search

zserge / jsmn

Jsmn is a world fastest JSON parser/tokenizer. This is the official repo replacing the old one at Bitbucket
MIT License
3.65k stars 778 forks source link

Possible buffer overflow with nested array in hash #110

Open Asmod4n opened 7 years ago

Asmod4n commented 7 years ago

The following input results in a overflow

'{ "name" : "Jack", "age" : 27, "legend" : false, "nested": [1, 2, [3, 4], {"foo": 1, [3, 4]}] }'

This can be triggered when jsondump.c gets changed a little, namely

tokcount = tokcount * 2;

at line 112 must be changed to

tokcount++;

I am using jsmn_parse(&p, js, NULL, 0); to get the number of tokens i need to allocate, when i add one more token it doesn't crash but believes [3,4] is a object key and the value isn't tokenised.

Doesn't matter if strict mode or parent links are enabled.