Stop parsing JSON after first finished construct.

Fix https://github.com/bitcoin/bitcoin/issues/6558.  In particular, stop
parsing JSON after the first object or array is finished.  Check that no
other garbage follows, and fail the parser if it does.
This commit is contained in:
Daniel Kraft 2015-08-20 12:48:43 +02:00
parent ef30389e2a
commit e938122b7b
2 changed files with 23 additions and 6 deletions

View File

@ -314,6 +314,21 @@ BOOST_AUTO_TEST_CASE(univalue_readwrite)
BOOST_CHECK(obj["key3"].isObject()); BOOST_CHECK(obj["key3"].isObject());
BOOST_CHECK_EQUAL(strJson1, v.write()); BOOST_CHECK_EQUAL(strJson1, v.write());
/* Check for (correctly reporting) a parsing error if the initial
JSON construct is followed by more stuff. Note that whitespace
is, of course, exempt. */
BOOST_CHECK(v.read(" {}\n "));
BOOST_CHECK(v.isObject());
BOOST_CHECK(v.read(" []\n "));
BOOST_CHECK(v.isArray());
BOOST_CHECK(!v.read("@{}"));
BOOST_CHECK(!v.read("{} garbage"));
BOOST_CHECK(!v.read("[]{}"));
BOOST_CHECK(!v.read("{}[]"));
BOOST_CHECK(!v.read("{} 42"));
} }
BOOST_AUTO_TEST_SUITE_END() BOOST_AUTO_TEST_SUITE_END()

View File

@ -244,16 +244,16 @@ bool UniValue::read(const char *raw)
bool expectColon = false; bool expectColon = false;
vector<UniValue*> stack; vector<UniValue*> stack;
enum jtokentype tok = JTOK_NONE;
enum jtokentype last_tok = JTOK_NONE;
while (1) {
last_tok = tok;
string tokenVal; string tokenVal;
unsigned int consumed; unsigned int consumed;
enum jtokentype tok = JTOK_NONE;
enum jtokentype last_tok = JTOK_NONE;
do {
last_tok = tok;
tok = getJsonToken(tokenVal, consumed, raw); tok = getJsonToken(tokenVal, consumed, raw);
if (tok == JTOK_NONE || tok == JTOK_ERR) if (tok == JTOK_NONE || tok == JTOK_ERR)
break; return false;
raw += consumed; raw += consumed;
switch (tok) { switch (tok) {
@ -377,9 +377,11 @@ bool UniValue::read(const char *raw)
default: default:
return false; return false;
} }
} } while (!stack.empty ());
if (stack.size() != 0) /* Check that nothing follows the initial construct (parsed above). */
tok = getJsonToken(tokenVal, consumed, raw);
if (tok != JTOK_NONE)
return false; return false;
return true; return true;