Skip to content

json_prettify stack overflows on deeply nested arrays — no recursion limit #83

@AhmedShAli24

Description

@AhmedShAli24

Found a stack overflow in json_prettify when fed deeply nested JSON. Shouldn't be too hard to reproduce.

What's happening

json_prettify calls json_walk internally, which calls json_parse_value and json_parse_array — those two call each other recursively with no depth cap at all. With a deeply nested array you can get 190+ stack frames before it falls over.

Affected Function: json_prettify → json_walk → json_parse_array / json_parse_value
Source Location: frozen.c:311, frozen.c:356

Crash Input:
[[[[[[[[[[[[[[[[[[[[[[[[{"P":{"b":[[[[[[[[[[[[[[[[[[[{"id":1},...

Crashes with SIGILL (UBSan/ASan abort). Any untrusted JSON passed to json_prettify can trigger this.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions