nlohmann / json

JSON for Modern C++
https://json.nlohmann.me
MIT License
42.01k stars 6.63k forks source link

heap corruption when i use nlohmann::json::accept function to check a valid json #3994

Closed pengsel closed 11 months ago

pengsel commented 1 year ago

Description

i use nlohmann::json::accept to check the format of a string, but my program corrupted and a dump file was found. the dump file shows that a heap corruption occurs when check the json format.

the json string is like: {"accountInfo":0,"userName":""} its length is 867, i delete some unnecessary chars.

the program crash when pase the fifth char "o", as you can see in the callstack

ntdll.dll!RtlpAllocateHeapInternal()    Unknown Non-user code. Symbols loaded.
libdm_interface.dll!_malloc_base(unsigned __int64 size) Line 34 C++ Symbols loaded.
libdm_interface.dll!operator new(unsigned __int64 size=6) Line 35   C++ Non-user code. Symbols loaded.
libdm_interface.dll!std::vector<char,std::allocator<char> >::_Emplace_reallocate<char>(char * const _Whereptr=0x000001f609417874, char && _Val='o') Line 956    C++ Non-user code. Symbols loaded.
libdm_interface.dll!std::vector<char,std::allocator<char> >::emplace_back<char>(char && _Val='o') Line 922  C++ Non-user code. Symbols loaded.
libdm_interface.dll!std::vector<char,std::allocator<char> >::push_back(char && _Val='o') Line 938   C++ Non-user code. Symbols loaded.
libdm_interface.dll!nlohmann::detail::lexer<nlohmann::basic_json<std::map,std::vector,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,bool,long long,unsigned long long,double,std::allocator,adl_serializer,std::vector<unsigned char,std::allocator<unsigned char> > >,nlohmann::detail::iterator_input_adapter<std::_String_const_iterator<std::_String_val<std::_Simple_types<char> > > > >::get() Line 7879   C++ Symbols loaded.
libdm_interface.dll!nlohmann::detail::lexer<nlohmann::basic_json<std::map,std::vector,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,bool,long long,unsigned long long,double,std::allocator,adl_serializer,std::vector<unsigned char,std::allocator<unsigned char> > >,nlohmann::detail::iterator_input_adapter<std::_String_const_iterator<std::_String_val<std::_Simple_types<char> > > > >::scan_string() Line 6787   C++ Symbols loaded.
libdm_interface.dll!nlohmann::detail::lexer<nlohmann::basic_json<std::map,std::vector,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,bool,long long,unsigned long long,double,std::allocator,adl_serializer,std::vector<unsigned char,std::allocator<unsigned char> > >,nlohmann::detail::iterator_input_adapter<std::_String_const_iterator<std::_String_val<std::_Simple_types<char> > > > >::scan() Line 8090  C++ Symbols loaded.
libdm_interface.dll!nlohmann::detail::parser<nlohmann::basic_json<std::map,std::vector,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,bool,long long,unsigned long long,double,std::allocator,adl_serializer,std::vector<unsigned char,std::allocator<unsigned char> > >,nlohmann::detail::iterator_input_adapter<std::_String_const_iterator<std::_String_val<std::_Simple_types<char> > > > >::get_token() Line 11282   C++ Symbols loaded.
libdm_interface.dll!nlohmann::detail::parser<nlohmann::basic_json<std::map,std::vector,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,bool,long long,unsigned long long,double,std::allocator,adl_serializer,std::vector<unsigned char,std::allocator<unsigned char> > >,nlohmann::detail::iterator_input_adapter<std::_String_const_iterator<std::_String_val<std::_Simple_types<char> > > > >::sax_parse_internal<nlohmann::detail::json_sax_acceptor<nlohmann::basic_json<> > >(nlohmann::detail::json_sax_acceptor<nlohmann::basic_json<std::map,std::vector,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,bool,long long,unsigned long long,double,std::allocator,adl_serializer,std::vector<unsigned char,std::allocator<unsigned char> > > > * sax=0x000000ebe9bfd980) Line 11022   C++ Symbols loaded.
libdm_interface.dll!nlohmann::detail::parser<nlohmann::basic_json<std::map,std::vector,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,bool,long long,unsigned long long,double,std::allocator,adl_serializer,std::vector<unsigned char,std::allocator<unsigned char> > >,nlohmann::detail::iterator_input_adapter<std::_String_const_iterator<std::_String_val<std::_Simple_types<char> > > > >::sax_parse<nlohmann::detail::json_sax_acceptor<nlohmann::basic_json<> > >(nlohmann::detail::json_sax_acceptor<nlohmann::basic_json<std::map,std::vector,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,bool,long long,unsigned long long,double,std::allocator,adl_serializer,std::vector<unsigned char,std::allocator<unsigned char> > > > * sax=0x000000ebe9bfd980, const bool strict=true) Line 10983    C++ Symbols loaded.
libdm_interface.dll!nlohmann::detail::parser<nlohmann::basic_json<std::map,std::vector,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,bool,long long,unsigned long long,double,std::allocator,adl_serializer,std::vector<unsigned char,std::allocator<unsigned char> > >,nlohmann::detail::iterator_input_adapter<std::_String_const_iterator<std::_String_val<std::_Simple_types<char> > > > >::accept(const bool strict=true) Line 10975    C++ Symbols loaded.
>   libdm_interface.dll!nlohmann::basic_json<std::map,std::vector,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,bool,long long,unsigned long long,double,std::allocator,adl_serializer,std::vector<unsigned char,std::allocator<unsigned char> > >::accept<const std::basic_string<char> &>(const std::basic_string<char,std::char_traits<char>,std::allocator<char> > & i, const bool ignore_comments=false) Line 24377 C++ Symbols loaded.
libdm_interface.dll!DM::CheckJsonFormat(const std::basic_string<char,std::char_traits<char>,std::allocator<char> > & deviceStr, nlohmann::basic_json<std::map,std::vector,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,bool,long long,unsigned long long,double,std::allocator,adl_serializer,std::vector<unsigned char,std::allocator<unsigned char> > > & deviceJson={...}) Line 24   C++ Symbols loaded.

Reproduction steps

i can't reproduct it by certain steps, it appears irregularly

Expected vs. actual results

Expect it return true, but the program crashed.

Minimal code example

No response

Error messages

No response

Compiler and operating system

Clang 3.4, Windows

Library version

3.10.0

Validation

nlohmann commented 1 year ago

We test the library with memory sanitizers and Valgrind. I do not believe this to be a library error. Waiting for a complete example.