open-source-parsers / open-source-parsers/jsoncpp

Access violation during getFormattedErrorMessages, if Parser read JSON from stream

Open
#801 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
C++
Stars
8.9k
Forks
2.7k
Avg merge
31m
Merged PRs (30d)
1

Description

Dear jsoncpp dev team,
I have faced with this bug, which is really annoying

Prerequisites:
jsoncpp-1.7.2
Affected OS: Windows/Linux
Test sources: https://pastebin.com/YsNpLq86

Steps to reproduce:
wget https://pastebin.com/raw/YsNpLq86 -O test.cpp
g++ -std=c++11 -I/usr/include/jsoncpp test.cpp -ljsoncpp -o test

valgrind ./test

Actual result

==1427== Memcheck, a memory error detector
==1427== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==1427== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==1427== Command: ./test
==1427==
==1427== Invalid read of size 1
==1427==    at 0x4E4755B: Json::Reader::getLocationLineAndColumn(char const*, int&, int&) const (in /usr/lib/x86_64-linux-gnu/libjsoncpp.so.1.7.2)
==1427==    by 0x4E475CF: Json::Reader::getLocationLineAndColumn[abi:cxx11](char const*) const (in /usr/lib/x86_64-linux-gnu/libjsoncpp.so.1.7.2)
==1427==    by 0x4E488BA: Json::Reader::getFormattedErrorMessages[abi:cxx11]() const (in /usr/lib/x86_64-linux-gnu/libjsoncpp.so.1.7.2)
==1427==    by 0x4011CD: main (in /home/lberserq/test/test)
==1427==  Address 0x5ce8580 is 0 bytes inside a block of size 31 free'd
==1427==    at 0x4C2F24B: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1427==    by 0x4E4D75B: Json::Reader::parse(std::istream&, Json::Value&, bool) (in /usr/lib/x86_64-linux-gnu/libjsoncpp.so.1.7.2)
==1427==    by 0x4011AD: main (in /home/lberserq/test/test)
==1427==  Block was alloc'd at
==1427==    at 0x4C2E0EF: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1427==    by 0x518A498: std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_mutate(unsigned long, unsigned long, char const*, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21)
==1427==    by 0x518B832: std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_append(char const*, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21)
==1427==    by 0x5111A7A: std::basic_istream<char, std::char_traits<char> >& std::getline<char, std::char_traits<char>, std::allocator<char> >(std::basic_istream<char, std::char_traits<char> >&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&, char) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21)
==1427==    by 0x4E4D72C: Json::Reader::parse(std::istream&, Json::Value&, bool) (in /usr/lib/x86_64-linux-gnu/libjsoncpp.so.1.7.2)
==1427==    by 0x4011AD: main (in /home/lberserq/test/test)
==1427==
* Line 1, Column 13
  Syntax error: value, object or array expected.
==1427==
==1427== HEAP SUMMARY:
==1427==     in use at exit: 72,704 bytes in 1 blocks
==1427==   total heap usage: 26 allocs, 25 frees, 75,172 bytes allocated
==1427==
==1427== LEAK SUMMARY:
==1427==    definitely lost: 0 bytes in 0 blocks
==1427==    indirectly lost: 0 bytes in 0 blocks
==1427==      possibly lost: 0 bytes in 0 blocks
==1427==    still reachable: 72,704 bytes in 1 blocks
==1427==         suppressed: 0 bytes in 0 blocks
==1427== Rerun with --leak-check=full to see details of leaked memory
==1427==
==1427== For counts of detected and suppressed errors, rerun with: -v
==1427== ERROR SUMMARY: 12 errors from 1 contexts (suppressed: 0 from 0)

Expected result:
No read access violation

Comments:
Main reason -- that Parser stores the locations of the token, which becomes invalid, after returning from Json::Reader::parse, because a value of the stream stored in the local variable and all tokens stored the pointers _start and _end to this local variable

The same error occurs on the Windows under Application Verifier.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the supplied test.cpp reproduction and inspect Json::Reader::parse(std::istream&, Json::Value&, bool), then follow how getFormattedErrorMessages() calls getLocationLineAndColumn(). Run the example under Valgrind or Application Verifier; done means the stream-parsing error can be formatted without an invalid read after parse returns.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.