From cf988dbccb1b71cc1cb27c59ac73e09f3a68c3c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Br=C3=A9nainn=20Woodsend?= Date: Wed, 10 Dec 2025 22:37:20 +0000 Subject: [PATCH] Fix memory leak parsing large integers CVE: CVE-2026-32874 Upstream-Status: Backport [https://github.com/ultrajson/ultrajson/commit/4baeb950df780092bd3c89fc702a868e99a3a1d2] Backport Changes: - Adjusted source paths for ujson 5.9.0's pre-src-layout tree. (cherry picked from commit 4baeb950df780092bd3c89fc702a868e99a3a1d2) Signed-off-by: Hetvi Thakar --- python/JSONtoObj.c | 4 +++- tests/test_ujson.py | 14 ++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/python/JSONtoObj.c b/python/JSONtoObj.c index 208055c..93e87f3 100644 --- a/python/JSONtoObj.c +++ b/python/JSONtoObj.c @@ -136,7 +136,9 @@ static JSOBJ Object_newIntegerFromString(void *prv, char *value, size_t length) char *buf = PyObject_Malloc(length + 1); memcpy(buf, value, length); buf[length] = '\0'; - return PyLong_FromString(buf, NULL, 10); + PyObject *ret = PyLong_FromString(buf, NULL, 10); + PyObject_Free(buf); + return ret; } static JSOBJ Object_newDouble(void *prv, double value) diff --git a/tests/test_ujson.py b/tests/test_ujson.py index d24edb0..9ba6f55 100644 --- a/tests/test_ujson.py +++ b/tests/test_ujson.py @@ -653,6 +653,20 @@ def test_encode_decode_big_int(i, mode): assert ujson.decode(json_string) == python_object +@pytest.mark.xfail( + sys.implementation.name == "pypy", + reason="PyPy's PyNumber_ToBase ignores sys.get_int_max_str_digits()", +) +def test_encode_too_big_int_error(): + with pytest.raises(ValueError, match="integer string conversion"): + ujson.dumps(pow(10, 10_000)) + + +def test_decode_too_big_int_error(): + with pytest.raises(ValueError, match="integer string conversion"): + ujson.loads("9" * 10_000) + + @pytest.mark.parametrize( "test_input, expected", [ -- 2.35.6