mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-09 06:40:17 +00:00
Code Issues Projects Releases Wiki Activity

python3-ujson: Fix CVE-2026-32875

Browse Source 
This patch applies the upstream fix referenced in [2], using the
commit shown in [1].

[1] https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-32875

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hetvi Thakar
2026-09-01 06:57:20 +05:30
committed by Anuj Mittal
parent b9534a154d
commit 28aefe0fdb
2 changed files with 200 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-python/recipes-devtools/python/python3-ujson/CVE-2026-32875.patch
+199
View File
@@ -0,0 +1,199 @@
From efe3a00499a74ff44867711f40f9bcc279d2ea92 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Br=C3=A9nainn=20Woodsend?= <bwoodsend@gmail.com>
Date: Wed, 4 Mar 2026 22:28:11 +0000
Subject: [PATCH] Fix buffer overflow/infinite loop from indent handling
If indent * nest depth is large enough to overflow an int, it causes the
required output buffer size to be underestimated leading to a buffer
overflow.
The offending arithmetic is upgraded to a ptrdiff_t and indent is
artificially capped. An overflow is still technically possible given a
high enough recursion depth but not without first consuming petabytes of
RAM.
If indent is negative, it causes a size_t to underflow to some number a
little bellow size_t max. If that underflow isn't accidentally rectified
by a subsequent overflow (if -indent * (nest_depth + 1) >
current_buffer_size) then the buffer up-sizer gets stuck in an infinite
loop trying to find a power of two that fits in a size_t but is greater
that size_t max / 2.
It's hard to tell if `ujson.dumps(..., indent=-1)` was ever an
intentional feature but I don't feel comfortable breaking it in a
security fix. For now, the dubious *any negative indent -> pad colons
but add no indentation or newlines* behaviour is preserved but
internally the indent is clipped to -1 and all subsequent indentation
code paths are skipped over.
CVE: CVE-2026-32875
Upstream-Status: Backport [https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea]
Backport Changes:
- Adjusted source paths for ujson 5.9.0's pre-src-layout tree.
(cherry picked from commit 486bd4553dc471a1de11613bc7347a6b318e37ea)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
lib/ultrajson.h | 3 ++-
lib/ultrajsonenc.c | 16 +++++++++-------
python/objToJSON.c | 16 +++++++++++++++-
tests/test_ujson.py | 20 ++++++++++++++++++--
4 files changed, 44 insertions(+), 11 deletions(-)
diff --git a/lib/ultrajson.h b/lib/ultrajson.h
index 143cd9e..4560f4d 100644
--- a/lib/ultrajson.h
+++ b/lib/ultrajson.h
@@ -54,6 +54,7 @@ tree doesn't have cyclic references.
#define __ULTRAJSON_H__
#include <stdio.h>
+#include <stddef.h>
// Max decimals to encode double floating point numbers with
#ifndef JSON_DOUBLE_MAX_DECIMALS
@@ -257,7 +258,7 @@ typedef struct __JSONObjectEncoder
/*
Configuration for spaces of indent */
- int indent;
+ ptrdiff_t indent;
/*
If true, NaN will be encoded as a string matching the Python standard library's JSON behavior.
diff --git a/lib/ultrajsonenc.c b/lib/ultrajsonenc.c
index 9ec2faf..0f9fde3 100644
--- a/lib/ultrajsonenc.c
+++ b/lib/ultrajsonenc.c
@@ -575,7 +575,7 @@ static void Buffer_AppendIndentNewlineUnchecked(JSONObjectEncoder *enc)
static void Buffer_AppendIndentUnchecked(JSONObjectEncoder *enc, JSINT32 value)
{
- int i;
+ ptrdiff_t i;
if (enc->indent > 0)
while (value-- > 0)
for (i = 0; i < enc->indent; i++)
@@ -741,10 +741,11 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
Buffer_AppendCharUnchecked (enc, '[');
+ // The extra 1 byte covers the optional newline.
+ size_t per_item_reserve = (enc->indent > 0 ? enc->indent : 0) * (enc->level + 1) + enc->itemSeparatorLength + 1;
while (enc->iterNext(obj, &tc))
