1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
From: UrielCh <uriel.chemouni@gmail.com>
Date: Sun, 5 Mar 2023 13:01:10 +0200
Subject: CVE-2023-1370: stack overflow due to excessive recursion
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code
parses an array or an object respectively. It was discovered that the
code does not have any limit to the nesting of such arrays or
objects. Since the parsing of nested arrays and objects is done
recursively, nesting too many of them can cause a stack exhaustion
(stack overflow) and crash the software.
origin: https://github.com/netplex/json-smart-v2/commit/5b3205d051952d3100aa0db1535f6ba6226bd87a.patch
bug: https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/
bug-debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033474
---
.../net/minidev/json/parser/JSONParserBase.java | 17 +++++++++++++-
.../net/minidev/json/parser/ParseException.java | 9 +++++++-
.../java/net/minidev/json/test/TestOverflow.java | 27 ++++++++++++++++++++++
3 files changed, 51 insertions(+), 2 deletions(-)
create mode 100644 json-smart/src/test/java/net/minidev/json/test/TestOverflow.java
diff --git a/json-smart/src/main/java/net/minidev/json/parser/JSONParserBase.java b/json-smart/src/main/java/net/minidev/json/parser/JSONParserBase.java
index 96d6bb6..f65b8c5 100644
--- a/json-smart/src/main/java/net/minidev/json/parser/JSONParserBase.java
+++ b/json-smart/src/main/java/net/minidev/json/parser/JSONParserBase.java
@@ -20,6 +20,7 @@ import static net.minidev.json.parser.ParseException.ERROR_UNEXPECTED_EOF;
import static net.minidev.json.parser.ParseException.ERROR_UNEXPECTED_LEADING_0;
import static net.minidev.json.parser.ParseException.ERROR_UNEXPECTED_TOKEN;
import static net.minidev.json.parser.ParseException.ERROR_UNEXPECTED_UNICODE;
+import static net.minidev.json.parser.ParseException.ERROR_UNEXPECTED_JSON_DEPTH;
import java.io.IOException;
import java.math.BigDecimal;
@@ -39,6 +40,12 @@ import net.minidev.json.writer.JsonReaderI;
*/
abstract class JSONParserBase {
protected char c;
+ /**
+ * hard coded maximal depth for JSON parsing
+ */
+ public final static int MAX_DEPTH = 400;
+ protected int depth = 0;
+
JsonReader base;
public final static byte EOI = 0x1A;
protected static final char MAX_STOP = 126; // '}' -> 125
@@ -232,9 +239,12 @@ abstract class JSONParserBase {
abstract protected void read() throws IOException;
protected <T> T readArray(JsonReaderI<T> mapper) throws ParseException, IOException {
- Object current = mapper.createArray();
if (c != '[')
throw new RuntimeException("Internal Error");
+ if (++this.depth > MAX_DEPTH) {
+ throw new ParseException(pos, ERROR_UNEXPECTED_JSON_DEPTH, c);
+ }
+ Object current = mapper.createArray();
read();
boolean needData = false;
//
@@ -249,6 +259,7 @@ abstract class JSONParserBase {
case ']':
if (needData && !acceptUselessComma)
throw new ParseException(pos, ERROR_UNEXPECTED_CHAR, (char) c);
+ this.depth--;
read(); /* unstack */
//
return mapper.convert(current);
@@ -485,6 +496,9 @@ abstract class JSONParserBase {
//
if (c != '{')
throw new RuntimeException("Internal Error");
+ if (++this.depth > MAX_DEPTH) {
+ throw new ParseException(pos, ERROR_UNEXPECTED_JSON_DEPTH, c);
+ }
Object current = mapper.createObject();
boolean needData = false;
boolean acceptData = true;
@@ -504,6 +518,7 @@ abstract class JSONParserBase {
case '}':
if (needData && !acceptUselessComma)
throw new ParseException(pos, ERROR_UNEXPECTED_CHAR, (char) c);
+ this.depth--;
read(); /* unstack */
//
return mapper.convert(current);
diff --git a/json-smart/src/main/java/net/minidev/json/parser/ParseException.java b/json-smart/src/main/java/net/minidev/json/parser/ParseException.java
index e652cf2..42f11f2 100644
--- a/json-smart/src/main/java/net/minidev/json/parser/ParseException.java
+++ b/json-smart/src/main/java/net/minidev/json/parser/ParseException.java
@@ -1,7 +1,7 @@
package net.minidev.json.parser;
/*
- * Copyright 2011 JSON-SMART authors
+ * Copyright 2011-2023 JSON-SMART authors
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -30,6 +30,7 @@ public class ParseException extends Exception {
public static final int ERROR_UNEXPECTED_UNICODE = 4;
public static final int ERROR_UNEXPECTED_DUPLICATE_KEY = 5;
public static final int ERROR_UNEXPECTED_LEADING_0 = 6;
+ public static final int ERROR_UNEXPECTED_JSON_DEPTH = 7;
private int errorType;
private Object unexpectedObject;
@@ -114,6 +115,12 @@ public class ParseException extends Exception {
sb.append(" at position ");
sb.append(position);
sb.append(".");
+ } else if (errorType == ERROR_UNEXPECTED_JSON_DEPTH) {
+ sb.append("Malicious payload, having non natural depths, parsing stoped on ");
+ sb.append(unexpectedObject);
+ sb.append(" at position ");
+ sb.append(position);
+ sb.append(".");
} else {
sb.append("Unkown error at position ");
sb.append(position);
diff --git a/json-smart/src/test/java/net/minidev/json/test/TestOverflow.java b/json-smart/src/test/java/net/minidev/json/test/TestOverflow.java
new file mode 100644
index 0000000..18b52e7
--- /dev/null
+++ b/json-smart/src/test/java/net/minidev/json/test/TestOverflow.java
@@ -0,0 +1,27 @@
+package net.minidev.json.test;
+
+import junit.framework.TestCase;
+import net.minidev.json.JSONValue;
+import net.minidev.json.parser.ParseException;
+
+public class TestOverflow extends TestCase {
+ public void testStress() throws Exception {
+ int size = 10000;
+ StringBuilder sb = new StringBuilder(10 + size*4);
+ for (int i=0; i < size; i++) {
+ sb.append("{a:");
+ }
+ sb.append("true");
+ for (int i=0; i < size; i++) {
+ sb.append("}");
+ }
+ String s = sb.toString();
+ try {
+ JSONValue.parseWithException(s);
+ } catch (ParseException e) {
+ assertEquals(e.getErrorType(), ParseException.ERROR_UNEXPECTED_JSON_DEPTH);
+ return;
+ }
+ assertEquals(0,1);
+ }
+}
|
