From 854aad55e37c7ab52e3d4d21686493ac72ed2514 Mon Sep 17 00:00:00 2001 From: Qianqian Fang Date: Fri, 17 Jun 2022 11:11:29 -0400 Subject: [PATCH] BJData dimension length can not be string_t::npos, fix #3541 --- include/nlohmann/detail/input/binary_reader.hpp | 2 +- single_include/nlohmann/json.hpp | 2 +- tests/src/unit-bjdata.cpp | 4 ++++ 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/include/nlohmann/detail/input/binary_reader.hpp b/include/nlohmann/detail/input/binary_reader.hpp index f5871ddf6..f84dd1111 100644 --- a/include/nlohmann/detail/input/binary_reader.hpp +++ b/include/nlohmann/detail/input/binary_reader.hpp @@ -2179,7 +2179,7 @@ class binary_reader for (auto i : dim) { result *= i; - if (result == 0) // because dim elements shall not have zeros, result = 0 means overflow happened + if (result == 0 || result == string_t::npos) // because dim elements shall not have zeros, result = 0 means overflow happened; it also can't be string_t::npos { return sax->parse_error(chars_read, get_token_string(), out_of_range::create(408, exception_message(input_format, "excessive ndarray size caused overflow", "size"), nullptr)); } diff --git a/single_include/nlohmann/json.hpp b/single_include/nlohmann/json.hpp index 98c8dd664..bec25e425 100644 --- a/single_include/nlohmann/json.hpp +++ b/single_include/nlohmann/json.hpp @@ -10879,7 +10879,7 @@ class binary_reader for (auto i : dim) { result *= i; - if (result == 0) // because dim elements shall not have zeros, result = 0 means overflow happened + if (result == 0 || result == string_t::npos) // because dim elements shall not have zeros, result = 0 means overflow happened; it also can't be string_t::npos { return sax->parse_error(chars_read, get_token_string(), out_of_range::create(408, exception_message(input_format, "excessive ndarray size caused overflow", "size"), nullptr)); } diff --git a/tests/src/unit-bjdata.cpp b/tests/src/unit-bjdata.cpp index ab046a602..d03117781 100644 --- a/tests/src/unit-bjdata.cpp +++ b/tests/src/unit-bjdata.cpp @@ -2620,6 +2620,7 @@ TEST_CASE("BJData") std::vector vl = {'[', '#', 'l', 0x00, 0x00, 0x00, 0xF2}; std::vector vL = {'[', '#', 'L', 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF3}; std::vector vM = {'[', '$', 'M', '#', '[', 'I', 0x00, 0x20, 'M', 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0xFF, ']'}; + std::vector vMX = {'[', '$', 'U', '#', '[', 'M', 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 'U', 0x01, ']'}; json _; CHECK_THROWS_WITH_AS(_ = json::from_bjdata(v1), "[json.exception.parse_error.113] parse error at byte 4: syntax error while parsing BJData size: count in an optimized container must be positive", json::parse_error&); @@ -2653,6 +2654,9 @@ TEST_CASE("BJData") CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vM), "[json.exception.out_of_range.408] syntax error while parsing BJData size: excessive ndarray size caused overflow", json::out_of_range&); #endif CHECK(json::from_bjdata(vM, true, false).is_discarded()); + + CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vMX), "[json.exception.out_of_range.408] syntax error while parsing BJData size: excessive ndarray size caused overflow", json::out_of_range&); + CHECK(json::from_bjdata(vMX, true, false).is_discarded()); } SECTION("optimized array: integer value overflow")