alibaba / alibaba/AliOS-Things
[Bug Report]: semantic bug in parsing json file
- Dominant language
- C
- Stars
- 4.6k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
### Contact Details
dliangfun@gmail.com
### What happened?
A bug happened!
运行环境: ubuntu 22.04
固件版本: no
### Version
master (Default)
### What soultions are you seeing the problem on?
_No response_
### Relevant log output
```shell
To demonstrate the semantic bug, I use the following code to parse a json text:
const char *s = "{\"a\": true, \"b\": [ null,9999999999999999999999999999999999999999999999912345678901234567]}";
cJSON *root = NULL;
root = cJSON_Parse(s);
if (root == NULL) {
const char *error_ptr = cJSON_GetErrorPtr();
printf("error in json data:%s\n", error_ptr);
}
```
It outputs the error message. However, according to the specification https://www.rfc-editor.org/rfc/rfc7159, JSON parser MUST accept all texts that conform to the JSON grammar.
I have checked it against other parsers, e.g., https://jsonlint.com/, https://github.com/nlohmann/json, etc. All of them accepts the text.
This kind of bug has potential security threats especially when different json parser involved (e.g., client side and server side), it may lead to some unexpected errors (e.g., cause data to get out of sync).
```
Contributor guide
Research direction
Reproduce the report with the provided C snippet, starting at the cJSON_Parse call and checking the error returned through cJSON_GetErrorPtr. Trace the JSON number parsing path and compare its handling of the large value with the reported JSON grammar requirement; done means the valid input is accepted without the reported parse error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- embedded-iot
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100