Skip to content

fix: report stackLimit exceedance as a parse error, not a thrown exception - #1717

Open
YuEfSaEDU wants to merge 2 commits into
open-source-parsers:masterfrom
YuEfSaEDU:fix/ourreader-stack-limit
Open

YuEfSaEDU wants to merge 2 commits into
open-source-parsers:masterfrom
YuEfSaEDU:fix/ourreader-stack-limit

Conversation

@YuEfSaEDU

Copy link
Copy Markdown

Exceeding the configured stackLimit made CharReader::parse() — the engine behind fromJson-style parsing — terminate the process instead of reporting a parse failure: OurReader::readValue() called throwRuntimeError(), and the resulting Json::RuntimeError escapes parse()'s bool-return plus error-string contract and goes uncaught in typical callers.

This change reports the depth violation through the reader's existing error collection instead, so deeply nested input (for example ~1100 consecutive [) yields false with Exceeded stackLimit for nested object and/or array values. at the offending offset, consistent with every other parse error and with the existing JSON_USE_EXCEPTION=0 behavior. The CharReaderBuilder documentation for stackLimit is updated to match.

CharReaderTest/parseWithStackLimit now asserts the clean-failure contract for both exception modes, and a new parseDeeplyNestedArrayFailsCleanly test covers the issue's payload. The full unit suite (133 tests) passes on MSVC x64.

Fixes #1704

…ption

OurReader::readValue() enforced the configured stackLimit by calling
throwRuntimeError() when JSON_USE_EXCEPTION is enabled (the default). The
Json::RuntimeError escapes CharReader::parse(), whose contract is to
return false and fill in the error string, so a document with ~1100
nested '[' characters terminates an application that does not catch the
exception. Report the depth failure through addError() instead,
mirroring the existing JSON_USE_EXCEPTION=0 path, and update the
CharReaderBuilder documentation accordingly.

Fixes open-source-parsers#1704
@greptile-apps

greptile-apps Bot commented Sep 8, 2026 •

Copy link
Copy Markdown

RetriggerView in GreptileConfidence Score: 5/5

[Medium impact] The PR appears safe to merge; excessive depth follows the existing parse-error path.

Summary

Exceeding stackLimit now makes CharReader::parse() return false with an error message instead of throwing.

  • Deep JSON nesting now returns a parse error instead of escaping as an exception.

The previous-review merge bases differ, so the full PR diff was reviewed. No previous review threads were supplied. No actionable issues were found.

Reviews (2) · Last reviewed commit: "Merge branch 'master' into fix/ourreader..." · Reviewed by Greptile

@coveralls

Copy link
Copy Markdown

Coverage Report for CI Build 40347639019

Coverage decreased (-0.01%) to 89.915%

Details

  • Coverage decreased (-0.01%) from the base build.
  • Patch coverage: No coverable lines changed in this PR.
  • 1 coverage regression across 1 file.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

1 previously-covered line in 1 file lost coverage.

File Lines Losing Coverage Coverage
src/lib_json/json_value.cpp 1 87.31%

Coverage Stats

Coverage Status
Relevant Lines: 2743
Covered Lines: 2617
Line Coverage: 95.41%
Relevant Branches: 2641
Covered Branches: 2224
Branch Coverage: 84.21%
Branches in Coverage %: Yes
Coverage Strength: 23939.25 hits per line

💛 - Coveralls

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Denial-of-service from uncontrolled deep recursion in OurReader::readValue (exceed stackLimit)

4 participants