diff options
author | Dmitry Janushkevich <gauri@tut.by> | 2016-05-02 13:59:26 +0200 |
---|---|---|
committer | Administrator <gauri@tut.by> | 2016-05-03 10:22:06 +0200 |
commit | 64ce0ad3731ebd77e02897b07920eadd0e2cc318 (patch) | |
tree | c62094087ae441d6cb94cb20a3e2376dcdbaaf31 /src | |
parent | 087ed94c452ecade26447c14605cd419e970cfd2 (diff) | |
download | jansson-64ce0ad3731ebd77e02897b07920eadd0e2cc318.zip jansson-64ce0ad3731ebd77e02897b07920eadd0e2cc318.tar.gz jansson-64ce0ad3731ebd77e02897b07920eadd0e2cc318.tar.bz2 |
Fix for issue #282
The fix limits recursion depths when parsing arrays and objects.
The limit is configurable via the `JSON_PARSER_MAX_DEPTH` setting
within `jansson_config.h` and is set by default to 2048.
Update the RFC conformance document to note the limit; the RFC
allows limits to be set by the implementation so nothing has
actually changed w.r.t. conformance state.
Reported by Gustavo Grieco.
Diffstat (limited to 'src')
-rw-r--r-- | src/jansson_config.h.in | 4 | ||||
-rw-r--r-- | src/load.c | 10 |
2 files changed, 14 insertions, 0 deletions
diff --git a/src/jansson_config.h.in b/src/jansson_config.h.in index 12580a0..aa02160 100644 --- a/src/jansson_config.h.in +++ b/src/jansson_config.h.in @@ -36,4 +36,8 @@ otherwise to 0. */ #define JSON_HAVE_LOCALECONV @json_have_localeconv@ +/* Maximum recursion depth for parsing JSON input. + This limits the depth of e.g. array-within-array constructions. */ +#define JSON_PARSER_MAX_DEPTH 2048 + #endif @@ -62,6 +62,7 @@ typedef struct { stream_t stream; strbuffer_t saved_text; size_t flags; + size_t depth; int token; union { struct { @@ -803,6 +804,12 @@ static json_t *parse_value(lex_t *lex, size_t flags, json_error_t *error) { json_t *json; + lex->depth++; + if(lex->depth > JSON_PARSER_MAX_DEPTH) { + error_set(error, lex, "maximum parsing depth reached"); + return NULL; + } + switch(lex->token) { case TOKEN_STRING: { const char *value = lex->value.string.val; @@ -865,6 +872,7 @@ static json_t *parse_value(lex_t *lex, size_t flags, json_error_t *error) if(!json) return NULL; + lex->depth--; return json; } @@ -872,6 +880,8 @@ static json_t *parse_json(lex_t *lex, size_t flags, json_error_t *error) { json_t *result; + lex->depth = 0; + lex_scan(lex, error); if(!(flags & JSON_DECODE_ANY)) { if(lex->token != '[' && lex->token != '{') { |