments

Comments

@wangcong15
Copy link

Hi. A call to function Delete may cause infinite loop. I wish you could take a look.
https://play.golang.org/p/kzKY-Z9ty_j

package main

import (
	"fmt"
	"github.com/buger/jsonparser"
)

func main() {
	data1 := []byte("^_�^C^A^@[")
	data2 := ""
	
	// sink: this function leads to an inifinite loop
	jsonparser.Delete(data1, data2)
	
	// code go hanged. So the last line won't be printed
	fmt.Println("Things go right!")
}
zengjinzheng pushed a commit to zengjinzheng/jsonparser that referenced this issue Mar 16, 2020
Fix issue buger#188
e28101a
zengjinzheng pushed a commit to zengjinzheng/jsonparser that referenced this issue Mar 16, 2020
Fix issue buger#188
d698b4c
zengjinzheng pushed a commit to zengjinzheng/jsonparser that referenced this issue Mar 17, 2020
Fix issue buger#188
9584947
zengjinzheng pushed a commit to zengjinzheng/jsonparser that referenced this issue Mar 17, 2020
Fix issue buger#188
1dc7c82
@AllenX2018 AllenX2018 mentioned this issue Mar 19, 2020
Merged
@carnil
Copy link

carnil commented Mar 20, 2020

This issue appears to have been assigned CVE-2020-10675.

buger pushed a commit that referenced this issue Mar 21, 2020
@AllenX2018
fix issue 188 (#192)
91ac968 
**Description**: This pr fix issue #188. If `findKeyStart` meets a `[` or `{`, it should not add i with `blockEnd`’s return value directly because it may return -1 if it did not find the close symbol
@KingB504
Copy link

Gf

@KingB504
Copy link

This is grrsy

naveensrinivasan added a commit to ossf/scorecard that referenced this issue Sep 21, 2021
@naveensrinivasan
🌱 Fix GO-2021-0089 vulnerability
2b4b07d 
The github.com/buger/jsonparser has this vulnerability.

"vulns": [
        {
          "id": "GO-2021-0089",
          "package": {
            "name": "github.com/buger/jsonparser",
            "ecosystem": "Go"
          },
          "details": "Parsing malformed JSON which contain opening brackets, but not closing brackes,\nleads to an infinite loop. If operating on untrusted user input this can be\nused as a denial of service vector.\n",
          "affects": {
            "ranges": [
              {
                "type": "SEMVER",
                "fixed": "0.0.0-20200321185410-91ac96899e49"
              }
            ]
          },
          "aliases": [
            "CVE-2020-10675"
          ],
          "modified": "2021-04-14T12:00:00Z",
          "published": "2021-04-14T12:00:00Z",
          "ecosystem_specific": {
            "symbols": [
              "findKeyStart"
            ]
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/go-vulndb/github.com/buger/jsonparser.json",
            "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2021-0089.yaml"
          },
          "references": [
            {
              "type": "FIX",
              "url": "buger/jsonparser#192"
            },
            {
              "type": "FIX",
              "url": "buger/jsonparser@91ac968"
            },
            {
              "type": "WEB",
              "url": "buger/jsonparser#188"
            }
          ],
          "affected": [
            {
              "package": {
                "name": "github.com/buger/jsonparser",
                "ecosystem": "Go"
              },
              "ranges": [
                {
                  "type": "SEMVER",
                  "events": [
                    {
                      "introduced": "0"
                    },
                    {
                      "fixed": "0.0.0-20200321185410-91ac96899e49"
                    }
                  ]
                }
              ],
              "ecosystem_specific": {
                "symbols": [
                  "findKeyStart"
                ]
              },
              "database_specific": {
                "source": "https://storage.googleapis.com/go-vulndb/github.com/buger/jsonparser.json",
                "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2021-0089.yaml"
              }
            }
          ]
        },
        {
          "id": "GO-2021-0057",
          "package": {
            "name": "github.com/buger/jsonparser",
            "ecosystem": "Go"
          },
          "details": "Due to improper bounds checking, maliciously crafted JSON objects\ncan cause an out-of-bounds panic. If parsing user input, this may\nbe used as a denial of service vector.\n",
          "affects": {
            "ranges": [
              {
                "type": "SEMVER",
                "fixed": "1.1.1"
              }
            ]
          },
          "aliases": [
            "CVE-2020-35381"
          ],
          "modified": "2021-04-14T12:00:00Z",
          "published": "2021-04-14T12:00:00Z",
          "ecosystem_specific": {
            "symbols": [
              "searchKeys"
            ]
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/go-vulndb/github.com/buger/jsonparser.json",
            "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2021-0057.yaml"
          },
          "references": [
            {
              "type": "FIX",
              "url": "buger/jsonparser#221"
            },
            {
              "type": "FIX",
              "url": "buger/jsonparser@df3ea76"
            },
            {
              "type": "WEB",
              "url": "buger/jsonparser#219"
            }
          ],
          "affected": [
            {
              "package": {
                "name": "github.com/buger/jsonparser",
                "ecosystem": "Go"
              },
              "ranges": [
                {
                  "type": "SEMVER",
                  "events": [
                    {
                      "introduced": "0"
                    },
                    {
                      "fixed": "1.1.1"
                    }
                  ]
                }
              ],
              "ecosystem_specific": {
                "symbols": [
                  "searchKeys"
                ]
              },
              "database_specific": {
                "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2021-0057.yaml",
                "source": "https://storage.googleapis.com/go-vulndb/github.com/buger/jsonparser.json"
              }
            }
          ]
        }
      ]
    }
naveensrinivasan added a commit to ossf/scorecard that referenced this issue Sep 21, 2021
@naveensrinivasan
🌱 Fix GO-2021-0089 vulnerability
51e11e6 
The github.com/buger/jsonparser has this vulnerability.

