meta-openembedded/meta-python/recipes-devtools/python/python3-ujson/CVE-2026-32875.patch

From efe3a00499a74ff44867711f40f9bcc279d2ea92 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Br=C3=A9nainn=20Woodsend?= <bwoodsend@gmail.com>
Date: Wed, 4 Mar 2026 22:28:11 +0000
Subject: [PATCH] Fix buffer overflow/infinite loop from indent handling

If indent * nest depth is large enough to overflow an int, it causes the
required output buffer size to be underestimated leading to a buffer
overflow.

The offending arithmetic is upgraded to a ptrdiff_t and indent is
artificially capped. An overflow is still technically possible given a
high enough recursion depth but not without first consuming petabytes of
RAM.

If indent is negative, it causes a size_t to underflow to some number a
little bellow size_t max. If that underflow isn't accidentally rectified
by a subsequent overflow (if -indent * (nest_depth + 1) >
current_buffer_size) then the buffer up-sizer gets stuck in an infinite
loop trying to find a power of two that fits in a size_t but is greater
that size_t max / 2.

It's hard to tell if `ujson.dumps(..., indent=-1)` was ever an
intentional feature but I don't feel comfortable breaking it in a
security fix. For now, the dubious *any negative indent -> pad colons
but add no indentation or newlines* behaviour is preserved but
internally the indent is clipped to -1 and all subsequent indentation
code paths are skipped over.

CVE: CVE-2026-32875
Upstream-Status: Backport [https://github.com/ultrajson/ultrajson/commit/486bd4553dc471a1de11613bc7347a6b318e37ea]

Backport Changes:
- Adjusted source paths for ujson 5.9.0's pre-src-layout tree.

(cherry picked from commit 486bd4553dc471a1de11613bc7347a6b318e37ea)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 lib/ultrajson.h     |  3 ++-
 lib/ultrajsonenc.c  | 16 +++++++++-------
 python/objToJSON.c  | 16 +++++++++++++++-
 tests/test_ujson.py | 20 ++++++++++++++++++--
 4 files changed, 44 insertions(+), 11 deletions(-)

diff --git a/lib/ultrajson.h b/lib/ultrajson.h
index 143cd9e..4560f4d 100644
--- a/lib/ultrajson.h
+++ b/lib/ultrajson.h
@@ -54,6 +54,7 @@ tree doesn't have cyclic references.
 #define __ULTRAJSON_H__
 
 #include <stdio.h>
+#include <stddef.h>
 
 // Max decimals to encode double floating point numbers with
 #ifndef JSON_DOUBLE_MAX_DECIMALS
@@ -257,7 +258,7 @@ typedef struct __JSONObjectEncoder
 
   /*
   Configuration for spaces of indent */
-  int indent;
+  ptrdiff_t indent;
 
   /*
   If true, NaN will be encoded as a string matching the Python standard library's JSON behavior.
diff --git a/lib/ultrajsonenc.c b/lib/ultrajsonenc.c
index 9ec2faf..0f9fde3 100644
--- a/lib/ultrajsonenc.c
+++ b/lib/ultrajsonenc.c
@@ -575,7 +575,7 @@ static void Buffer_AppendIndentNewlineUnchecked(JSONObjectEncoder *enc)
 
 static void Buffer_AppendIndentUnchecked(JSONObjectEncoder *enc, JSINT32 value)
 {
-  int i;
+  ptrdiff_t i;
   if (enc->indent > 0)
     while (value-- > 0)
       for (i = 0; i < enc->indent; i++)
@@ -741,10 +741,11 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
 
       Buffer_AppendCharUnchecked (enc, '[');
 
+      // The extra 1 byte covers the optional newline.
+      size_t per_item_reserve = (enc->indent > 0 ? enc->indent : 0) * (enc->level + 1) + enc->itemSeparatorLength + 1;
       while (enc->iterNext(obj, &tc))
       {
-        // The extra 1 byte covers the optional newline.
-        Buffer_Reserve (enc, enc->indent * (enc->level + 1) + enc->itemSeparatorLength + 1);
+        Buffer_Reserve (enc, per_item_reserve);
 
         if (count > 0)
         {
@@ -769,7 +770,7 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
 
       enc->iterEnd(obj, &tc);
 
-      if (count > 0) {
+      if (count > 0 && enc->indent > 0) {
         // Reserve space for the indentation plus the newline.
         Buffer_Reserve (enc, enc->indent * enc->level + 1);
         Buffer_AppendIndentNewlineUnchecked (enc);
@@ -786,10 +787,11 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
 
