Skip to content

Calling JsonPointer.compile(...) on very deeply nested expression throws StackOverflowError #818

Closed
@cowtowncoder

Description

@cowtowncoder

(note: found by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51806)

When trying to compile JsonPointer expressions with thousands (on my machine 6000 or more) of path segments, a StackOverflowError is thrown as parser uses simple recursive technique. This should be prevented by, for example:

  1. Imposing maximum depth (1000?) and simply failing cleanly
  2. Rewriting method to use iterative+stack approach to increase limit to be relative to heap space size (million(s) of segments).

Note: this does not appear like something straight-forward to use by malicious actors since JsonPointer instances are not typically read from untrusted contents. Although as with anything else there may be specific individual cases where this could be a vector.

Metadata

Metadata

Assignees

No one assigned

    Labels

    oss-fuzzIssue uncovered by oss-fuzz fuzzer

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions