stackLimit

cdunn2001 · cdunn2001 · commit 249ad9f47fa9 · 2015-02-11T10:01:58.000-06:00
diff --git a/include/json/reader.h b/include/json/reader.h
@@ -310,6 +310,9 @@ class JSON_API CharReaderBuilder : public CharReader::Factory {
       - true if dropped null placeholders are allowed. (See StreamWriterBuilder.)
     - "allowNumericKeys": false or true
       - true if numeric object keys are allowed.
+    - "stackLimit": integer
+      - This is a security issue (seg-faults caused by deeply nested JSON),
+        so the default is low.
 
     You can examine 'settings_` yourself
     to see the defaults. You can also write and read them just like any
diff --git a/src/lib_json/json_reader.cpp b/src/lib_json/json_reader.cpp
@@ -1865,6 +1865,7 @@ static void getValidReaderKeys(std::set<std::string>* valid_keys)
   valid_keys->insert("strictRoot");
   valid_keys->insert("allowDroppedNullPlaceholders");
   valid_keys->insert("allowNumericKeys");
+  valid_keys->insert("stackLimit");
 }
 bool CharReaderBuilder::validate(Json::Value* invalid) const
 {
@@ -1903,6 +1904,7 @@ void CharReaderBuilder::setDefaults(Json::Value* settings)
   (*settings)["strictRoot"] = false;
   (*settings)["allowDroppedNullPlaceholders"] = false;
   (*settings)["allowNumericKeys"] = false;
+  (*settings)["stackLimit"] = 1000;
 //! [CharReaderBuilderDefaults]
 }
 

Original file line number	Diff line number	Diff line change
`@@ -1865,6 +1865,7 @@ static void getValidReaderKeys(std::set<std::string>* valid_keys)`
`1865`	`1865`	`valid_keys->insert("strictRoot");`
`1866`	`1866`	`valid_keys->insert("allowDroppedNullPlaceholders");`
`1867`	`1867`	`valid_keys->insert("allowNumericKeys");`
	`1868`	`+ valid_keys->insert("stackLimit");`
`1868`	`1869`	`}`
`1869`	`1870`	`bool CharReaderBuilder::validate(Json::Value* invalid) const`
`1870`	`1871`	`{`
`@@ -1903,6 +1904,7 @@ void CharReaderBuilder::setDefaults(Json::Value* settings)`
`1903`	`1904`	`(*settings)["strictRoot"] = false;`
`1904`	`1905`	`(*settings)["allowDroppedNullPlaceholders"] = false;`
`1905`	`1906`	`(*settings)["allowNumericKeys"] = false;`
	`1907`	`+ (*settings)["stackLimit"] = 1000;`
`1906`	`1908`	`//! [CharReaderBuilderDefaults]`
`1907`	`1909`	`}`
`1908`	`1910`