       Buffer_AppendCharUnchecked (enc, '{');
 
+      // The extra 1 byte covers the optional newline.
+      size_t reserve_size = (enc->indent > 0 ? enc->indent : 0) * (enc->level + 1) + enc->itemSeparatorLength + 1;
       while ((res = enc->iterNext(obj, &tc)))
       {
-        // The extra 1 byte covers the optional newline.
-        Buffer_Reserve (enc, enc->indent * (enc->level + 1) + enc->itemSeparatorLength + 1);
+        Buffer_Reserve (enc, reserve_size);
 
         if(res < 0)
         {
@@ -823,7 +825,7 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
 
       enc->iterEnd(obj, &tc);
 
-      if (count > 0) {
+      if (count > 0 && enc->indent > 0) {
         Buffer_Reserve (enc, enc->indent * enc->level + 1);
         Buffer_AppendIndentNewlineUnchecked (enc);
         Buffer_AppendIndentUnchecked (enc, enc->level);
diff --git a/python/objToJSON.c b/python/objToJSON.c
index b754819..9013205 100644
--- a/python/objToJSON.c
+++ b/python/objToJSON.c
@@ -678,6 +678,7 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs)
   PyObject *separatorsKeyBytes = NULL;
   int allowNan = -1;
   int orejectBytes = -1;
+  int indent = 0;
   size_t retLen;
 
   JSONObjectEncoder encoder =
@@ -714,7 +715,7 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs)
 
   PRINTMARK();
 
-  if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|OOOOiiiOO", kwlist, &oinput, &oensureAscii, &oencodeHTMLChars, &oescapeForwardSlashes, &osortKeys, &encoder.indent, &allowNan, &orejectBytes, &odefaultFn, &oseparators))
+  if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|OOOOiiiOO", kwlist, &oinput, &oensureAscii, &oencodeHTMLChars, &oescapeForwardSlashes, &osortKeys, &indent, &allowNan, &orejectBytes, &odefaultFn, &oseparators))
   {
     return NULL;
   }
@@ -761,6 +762,19 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs)
     encoder.rejectBytes = orejectBytes;
   }
 
+  if (indent < -1)
+  {
+    encoder.indent = -1;
+  }
+  else if (indent > 1000)
+  {
+    PyErr_SetString(PyExc_ValueError, "Maximum allowed indentation is 1000");
+    return NULL;
+  }
+  else {
+    encoder.indent = indent;
+  }
+
   if (oseparators != NULL && oseparators != Py_None)
   {
     if (!PyTuple_Check(oseparators))
diff --git a/tests/test_ujson.py b/tests/test_ujson.py
index 506666d..d24edb0 100644
--- a/tests/test_ujson.py
+++ b/tests/test_ujson.py
@@ -1050,9 +1050,25 @@ def test_default_function():
         ujson.dumps(unjsonable_obj, default=default)
 
 
-@pytest.mark.parametrize("indent", list(range(65537, 65542)))
+@pytest.mark.parametrize("indent", [999, 1000, 1001, 1 << 30, 1 << 63, 1 << 128])
 def test_dump_huge_indent(indent):
-    ujson.encode({"a": True}, indent=indent)
+    obj = {"list": [1, [2, 3], 4], "nested": {"key": "value", "a": True}}
+    if indent <= 1000:
+        assert ujson.loads(ujson.encode(obj, indent=indent)) == obj
+    else:
+        with pytest.raises((ValueError, OverflowError)):
+            ujson.encode(obj, indent=indent)
+
+
+def test_negative_indent():
+    obj = {"a": [1, 2], "b": "c"}
+    assert ujson.dumps(obj) == '{"a":[1,2],"b":"c"}'
+    assert ujson.dumps(obj, 0) == '{"a":[1,2],"b":"c"}'
+    assert ujson.dumps(obj, indent=-1) == '{"a": [1,2],"b": "c"}'
+    assert ujson.dumps(obj, indent=-1000000) == '{"a": [1,2],"b": "c"}'
+    assert (
+        ujson.dumps(obj, indent=2) == '{\n  "a": [\n    1,\n    2\n  ],\n  "b": "c"\n}'
+    )
 
 
 @pytest.mark.parametrize("first_length", list(range(2, 7)))
-- 
2.35.6