From efe3a00499a74ff44867711f40f9bcc279d2ea92 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Br=C3=A9nainn=20Woodsend?= Date: Wed, 4 Mar 2026 22:28:11 +0000 Subject: [PATCH] Fix buffer overflow/infinite loop from indent handling If indent * nest depth is large enough to overflow an int, it causes the required output buffer size to be underestimated leading to a buffer overflow. The offending arithmetic is upgraded to a ptrdiff_t and indent is artificially capped. An overflow is still technically possible given a high enough recursion depth but not without first consuming petabytes of RAM. If indent is negative, it causes a size_t to underflow to some number a little bellow size_t max. If that underflow isn't accidentally rectified by a subsequent overflow (if -indent * (nest_depth + 1) > current_buffer_size) then the buffer up-sizer gets stuck in an infinite loop trying to find a power of two that fits in a size_t but is greater that size_t max / 2. It's hard to tell if `ujson.dumps(..., indent=-1)` was ever an intentional feature but I don't feel comfortable breaking it in a security fix. For now, the dubious *any negative indent -> pad colons but add no indentation or newlines* behaviour is preserved but internally the indent is clipped to -1 and all subsequent indentation code paths are skipped over. CVE: CVE-2026-32875 Upstream-Status: Backport [https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea] Backport Changes: - Adjusted source paths for ujson 5.9.0's pre-src-layout tree. (cherry picked from commit 486bd4553dc471a1de11613bc7347a6b318e37ea) Signed-off-by: Hetvi Thakar --- lib/ultrajson.h | 3 ++- lib/ultrajsonenc.c | 16 +++++++++------- python/objToJSON.c | 16 +++++++++++++++- tests/test_ujson.py | 20 ++++++++++++++++++-- 4 files changed, 44 insertions(+), 11 deletions(-) diff --git a/lib/ultrajson.h b/lib/ultrajson.h index 143cd9e..4560f4d 100644 --- a/lib/ultrajson.h +++ b/lib/ultrajson.h @@ -54,6 +54,7 @@ tree doesn't have cyclic references. #define __ULTRAJSON_H__ #include +#include // Max decimals to encode double floating point numbers with #ifndef JSON_DOUBLE_MAX_DECIMALS @@ -257,7 +258,7 @@ typedef struct __JSONObjectEncoder /* Configuration for spaces of indent */ - int indent; + ptrdiff_t indent; /* If true, NaN will be encoded as a string matching the Python standard library's JSON behavior. diff --git a/lib/ultrajsonenc.c b/lib/ultrajsonenc.c index 9ec2faf..0f9fde3 100644 --- a/lib/ultrajsonenc.c +++ b/lib/ultrajsonenc.c @@ -575,7 +575,7 @@ static void Buffer_AppendIndentNewlineUnchecked(JSONObjectEncoder *enc) static void Buffer_AppendIndentUnchecked(JSONObjectEncoder *enc, JSINT32 value) { - int i; + ptrdiff_t i; if (enc->indent > 0) while (value-- > 0) for (i = 0; i < enc->indent; i++) @@ -741,10 +741,11 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c Buffer_AppendCharUnchecked (enc, '['); + // The extra 1 byte covers the optional newline. + size_t per_item_reserve = (enc->indent > 0 ? enc->indent : 0) * (enc->level + 1) + enc->itemSeparatorLength + 1; while (enc->iterNext(obj, &tc)) { - // The extra 1 byte covers the optional newline. - Buffer_Reserve (enc, enc->indent * (enc->level + 1) + enc->itemSeparatorLength + 1); + Buffer_Reserve (enc, per_item_reserve); if (count > 0) { @@ -769,7 +770,7 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c enc->iterEnd(obj, &tc); - if (count > 0) { + if (count > 0 && enc->indent > 