Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

json:parse_bjdata_fuzzer: ASSERT: ref_stack.back()->is_array() #3541

Closed
2 tasks done
nlohmann opened this issue Jun 16, 2022 · 1 comment · Fixed by #3543
Closed
2 tasks done

json:parse_bjdata_fuzzer: ASSERT: ref_stack.back()->is_array() #3541

nlohmann opened this issue Jun 16, 2022 · 1 comment · Fixed by #3543
Assignees
@nlohmann
Labels
aspect: binary formats BSON, CBOR, MessagePack, UBJSON kind: bug release item: 🐛 bug fix solution: proposed fix a fix for the issue has been proposed and waits for confirmation
Milestone
Release 3.11.0

Comments

@nlohmann
Copy link
Owner

Description

OSS-Fuzz detected an input that yields an assertion.

Reproduction steps

Input:

00000000: 5b5b 2420 235b 4dff ffff ffff ffff ff69  [[$ #[M........i
00000010: 015d 5d                                  .]]

clusterfuzz-testcase-minimized-parse_bjdata_fuzzer-6469348761403392.bjdata.zip

Expected vs. actual results

Actual result:

<array>
    <object size="3">
        <key key="_ArraySize_" />
        <array size="2">
            <number_unsigned val="18446744073709551615" />
            <number_unsigned val="1" />
        </array>
        <array>
        </array>
    </array>
Assertion failed: (ref_stack.back()->is_array()), function end_array, file json_sax.hpp, line 269.

Expected result:

Parse error.

Minimal code example

See above.

Error messages

Assertion failed: (ref_stack.back()->is_array()), function end_array, file json_sax.hpp, line 269.

Compiler and operating system

OSS-Fuzz

Library version

develop

Validation
@nlohmann nlohmann added kind: bug aspect: binary formats BSON, CBOR, MessagePack, UBJSON labels Jun 16, 2022
@nlohmann
Copy link
Owner Author

CC @fangq

fangq added a commit to NeuroJSON/json that referenced this issue Jun 17, 2022
@fangq
BJData dimension length can not be string_t::npos, fix nlohmann#3541
854aad5
@fangq fangq mentioned this issue Jun 17, 2022
Merged
@nlohmann nlohmann linked a pull request Jun 17, 2022 that will close this issue
BJData dimension length can not be string_t::npos, fix #3541 #3543
Merged
@nlohmann nlohmann added solution: proposed fix a fix for the issue has been proposed and waits for confirmation release item: 🐛 bug fix labels Jun 18, 2022
@nlohmann nlohmann self-assigned this Jun 18, 2022
@nlohmann nlohmann added this to the Release 3.11.0 milestone Jun 18, 2022
nlohmann pushed a commit that referenced this issue Jun 18, 2022
@fangq @falbrechtskirchinger
BJData dimension length can not be string_t::npos, fix #3541 (#3543)
1373023 
* BJData dimension length can not be string_t::npos, fix #3541

* handle error messages on 32bit machine

* add explanation to why size can not be string_t::npos

* add test cases to 32bit unit test

Co-authored-by: Florian Albrechtskirchinger <falbrechtskirchinger@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@nlohmann nlohmann

Labels
aspect: binary formats BSON, CBOR, MessagePack, UBJSON kind: bug release item: 🐛 bug fix solution: proposed fix a fix for the issue has been proposed and waits for confirmation
Projects
None yet
Milestone
Release 3.11.0
Development

Successfully merging a pull request may close this issue.

BJData dimension length can not be string_t::npos, fix #3541 NeuroJSON/json
1 participant
@nlohmann