open-source-parsers / open-source-parsers/jsoncpp
Access violation during getFormattedErrorMessages, if Parser read JSON from stream
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 8.9k
- Forks
- 2.7k
- Avg merge
- 31m
- Merged PRs (30d)
- 1
Description
Dear jsoncpp dev team,
I have faced with this bug, which is really annoying
Prerequisites:
jsoncpp-1.7.2
Affected OS: Windows/Linux
Test sources: https://pastebin.com/YsNpLq86
Steps to reproduce:
wget https://pastebin.com/raw/YsNpLq86 -O test.cpp
g++ -std=c++11 -I/usr/include/jsoncpp test.cpp -ljsoncpp -o test
valgrind ./test
Actual result
==1427== Memcheck, a memory error detector
==1427== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==1427== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==1427== Command: ./test
==1427==
==1427== Invalid read of size 1
==1427== at 0x4E4755B: Json::Reader::getLocationLineAndColumn(char const*, int&, int&) const (in /usr/lib/x86_64-linux-gnu/libjsoncpp.so.1.7.2)
==1427== by 0x4E475CF: Json::Reader::getLocationLineAndColumn[abi:cxx11](char const*) const (in /usr/lib/x86_64-linux-gnu/libjsoncpp.so.1.7.2)
==1427== by 0x4E488BA: Json::Reader::getFormattedErrorMessages[abi:cxx11]() const (in /usr/lib/x86_64-linux-gnu/libjsoncpp.so.1.7.2)
==1427== by 0x4011CD: main (in /home/lberserq/test/test)
==1427== Address 0x5ce8580 is 0 bytes inside a block of size 31 free'd
==1427== at 0x4C2F24B: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1427== by 0x4E4D75B: Json::Reader::parse(std::istream&, Json::Value&, bool) (in /usr/lib/x86_64-linux-gnu/libjsoncpp.so.1.7.2)
==1427== by 0x4011AD: main (in /home/lberserq/test/test)
==1427== Block was alloc'd at
==1427== at 0x4C2E0EF: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1427== by 0x518A498: std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21)
==1427== by 0x518B832: std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_append(char const*, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21)
==1427== by 0x5111A7A: std::basic_istream<char, std::char_traits<char> >& std::getline<char, std::char_traits<char>, std::allocator<char> >(std::basic_istream<char, std::char_traits<char> >&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&, char) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21)
==1427== by 0x4E4D72C: Json::Reader::parse(std::istream&, Json::Value&, bool) (in /usr/lib/x86_64-linux-gnu/libjsoncpp.so.1.7.2)
==1427== by 0x4011AD: main (in /home/lberserq/test/test)
==1427==
* Line 1, Column 13
Syntax error: value, object or array expected.
==1427==
==1427== HEAP SUMMARY:
==1427== in use at exit: 72,704 bytes in 1 blocks
==1427== total heap usage: 26 allocs, 25 frees, 75,172 bytes allocated
==1427==
==1427== LEAK SUMMARY:
==1427== definitely lost: 0 bytes in 0 blocks
==1427== indirectly lost: 0 bytes in 0 blocks
==1427== possibly lost: 0 bytes in 0 blocks
==1427== still reachable: 72,704 bytes in 1 blocks
==1427== suppressed: 0 bytes in 0 blocks
==1427== Rerun with --leak-check=full to see details of leaked memory
==1427==
==1427== For counts of detected and suppressed errors, rerun with: -v
==1427== ERROR SUMMARY: 12 errors from 1 contexts (suppressed: 0 from 0)
Expected result:
No read access violation
Comments:
Main reason -- that Parser stores the locations of the token, which becomes invalid, after returning from Json::Reader::parse, because a value of the stream stored in the local variable and all tokens stored the pointers _start and _end to this local variable
The same error occurs on the Windows under Application Verifier.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the supplied test.cpp reproduction and inspect Json::Reader::parse(std::istream&, Json::Value&, bool), then follow how getFormattedErrorMessages() calls getLocationLineAndColumn(). Run the example under Valgrind or Application Verifier; done means the stream-parsing error can be formatted without an invalid read after parse returns.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100