jsoncpp Depth Limit Mitigation for Stack Overflow Vulnerability

Vulnerability Overview This commit (Commit 4964d24) introduces a depth limit mechanism to the library. Its primary purpose is to prevent stack overflow caused by parsing deeply nested JSON structures (such as deeply nested arrays or objects). This mechanism addresses the issue by restricting the maximum nesting depth for JSON parsing (default value is 24). Scope of Impact Affected Components: The JSON parser in the library ( / ). Trigger Conditions: When the nesting level of the JSON data being parsed exceeds the set depth limit, the parser throws an exception ( ), thereby avoiding crashes caused by stack overflow. Remediation 1. Introduction of Depth Limit Parameter: A parameter has been added to and , allowing callers to customize the maximum nesting depth. 2. Default Value Setting: The default depth limit is set to 24 levels. 3. Exception Handling: When the parsing depth exceeds the limit, a exception is thrown with the message "JSON decoding recursion limit reached". POC / Exploitation Code The screenshot includes test code used to verify the fix for this vulnerability (located in ): ```cpp // Test case: Verify depth limit functionality BOOST_AUTO_TEST_CASE(decode_depth_limit) { auto isDepthLimit = [](const std::exception& ex) { return std::string(ex.what()) == "JSON decoding recursion limit reached"; }; // Construct a JSON string with a nesting depth of 42 static std::string MakeNestedJson(size_t depth) { std::string buf; for (size_t i = 0; i < depth; ++i) { buf += "["; } for (size_t i = 0; i < depth; ++i) { buf += "]"; } return buf; } // Test: Nesting depth 42 exceeds the default limit of 24, should throw an exception BOOST_CHECK_THROWS(Json::decode(MakeNestedJson(42), 0), std::exception, isDepthLimit); BOOST_CHECK_NO_THROW(Json::decode(MakeNestedJson(24), 0)); // Test: Mixed nesting (objects + arrays) std::string objWithNestedArray2 = MakeNestedJson(42); BOOST_CHECK_THROWS(Json::decode(objWithNestedArray2, 42), std::exception, isDepthLimit); BOOST_CHECK_NO_THROW(Json::decode(objWithNestedArray2, 43)); // Test: Deeply nested objects std::string objWithNestedObj2 = MakeNestedJson(42); BOOST_CHECK_THROWS(Json::decode(objWithNestedObj2, 42), std::exception, isDepthLimit); BOOST_CHECK_NO_THROW(Json::decode(objWithNestedObj2, 43)); // Test: Mixed nesting structure std::string mixedNesting = R"( { "1st-level": [ "2nd-level": [ "3rd-level": [ "4th-level": [ "5th-level": [ "6th-level": [ "7th-level": [ "8th-level": [ "9th-level": [ "10th-level": [ "11th-level": [ "12th-level": [ "13th-level": [ "14th-level": [ "15th-level": [ "16th-level": [ "17th-level": [ "18th-level": [ "19th-level": [ "20th-level": [ "21st-level": [ "22nd-level": [ "23rd-level": [ "24th-level": [ "25th-level": [ "26th-level": [ "27th-level": [ "28th-level": [ "29th-level": [ "30th-level": [ "31st-level": [ "32nd-level": [ "33rd-level": [ "34th-level": [ "35th-level": [ "36th-level": [ "37th-level": [ "38th-level": [ "39th-level": [ "40th-level": [ "41st-level": [ "42nd-level": [ "43rd-level": [ "44th-level": [ "45th-level": [ "46th-level": [ "47th-level": [ "48th-level": [ "49th-level": [ "50th-level": [ "51st-level": [ "52nd-level": [ "53rd-level": [ "54th-level": [ "55th-level": [ "56th-level": [ "57th-level": [ "58th-level": [ "59th-level": [ "60th-level": [ "61st-level": [ "62nd-level": [ "63rd-level": [ "64th-level": [ "65th-level": [ "66th-level": [ "67th-level": [ "68th-level": [ "69th-level": [ "70th-level": [ "71st-level": [ "72nd-level": [ "73rd-level": [ "74th-level": [ "75th-level": [ "76th-level": [ "77th-level": [ "78th-level": [ "79th-level": [ "80th-level": [ "81st-level": [ "82nd-level": [ "83rd-level": [ "84th-level": [ "85th-level": [ "86th-level": [ "87th-level": [ "88th-level": [ "89th-level": [ "90th-level": [ "91st-level": [ "92nd-level": [ "93rd-level": [ "94th-level": [ "95th-level": [ "96th-level": [ "97th-level": [ "98th-level": [ "99th-level": [ "100th-level": [ "101st-level": [ "102nd-level": [ "103rd-level": [ "104th-level": [ "105th-level": [ "106th-level": [ "107th-level": [ "108th-level": [ "109th-level": [ "110th-level": [ "111st-level": [ "112nd-level": [ "113rd-level": [ "114th-level": [ "115th-level": [ "116th-level": [ "117th-level": [ "118th-level": [ "119th-level": [ "120th-level": [ "121st-level": [ "122nd-level": [ "123rd-level": [ "124th-level": [ "125th-level": [ "126th-level": [ "127th-level": [ "128th-level": [ "129th-level": [ "130th-level": [ "131st-level": [ "132nd-level": [ "133rd-level": [ "134th-level": [ "135th-level": [ "136th-level": [ "137th-level": [ "138th-level": [ "139th-level": [ "140th-level": [ "141st-level": [ "142nd-level": [ "143rd-level": [ "144th-level": [ "145th-level": [ "146th-level": [ "147th-level": [ "148th-level": [ "149th-level": [ "150th-level": [ "151st-level": [ "152nd-level": [ "153rd-level": [ "154th-level": [ "155th-level": [ "156th-level": [ "157th-level": [ "158th-level": [ "159th-level": [ "160th-level": [ "161st-level": [ "162nd-level": [ "163rd-level":

Goal Reached Thanks to every supporter — we hit 100%!

jsoncpp Depth Limit Mitigation for Stack Overflow Vulnerability

More from this source