From 98ab9f31c3c685c4235d4565456682c8eba9c3cb Mon Sep 17 00:00:00 2001 From: Niels Lohmann Date: Sun, 6 Sep 2026 11:19:06 +0200 Subject: [PATCH] Make the huge-claimed-length DoS regression tests portable across size_t widths On a platform where size_t is narrower than 64 bits (e.g. 32-bit mingw/msvc x86), the previously-hardcoded huge test lengths either collide with that platform's unknown_size() sentinel (CBOR/MessagePack, both using exactly SIZE_MAX) or exceed the platform's smaller vector::max_size() (UBJSON/BJData's 0x7FFFFFFF), so the header is now rejected outright (out_of_range.408) instead of being accepted and only found short of data (parse_error.110). Both are safe, bounded rejections of the hostile input; the property under test -- no attempt to allocate space for billions of elements -- holds either way. Accept both outcomes instead of pinning the 64-bit-only exact result. Also fixed an unrelated clang-tidy finding (google-readability-casting) on the functional-style std::size_t(...) casts in the neighboring "arrays of various sizes" section. Signed-off-by: Niels Lohmann --- tests/src/unit-bjdata.cpp | 31 ++++++++++++++++++++++++++++--- tests/src/unit-cbor.cpp | 38 ++++++++++++++++++++++++++++++++------ tests/src/unit-msgpack.cpp | 31 ++++++++++++++++++++++++++++--- tests/src/unit-ubjson.cpp | 31 ++++++++++++++++++++++++++++--- 4 files changed, 116 insertions(+), 15 deletions(-) diff --git a/tests/src/unit-bjdata.cpp b/tests/src/unit-bjdata.cpp index 00b3b62bb..f94d808ae 100644 --- a/tests/src/unit-bjdata.cpp +++ b/tests/src/unit-bjdata.cpp @@ -3501,9 +3501,34 @@ TEST_CASE("issue #5405 - array reserve for definite-length BJData arrays") // billions of elements before the missing data is detected. json _; const std::vector input = {'[', '$', 'i', '#', 'l', 0xFF, 0xFF, 0xFF, 0x7F}; - CHECK_THROWS_WITH_AS(_ = json::from_bjdata(input), - "[json.exception.parse_error.110] parse error at byte 10: syntax error while parsing BJData number: unexpected end of input", - json::parse_error&); + // On a platform where std::vector::max_size() is smaller than + // the claimed count (e.g. 32-bit, where max_size() is bounded by a + // 32-bit SIZE_MAX divided by sizeof(json)), the SAX consumer's own + // check rejects the header outright (out_of_range.408, with the + // claimed count in the message) instead of accepting it and only + // finding it short of data once the (capped) reservation looks for + // element bytes that were never provided (parse_error.110). Either + // is an acceptable, bounded rejection of the hostile header -- the + // property under test is that no path attempts to allocate space + // for billions of elements. + bool threw = false; + try + { + _ = json::from_bjdata(input); + } + catch (const json::parse_error& e) + { + threw = true; + CHECK(e.id == 110); + CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 10: syntax error while parsing BJData number: unexpected end of input"); + } + catch (const json::out_of_range& e) + { + threw = true; + CHECK(e.id == 408); + CHECK(std::string(e.what()).find("excessive array size") != std::string::npos); + } + CHECK(threw); CHECK(json::from_bjdata(input, true, false).is_discarded()); } diff --git a/tests/src/unit-cbor.cpp b/tests/src/unit-cbor.cpp index ee5651b46..3a62fb768 100644 --- a/tests/src/unit-cbor.cpp +++ b/tests/src/unit-cbor.cpp @@ -2046,9 +2046,35 @@ TEST_CASE("issue #5405 - array reserve for definite-length CBOR arrays") // billions of elements before the missing data is detected. json _; const std::vector input = {0x9A, 0xFF, 0xFF, 0xFF, 0xFF}; - CHECK_THROWS_WITH_AS(_ = json::from_cbor(input), - "[json.exception.parse_error.110] parse error at byte 6: syntax error while parsing CBOR value: unexpected end of input", - json::parse_error&); + // On a platform where std::size_t is narrower than 64 bits (e.g. + // 32-bit), the claimed count 0xFFFFFFFF coincides with that + // platform's detail::unknown_size() sentinel (SIZE_MAX), so the + // format-level size check rejects it outright (out_of_range.408, + // "excessive ... size") before the SAX consumer's own max_size() + // check would even run; on a 64-bit platform it passes both of + // those checks and is only found short of data once the (capped) + // reservation looks for element bytes that were never provided + // (parse_error.110). Either is an acceptable, bounded rejection of + // the hostile header -- the property under test is that no path + // attempts to allocate space for billions of elements. + bool threw = false; + try + { + _ = json::from_cbor(input); + } + catch (const json::parse_error& e) + { + threw = true; + CHECK(e.id == 110); + CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 6: syntax error while parsing CBOR value: unexpected end of input"); + } + catch (const json::out_of_range& e) + { + threw = true; + CHECK(e.id == 408); + CHECK(std::string(e.what()).find("excessive") != std::string::npos); + } + CHECK(threw); CHECK(json::from_cbor(input, true, false).is_discarded()); } @@ -2056,9 +2082,9 @@ TEST_CASE("issue #5405 - array reserve for definite-length CBOR arrays") { for (const auto size : { - std::size_t(0), std::size_t(1), std::size_t(5), // small - std::size_t(16384), // exactly at the reserve cap - std::size_t(20000) // above the reserve cap + std::size_t{0}, std::size_t{1}, std::size_t{5}, // small + std::size_t{16384}, // exactly at the reserve cap + std::size_t{20000} // above the reserve cap }) { CAPTURE(size) diff --git a/tests/src/unit-msgpack.cpp b/tests/src/unit-msgpack.cpp index bd83cb4b3..1823a1d7e 100644 --- a/tests/src/unit-msgpack.cpp +++ b/tests/src/unit-msgpack.cpp @@ -1608,9 +1608,34 @@ TEST_CASE("issue #5405 - array reserve for definite-length MessagePack arrays") // billions of elements before the missing data is detected. json _; const std::vector input = {0xdd, 0xFF, 0xFF, 0xFF, 0xFF}; - CHECK_THROWS_WITH_AS(_ = json::from_msgpack(input), - "[json.exception.parse_error.110] parse error at byte 6: syntax error while parsing MessagePack value: unexpected end of input", - json::parse_error&); + // On a platform where std::size_t is narrower than 64 bits (e.g. + // 32-bit), the claimed count 0xFFFFFFFF coincides with that + // platform's SIZE_MAX, which some size-narrowing checks treat the + // same as detail::unknown_size(); it may then be rejected before + // the SAX consumer's own max_size() check (out_of_range.408) rather + // than being accepted and only found short of data once the + // (capped) reservation looks for element bytes that were never + // provided (parse_error.110). Either is an acceptable, bounded + // rejection of the hostile header -- the property under test is + // that no path attempts to allocate space for billions of elements. + bool threw = false; + try + { + _ = json::from_msgpack(input); + } + catch (const json::parse_error& e) + { + threw = true; + CHECK(e.id == 110); + CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 6: syntax error while parsing MessagePack value: unexpected end of input"); + } + catch (const json::out_of_range& e) + { + threw = true; + CHECK(e.id == 408); + CHECK(std::string(e.what()).find("excessive") != std::string::npos); + } + CHECK(threw); CHECK(json::from_msgpack(input, true, false).is_discarded()); } diff --git a/tests/src/unit-ubjson.cpp b/tests/src/unit-ubjson.cpp index 779b59306..dee41edf9 100644 --- a/tests/src/unit-ubjson.cpp +++ b/tests/src/unit-ubjson.cpp @@ -2161,9 +2161,34 @@ TEST_CASE("issue #5405 - array reserve for definite-length UBJSON arrays") // missing data is detected. json _; const std::vector input = {'[', '$', 'i', '#', 'l', 0x7F, 0xFF, 0xFF, 0xFF}; - CHECK_THROWS_WITH_AS(_ = json::from_ubjson(input), - "[json.exception.parse_error.110] parse error at byte 10: syntax error while parsing UBJSON number: unexpected end of input", - json::parse_error&); + // On a platform where std::vector::max_size() is smaller than + // the claimed count (e.g. 32-bit, where max_size() is bounded by a + // 32-bit SIZE_MAX divided by sizeof(json)), the SAX consumer's own + // check rejects the header outright (out_of_range.408, with the + // claimed count in the message) instead of accepting it and only + // finding it short of data once the (capped) reservation looks for + // element bytes that were never provided (parse_error.110). Either + // is an acceptable, bounded rejection of the hostile header -- the + // property under test is that no path attempts to allocate space + // for billions of elements. + bool threw = false; + try + { + _ = json::from_ubjson(input); + } + catch (const json::parse_error& e) + { + threw = true; + CHECK(e.id == 110); + CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 10: syntax error while parsing UBJSON number: unexpected end of input"); + } + catch (const json::out_of_range& e) + { + threw = true; + CHECK(e.id == 408); + CHECK(std::string(e.what()).find("excessive array size") != std::string::npos); + } + CHECK(threw); CHECK(json::from_ubjson(input, true, false).is_discarded()); }