Repository navigation
reject non-integer JSON numbers where an integer is expected - #1240
Open
aysha-afrah26 wants to merge 1 commit into
Open
aysha-afrah26 wants to merge 1 commit into
aysha-afrah26 wants to merge 1 commit into
Conversation
json.get<T>() for an integral T converts a floating point number with a plain static_cast, which is undefined behavior outside the range of T, truncates fractions, and wraps out-of-range integers. Read those values through a new JsonToInteger<T> helper that throws RuntimeError instead: the elements of an integer array in JsonExporter::fromJson, the "json:" form of convertFromString<std::vector<int>>, async_delay in loadSubstitutionRuleFromJSON, and the uid/position/mode fields of the Groot2 hook requests. Behavior change: an integer array with a real or out-of-range element, and a fractional or out-of-range async_delay or hook uid, now throw instead of being silently converted.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
nlohmann's
get<T>()for an integralTconverts a JSON float with a barestatic_cast, so a value outside the range ofTis undefined behavior (UBSan float-cast-overflow), a fraction is truncated and an out-of-range integer wraps. Several readers apply it to external JSON:JsonExporter::fromJsonpicksstd::vector<int>from the first array element only and then casts every element (ImportBlackboardFromJSONwith{"v":[1, 1e300]}), ajson:[1e300]value on astd::vector<int>port in the XML,async_delayinloadSubstitutionRuleFromJSON, and theuid/position/modefields of the Groot2HOOK_INSERT,BREAKPOINT_UNLOCKandHOOK_REMOVErequests. On the Groot2 server auidofnode_uid + 65536ornode_uid + 0.5silently installs the hook on that real node, and1e300is UB on the server thread. UBSan reports1e+300 is outside the range of representable values of type 'int'(json.hpp:4983) for the first three, and on master the hook request with a wrapped uid is accepted. #1186 fixed the scalar branch offromJson; this covers the array branch and every otherget<integral>call on external input in the tree (theBT_JSON_CONVERTERfields belong to user types and are left alone). The new inlineJsonToInteger<T>in json_export.h accepts only JSON integers representable asTand throwsRuntimeErrorotherwise, so a bad value takes the existing error paths; the Groot2 server already turns the exception into an error reply.Behavior change: an integer array with a real or out-of-range element, and a fractional or out-of-range
async_delayor hookuid, now throw instead of being converted. Inline header additions only, no ABI change. The new testsJsonTest.IntegerValuesAreRangeChecked,Substitution.ParserRejectsNonIntegerAsyncDelayandGroot2PublisherIntegration.HookRequestRejectsNonIntegerUidfail on master and pass with the change. Full ctest is 549/549 under ASan+UBSan on macOS, and clang-format and codespell are clean (clang-tidy-21 was not available locally).