External/json
8
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix ndarray dimension signness, fix ndarray length overflow, close #3519

Browse Source
This commit is contained in:
Qianqian Fang 2022-06-06 13:37:47 -04:00
parent b6d00d1897
commit bccd7aeef2
3 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
include/nlohmann/detail/input/binary_reader.hpp
View File

@ -2168,7 +2168,11 @@ class binary_reader
for (auto i : dim)
{
result *= i;
if (JSON_HEDLEY_UNLIKELY(!sax->number_integer(static_cast<number_integer_t>(i))))
if (result == 0) // because dim elements shall not have zeros, result = 0 means overflow happened
{
return sax->parse_error(chars_read, get_token_string(), parse_error::create(113, chars_read, exception_message(input_format, "excessive ndarray size caused overflow", "size"), nullptr));
}
if (JSON_HEDLEY_UNLIKELY(!sax->number_unsigned(static_cast<number_unsigned_t>(i))))
{
return false;
}

6
single_include/nlohmann/json.hpp
View File

@ -10758,7 +10758,11 @@ class binary_reader
for (auto i : dim)
{
result *= i;
if (JSON_HEDLEY_UNLIKELY(!sax->number_integer(static_cast<number_integer_t>(i))))
if (result == 0) // because dim elements shall not have zeros, result = 0 means overflow happened
{
return sax->parse_error(chars_read, get_token_string(), parse_error::create(113, chars_read, exception_message(input_format, "excessive ndarray size caused overflow", "size"), nullptr));
}
if (JSON_HEDLEY_UNLIKELY(!sax->number_unsigned(static_cast<number_unsigned_t>(i))))
{
return false;
}

8
tests/src/unit-bjdata.cpp
View File

@ -2511,6 +2511,7 @@ TEST_CASE("BJData")
std::vector<uint8_t> vI = {'[', '#', 'I', 0x00, 0xF1};
std::vector<uint8_t> vl = {'[', '#', 'l', 0x00, 0x00, 0x00, 0xF2};
std::vector<uint8_t> vL = {'[', '#', 'L', 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF3};
std::vector<uint8_t> vM = {'[', '$', 'M', '#', '[', 'I', 0x00, 0x20, 'M', 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0xFF, ']'};
json _;
CHECK_THROWS_WITH_AS(_ = json::from_bjdata(v1), "[json.exception.parse_error.113] parse error at byte 4: syntax error while parsing BJData size: count in an optimized container must be positive", json::parse_error&);
@ -2535,10 +2536,13 @@ TEST_CASE("BJData")
CHECK(json::from_bjdata(vI, true, false).is_discarded());
CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vl), "[json.exception.parse_error.113] parse error at byte 7: syntax error while parsing BJData size: count in an optimized container must be positive", json::parse_error&);
CHECK(json::from_bjdata(vI, true, false).is_discarded());
CHECK(json::from_bjdata(vl, true, false).is_discarded());
CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vL), "[json.exception.parse_error.113] parse error at byte 11: syntax error while parsing BJData size: count in an optimized container must be positive", json::parse_error&);
CHECK(json::from_bjdata(vI, true, false).is_discarded());
CHECK(json::from_bjdata(vL, true, false).is_discarded());
CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vM), "[json.exception.parse_error.113] parse error at byte 18: syntax error while parsing BJData size: excessive ndarray size caused overflow", json::parse_error&);
CHECK(json::from_bjdata(vM, true, false).is_discarded());
}
SECTION("do not accept NTFZ markers in ndarray optimized type (with count)")