Fix for issue #282

The fix limits recursion depths when parsing arrays and objects.
The limit is configurable via the `JSON_PARSER_MAX_DEPTH` setting
within `jansson_config.h` and is set by default to 2048.

Update the RFC conformance document to note the limit; the RFC
allows limits to be set by the implementation so nothing has
actually changed w.r.t. conformance state.

Reported by Gustavo Grieco.

1 files changed, 10 insertions, 0 deletions

diff --git a/src/load.c b/src/load.c
index 614a845..33a260a 100644
--- a/src/load.c
+++ b/src/load.c
@@ -62,6 +62,7 @@ typedef struct {
     stream_t stream;
     strbuffer_t saved_text;
     size_t flags;
+    size_t depth;
     int token;
     union {
         struct {
@@ -803,6 +804,12 @@ static json_t *parse_value(lex_t *lex, size_t flags, json_error_t *error)
 {
     json_t *json;
 
+    lex->depth++;
+    if(lex->depth > JSON_PARSER_MAX_DEPTH) {
+        error_set(error, lex, "maximum parsing depth reached");
+        return NULL;
+    }
+
     switch(lex->token) {
         case TOKEN_STRING: {
             const char *value = lex->value.string.val;
@@ -865,6 +872,7 @@ static json_t *parse_value(lex_t *lex, size_t flags, json_error_t *error)
     if(!json)
         return NULL;
 
+    lex->depth--;
     return json;
 }
 
@@ -872,6 +880,8 @@ static json_t *parse_json(lex_t *lex, size_t flags, json_error_t *error)
 {
     json_t *result;
 
+    lex->depth = 0;
+
     lex_scan(lex, error);
     if(!(flags & JSON_DECODE_ANY)) {
         if(lex->token != '[' && lex->token != '{') {