"vulns": [
        {
          "id": "GO-2021-0089",
          "package": {
            "name": "github.com/buger/jsonparser",
            "ecosystem": "Go"
          },
          "details": "Parsing malformed JSON which contain opening brackets, but not closing brackes,\nleads to an infinite loop. If operating on untrusted user input this can be\nused as a denial of service vector.\n",
          "affects": {
            "ranges": [
              {
                "type": "SEMVER",
                "fixed": "0.0.0-20200321185410-91ac96899e49"
              }
            ]
          },
          "aliases": [
            "CVE-2020-10675"
          ],
          "modified": "2021-04-14T12:00:00Z",
          "published": "2021-04-14T12:00:00Z",
          "ecosystem_specific": {
            "symbols": [
              "findKeyStart"
            ]
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/go-vulndb/github.com/buger/jsonparser.json",
            "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2021-0089.yaml"
          },
          "references": [
            {
              "type": "FIX",
              "url": "buger/jsonparser#192"
            },
            {
              "type": "FIX",
              "url": "buger/jsonparser@91ac968"
            },
            {
              "type": "WEB",
              "url": "buger/jsonparser#188"
            }
          ],
          "affected": [
            {
              "package": {
                "name": "github.com/buger/jsonparser",
                "ecosystem": "Go"
              },
              "ranges": [
                {
                  "type": "SEMVER",
                  "events": [
                    {
                      "introduced": "0"
                    },
                    {
                      "fixed": "0.0.0-20200321185410-91ac96899e49"
                    }
                  ]
                }
              ],
              "ecosystem_specific": {
                "symbols": [
                  "findKeyStart"
                ]
              },
              "database_specific": {
                "source": "https://storage.googleapis.com/go-vulndb/github.com/buger/jsonparser.json",
                "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2021-0089.yaml"
              }
            }
          ]
        },
        {
          "id": "GO-2021-0057",
          "package": {
            "name": "github.com/buger/jsonparser",
            "ecosystem": "Go"
          },
          "details": "Due to improper bounds checking, maliciously crafted JSON objects\ncan cause an out-of-bounds panic. If parsing user input, this may\nbe used as a denial of service vector.\n",
          "affects": {
            "ranges": [
              {
                "type": "SEMVER",
                "fixed": "1.1.1"
              }
            ]
          },
          "aliases": [
            "CVE-2020-35381"
          ],
          "modified": "2021-04-14T12:00:00Z",
          "published": "2021-04-14T12:00:00Z",
          "ecosystem_specific": {
            "symbols": [
              "searchKeys"
            ]
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/go-vulndb/github.com/buger/jsonparser.json",
            "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2021-0057.yaml"
          },
          "references": [
            {
              "type": "FIX",
              "url": "buger/jsonparser#221"
            },
            {
              "type": "FIX",
              "url": "buger/jsonparser@df3ea76"
            },
            {
              "type": "WEB",
              "url": "buger/jsonparser#219"
            }
          ],
          "affected": [
            {
              "package": {
                "name": "github.com/buger/jsonparser",
                "ecosystem": "Go"
              },
              "ranges": [
                {
                  "type": "SEMVER",
                  "events": [
                    {
                      "introduced": "0"
                    },
                    {
                      "fixed": "1.1.1"
                    }
                  ]
                }
              ],
              "ecosystem_specific": {
                "symbols": [
                  "searchKeys"
                ]
              },
              "database_specific": {
                "url": "https://go.googlesource.com/vulndb/+/refs/heads/master/reports/GO-2021-0057.yaml",
                "source": "https://storage.googleapis.com/go-vulndb/github.com/buger/jsonparser.json"
              }
            }
          ]
        }
      ]
    }
@vindhyahegde31 vindhyahegde31 mentioned this issue Oct 27, 2022
Closed
@buger buger mentioned this issue Jan 25, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@carnil @wangcong15 @KingB504