{
- // The extra 1 byte covers the optional newline.
- Buffer_Reserve (enc, enc->indent * (enc->level + 1) + enc->itemSeparatorLength + 1);
+ Buffer_Reserve (enc, per_item_reserve);
if (count > 0)
{
@@ -769,7 +770,7 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
enc->iterEnd(obj, &tc);
- if (count > 0) {
+ if (count > 0 && enc->indent > 0) {
// Reserve space for the indentation plus the newline.
Buffer_Reserve (enc, enc->indent * enc->level + 1);
Buffer_AppendIndentNewlineUnchecked (enc);
@@ -786,10 +787,11 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
Buffer_AppendCharUnchecked (enc, '{');
+ // The extra 1 byte covers the optional newline.
+ size_t reserve_size = (enc->indent > 0 ? enc->indent : 0) * (enc->level + 1) + enc->itemSeparatorLength + 1;
while ((res = enc->iterNext(obj, &tc)))
{
- // The extra 1 byte covers the optional newline.
- Buffer_Reserve (enc, enc->indent * (enc->level + 1) + enc->itemSeparatorLength + 1);
+ Buffer_Reserve (enc, reserve_size);
if(res < 0)
{
@@ -823,7 +825,7 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
enc->iterEnd(obj, &tc);
- if (count > 0) {
+ if (count > 0 && enc->indent > 0) {
Buffer_Reserve (enc, enc->indent * enc->level + 1);
Buffer_AppendIndentNewlineUnchecked (enc);
Buffer_AppendIndentUnchecked (enc, enc->level);
diff --git a/python/objToJSON.c b/python/objToJSON.c
index b754819..9013205 100644
--- a/python/objToJSON.c
+++ b/python/objToJSON.c
@@ -678,6 +678,7 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs)
PyObject *separatorsKeyBytes = NULL;
int allowNan = -1;
int orejectBytes = -1;
+ int indent = 0;
size_t retLen;
JSONObjectEncoder encoder =
@@ -714,7 +715,7 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs)
PRINTMARK();
- if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|OOOOiiiOO", kwlist, &oinput, &oensureAscii, &oencodeHTMLChars, &oescapeForwardSlashes, &osortKeys, &encoder.indent, &allowNan, &orejectBytes, &odefaultFn, &oseparators))
+ if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|OOOOiiiOO", kwlist, &oinput, &oensureAscii, &oencodeHTMLChars, &oescapeForwardSlashes, &osortKeys, &indent, &allowNan, &orejectBytes, &odefaultFn, &oseparators))
{
return NULL;
}
@@ -761,6 +762,19 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs)
encoder.rejectBytes = orejectBytes;
}
+ if (indent < -1)
+ {
+ encoder.indent = -1;
+ }
+ else if (indent > 1000)
+ {
+ PyErr_SetString(PyExc_ValueError, "Maximum allowed indentation is 1000");
+ return NULL;
+ }
+ else {
+ encoder.indent = indent;
+ }
+
if (oseparators != NULL && oseparators != Py_None)
{
if (!PyTuple_Check(oseparators))
diff --git a/tests/test_ujson.py b/tests/test_ujson.py
index 506666d..d24edb0 100644
--- a/tests/test_ujson.py
+++ b/tests/test_ujson.py
@@ -1050,9 +1050,25 @@ def test_default_function():
ujson.dumps(unjsonable_obj, default=default)
-@pytest.mark.parametrize("indent", list(range(65537, 65542)))
+@pytest.mark.parametrize("indent", [999, 1000, 1001, 1 << 30, 1 << 63, 1 << 128])
def test_dump_huge_indent(indent):
- ujson.encode({"a": True}, indent=indent)
+ obj = {"list": [1, [2, 3], 4], "nested": {"key": "value", "a": True}}
+ if indent <= 1000:
+ assert ujson.loads(ujson.encode(obj, indent=indent)) == obj
+ else:
+ with pytest.raises((ValueError, OverflowError)):
+ ujson.encode(obj, indent=indent)
+
+
+def test_negative_indent():
+ obj = {"a": [1, 2], "b": "c"}
+ assert ujson.dumps(obj) == '{"a":[1,2],"b":"c"}'
+ assert ujson.dumps(obj, 0) == '{"a":[1,2],"b":"c"}'
+ assert ujson.dumps(obj, indent=-1) == '{"a": [1,2],"b": "c"}'
+ assert ujson.dumps(obj, indent=-1000000) == '{"a": [1,2],"b": "c"}'
+ assert (
+ ujson.dumps(obj, indent=2) == '{\n "a": [\n 1,\n 2\n ],\n "b": "c"\n}'
+ )
@pytest.mark.parametrize("first_length", list(range(2, 7)))
--
2.35.6