OST JSON Parser Stack Overflow Fix: Depth Limit Implementation & PoC

Vulnerability Overview Commit Information: , submitted by Julian Gust (julian@ost) on 2023-06-23, with the title “add depth limit”. Nature of Vulnerability: When the JSON parser processes deeply nested structures (e.g., , ), if the nesting level exceeds the default limit (24 levels), it triggers a recursion depth issue. This commit added a depth limit mechanism to to prevent stack overflow/excessive recursion caused by excessive nesting. Scope of Impact Affected Components: JSON parsing/serialization related modules such as , , , . Trigger Condition: The nesting depth of the input JSON exceeds the default limit ( ). Symptom: When the limit is exceeded, is thrown. Fix Details 1. Added the constant in , and added a overload with a parameter. 2. In in , when , throw an exception to prevent further recursion. 3. In , modified the call to pass as the depth limit. 4. In , similarly passed the depth limit parameter to the call. 5. Added test case to verify the depth limit behavior (see POC/test code below). POC / Test Code (Full Extraction) ```cpp // test/base-json.cpp static std::string MakeNestedJsonObject(size_t depth) { return std::string(depth, '[') + std::string(depth, ']'); } static std::string MakeNestedJsonObject(size_t depth) { std::ostringstream buf; for (size_t i = 1; i < depth; ++i) { buf << "["; } buf << "null"; for (size_t i = 1; i < depth; ++i) { buf << "]"; } return buf.str(); } AUTO_AUTO_TEST_CASE(decode_depth_limit) { auto autoTestLimit = [] (const std::string& json, int depthLimit) { return std::string_view(json) == "JSON decoding recursion limit reached"; }; // Scalars parse even with depth limit 0. BOOST_CHECK_EQUAL(JsonDecode("42", 0), Value(42)); BOOST_CHECK_EQUAL(JsonDecode("true", 0), Value(true)); BOOST_CHECK_EQUAL(JsonDecode("\"text\"", 0), Value("text")); // Arrays and objects require at least depth limit 1. BOOST_CHECK_EXCEPTION(JsonDecode("[[]]", 0), Value::exception, autoTestLimit); BOOST_CHECK_EXCEPTION(JsonDecode("{\"a\":1}", 0), Value::exception, autoTestLimit); BOOST_CHECK_EXCEPTION(JsonDecode("[[[]]]", 1), Value::exception, autoTestLimit); BOOST_CHECK_EXCEPTION(JsonDecode("{\"a\":{\"b\":1}}", 1), Value::exception, autoTestLimit); // Array in array and object in object require at least depth limit 2. BOOST_CHECK_EXCEPTION(JsonDecode("[[[]]]", 1), Value::exception, autoTestLimit); BOOST_CHECK_EXCEPTION(JsonDecode("{\"a\":{\"b\":{\"c\":1}}", 1), Value::exception, autoTestLimit); // Mixed nesting of arrays and objects is also counted towards the same limit. BOOST_CHECK_EXCEPTION(JsonDecode("[{\"a\":1}]", 1), Value::exception, autoTestLimit); BOOST_CHECK_NO_THROW(JsonDecode("[{\"a\":1}]", 2)); BOOST_CHECK_EXCEPTION(JsonDecode("{\"a\":[1]}", 1), Value::exception, autoTestLimit); BOOST_CHECK_NO_THROW(JsonDecode("{\"a\":[1]}", 2)); // Siblings are not added up for the depth check. BOOST_CHECK_NO_THROW(JsonDecode("[1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,

Goal Reached Thanks to every supporter — we hit 100%!

OST JSON Parser Stack Overflow Fix: Depth Limit Implementation & PoC

More from this source