0) { // Reserve space for the indentation plus the newline. Buffer_Reserve (enc, enc->indent * enc->level + 1); Buffer_AppendIndentNewlineUnchecked (enc); @@ -786,10 +787,11 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c Buffer_AppendCharUnchecked (enc, '{'); + // The extra 1 byte covers the optional newline. + size_t reserve_size = (enc->indent > 0 ? enc->indent : 0) * (enc->level + 1) + enc->itemSeparatorLength + 1; while ((res = enc->iterNext(obj, &tc))) { - // The extra 1 byte covers the optional newline. - Buffer_Reserve (enc, enc->indent * (enc->level + 1) + enc->itemSeparatorLength + 1); + Buffer_Reserve (enc, reserve_size); if(res < 0) { @@ -823,7 +825,7 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c enc->iterEnd(obj, &tc); - if (count > 0) { + if (count > 0 && enc->indent > 0) { Buffer_Reserve (enc, enc->indent * enc->level + 1); Buffer_AppendIndentNewlineUnchecked (enc); Buffer_AppendIndentUnchecked (enc, enc->level); diff --git a/python/objToJSON.c b/python/objToJSON.c index b754819..9013205 100644 --- a/python/objToJSON.c +++ b/python/objToJSON.c @@ -678,6 +678,7 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs) PyObject *separatorsKeyBytes = NULL; int allowNan = -1; int orejectBytes = -1; + int indent = 0; size_t retLen; JSONObjectEncoder encoder = @@ -714,7 +715,7 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs) PRINTMARK(); - if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|OOOOiiiOO", kwlist, &oinput, &oensureAscii, &oencodeHTMLChars, &oescapeForwardSlashes, &osortKeys, &encoder.indent, &allowNan, &orejectBytes, &odefaultFn, &oseparators)) + if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|OOOOiiiOO", kwlist, &oinput, &oensureAscii, &oencodeHTMLChars, &oescapeForwardSlashes, &osortKeys, &indent, &allowNan, &orejectBytes, &odefaultFn, &oseparators)) { return NULL; } @@ -761,6 +762,19 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs) encoder.rejectBytes = orejectBytes; } + if (indent < -1) + { + encoder.indent = -1; + } + else if (indent > 1000) + { + PyErr_SetString(PyExc_ValueError, "Maximum allowed indentation is 1000"); + return NULL; + } + else { + encoder.indent = indent; + } + if (oseparators != NULL && oseparators != Py_None) { if (!PyTuple_Check(oseparators)) diff --git a/tests/test_ujson.py b/tests/test_ujson.py index 506666d..d24edb0 100644 --- a/tests/test_ujson.py +++ b/tests/test_ujson.py @@ -1050,9 +1050,25 @@ def test_default_function(): ujson.dumps(unjsonable_obj, default=default) -@pytest.mark.parametrize("indent", list(range(65537, 65542))) +@pytest.mark.parametrize("indent", [999, 1000, 1001, 1 << 30, 1 << 63, 1 << 128]) def test_dump_huge_indent(indent): - ujson.encode({"a": True}, indent=indent) + obj = {"list": [1, [2, 3], 4], "nested": {"key": "value", "a": True}} + if indent <= 1000: + assert ujson.loads(ujson.encode(obj, indent=indent)) == obj + else: + with pytest.raises((ValueError, OverflowError)): + ujson.encode(obj, indent=indent) + + +def test_negative_indent(): + obj = {"a": [1, 2], "b": "c"} + assert ujson.dumps(obj) == '{"a":[1,2],"b":"c"}' + assert ujson.dumps(obj, 0) == '{"a":[1,2],"b":"c"}' + assert ujson.dumps(obj, indent=-1) == '{"a": [1,2],"b": "c"}' + assert ujson.dumps(obj, indent=-1000000) == '{"a": [1,2],"b": "c"}' + assert ( + ujson.dumps(obj, indent=2) == '{\n "a": [\n 1,\n 2\n ],\n "b": "c"\n}' + ) @pytest.mark.parametrize("first_length", list(range(2, 7))) -- 2.35.6