Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Calling JsonPointer.compile(...) on very deeply nested expression throws StackOverflowError #818

Closed
cowtowncoder opened this issue Oct 2, 2022 · 1 comment
Labels
2.14 Issue planned (at earliest) for 2.14 oss-fuzz Issue uncovered by oss-fuzz fuzzer
Milestone

Comments

@cowtowncoder
Copy link
Member

(note: found by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51806)

When trying to compile JsonPointer expressions with thousands (on my machine 6000 or more) of path segments, a StackOverflowError is thrown as parser uses simple recursive technique. This should be prevented by, for example:

  1. Imposing maximum depth (1000?) and simply failing cleanly
  2. Rewriting method to use iterative+stack approach to increase limit to be relative to heap space size (million(s) of segments).

Note: this does not appear like something straight-forward to use by malicious actors since JsonPointer instances are not typically read from untrusted contents. Although as with anything else there may be specific individual cases where this could be a vector.

@cowtowncoder cowtowncoder added 2.14 Issue planned (at earliest) for 2.14 oss-fuzz Issue uncovered by oss-fuzz fuzzer labels Oct 2, 2022
cowtowncoder added a commit that referenced this issue Oct 3, 2022
@cowtowncoder cowtowncoder added this to the 2.14.0 milestone Oct 5, 2022
@cowtowncoder
Copy link
Member Author

Rewrite decoder/parser to use explicit stack instead of recursive calls, resolving the SO issue.
Will be in 2.14.0-rc2 and final 2.14.0; no plans to backport.

@pjfanning pjfanning changed the title Calling JsonPointer.compile(...) on very deeply nested expression throws StackOverflowErrror Calling JsonPointer.compile(...) on very deeply nested expression throws StackOverflowError Feb 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2.14 Issue planned (at earliest) for 2.14 oss-fuzz Issue uncovered by oss-fuzz fuzzer
Projects
None yet
Development

No branches or pull requests

1 participant