Closed
Description
(note: found by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51806)
When trying to compile JsonPointer
expressions with thousands (on my machine 6000 or more) of path segments, a StackOverflowError
is thrown as parser uses simple recursive technique. This should be prevented by, for example:
- Imposing maximum depth (1000?) and simply failing cleanly
- Rewriting method to use iterative+stack approach to increase limit to be relative to heap space size (million(s) of segments).
Note: this does not appear like something straight-forward to use by malicious actors since JsonPointer
instances are not typically read from untrusted contents. Although as with anything else there may be specific individual cases where this could be a vector.