You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Detailed report: https://oss-fuzz.com/testcase?key=5089762371174400
Project: json
Fuzzer: libFuzzer_json_parse_msgpack_fuzzer
Job Type: libfuzzer_asan_json
Platform Id: linux
Crash Type: Stack-overflow
Crash Address: 0x7ffd1f45dfe8
Crash State:
nlohmann::basic_json<std::__1::map, std::__1::vector, std::__1::basic_string<cha
Sanitizer: address (ASAN)
Regressed: https://oss-fuzz.com/revisions?job=libfuzzer_asan_json&range=201701031958:201701032147
Reproducer Testcase: https://oss-fuzz.com/download/AMIfv94a4ny2w2F6ZCWYdf0DJCJ2xddDzyets2BdJ8Vv1zkAhsBzwDNiuhh0HE5OrlUDyXvPHaXMdX-nVX5UPRE0k2UiSLm0wanWa_PJyE-enR0BNnzFCKTAGl_DZCLis2TJAPb2kkeXS8SbBpCZzYs4EfKhZdnvClexaherh8x4Izejcny_NdIoDj2uIhuHfcYoLbiJ3ufROAxvrQvv9rdfHBhrD8W4hstZURSrluZ2HGyp6Y_V5qRCmo2trHJQcQXFHC56kXG3G-3bQW2uYTsH5EpZrdvaKTHV2kEU2Ii4N__VRx5tkE973yvuxqFpbSmeDjSoc5lgoGQbouKZYC-s6zE4-hk-RrhMR0HsoQKYqBudibaOiyhXFHdsc-5gZd8Y-bSbqbex?testcase_id=5089762371174400
Issue filed automatically.
See https://github.com/google/oss-fuzz/blob/master/docs/reproducing.md for more information.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without an upstream patch, then the bug report will automatically
become visible to the public.
As first observation to why there is such deep recursion: When the code reads an object entry, it first parses the key and recurses. If this call does not read a string (but, for instance another object), the code happily recurses again. Instead, one should be able to give the parser a hint that it now must parse a string so it can abort earlier.
To avoid the error described in #497, I added a function
msgpack_expect_string that is executed every time a string is expected
during the parsing of a map. In case the current byte does not belong
to a MsgPack string, an exception is thrown.
clusterfuzz-testcase-5089762371174400.msgpack.zip
The text was updated successfully, but these errors were encountered: