[Security] Stack Overflow via Uncontrolled Recursion in cJSONUtils_MergePatch
还没有人认领这个 Issue。
评估
调研方向
从 cJSONUtils_MergePatch 和 tests/old_utils_tests.c 中的 merge_tests 逻辑开始，然后将其递归处理方式与 issue 中提到的 CJSON_NESTING_LIMIT 行为进行比较。启用 ENABLE_CJSON_UTILS 和 ENABLE_CJSON_TEST 进行构建，复现 30,000 层的情况，并在嵌套 patch 不再导致 segmentation fault 且回归问题已由测试套件覆盖时，视为工作完成。
由索引模型根据 Issue 内容生成。
描述
Clear and concise description of the bug:
A stack overflow vulnerability exists in the cJSON_Utils library due to uncontrolled recursion in the cJSONUtils_MergePatch function. When processing a JSON Merge Patch (RFC 7396) with deeply nested objects, the function recursively traverses the patch without any depth limit. This exhausts the system stack memory, leading to a segmentation fault and application crash (Denial of Service).
Steps to reproduce the bug :
To reproduce this with the existing test suite, modify tests/old_utils_tests.c to dynamically inject a deeply nested object：
1.Increase the size of the merges array and add a placeholder:
static const char *merges[16][3] = {
// ... existing tests ...
{"{}", "RECURSIVE_PLACEHOLDER", "{}"}
};
2.Modify the test loop in merge_tests to dynamically build a 30,000-layer object when the placeholder is encountered:
if (strcmp(merges[i][1], "RECURSIVE_PLACEHOLDER") == 0) {
int depth = 30000;
int d = 0;
patch = cJSON_CreateObject();
cJSON *current = patch;
for (d = 0; d < depth; d++) {
cJSON *next = cJSON_CreateObject();
cJSON_AddItemToObject(current, "a", next);
current = next;
}
}
3.Build and run the tests:
mkdir build
cd build
cmake .. -DENABLE_CJSON_UTILS=On -DENABLE_CJSON_TEST=On -DCMAKE_BUILD_TYPE=Debug
make
./tests/old_utils_tests .
Expected behavior:
The function should either successfully process the nested structure or, more appropriately, return an error when a pre-defined recursion depth limit is exceeded, similar to the CJSON_NESTING_LIMIT enforced in the core library.
Observed behavior:
The program crashes with a Segmentation fault. GDB backtrace shows thousands of recursive calls to merge_patch (frames reaching over #13000), eventually exhausting the default stack size.
Platform(s) (compiler version, operating system version, CPU) on which the bug was observed:
OS: Ubuntu Linux 20.04+
Compiler: GCC
cJSON release(s), commit(s), or branch(es) in which the bug was observed :
cJSON(main branch)
- 主要语言
- C
- 星标
- 13k
- 派生
- 3.5k
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
DaveGamble/cJSON 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 86/100
DaveGamble/cJSON#1094 ·
-
难度 2/5 1-3 小时 新手友好度 68/100
DaveGamble/cJSON#1093 ·
-
难度 2/5 1-3 小时 新手友好度 82/100
DaveGamble/cJSON#1082 ·
-
难度 2/5 1-3 小时 新手友好度 82/100
DaveGamble/cJSON#1081 ·
-
难度 2/5 1-3 小时 新手友好度 78/100
DaveGamble/cJSON#1074 ·
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 84/100
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 68/100
fastfetch-cli/fastfetch#2628 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
FujiNetWIFI/fujinet-firmware#1736 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 3 天内回复
-
难度 2/5 1-3 小时 新手友好度 86/100