Skip to content

Reject nested indefinite-length CBOR string chunks - #5325

Open
JosephDemarest wants to merge 1 commit into
nlohmann:developfrom
JosephDemarest:codex/nlohmann-5317-cbor-chunks
Open

Reject nested indefinite-length CBOR string chunks#5325
JosephDemarest wants to merge 1 commit into
nlohmann:developfrom
JosephDemarest:codex/nlohmann-5317-cbor-chunks

Conversation

@JosephDemarest

Copy link
Copy Markdown

Summary

  • enforce RFC 8949 Section 3.2.3 by allowing only definite-length chunks inside indefinite-length text and byte strings
  • add regression coverage for both CBOR major types and update the existing nested-byte-string fixture expectation
  • regenerate the amalgamated header and document the chunk requirement

Closes #5317.

Validation

  • ctest --test-dir build17 -j 8 -LE "not_reproducible|git_required" --output-on-failure — 77/77 passed (Clang 20, C++17)
  • focused test-cbor_cpp17 and test-regression2_cpp17 targets — passed
  • compiled and ran the malformed-input check against single_include/nlohmann/json.hpp — both inputs raised parse_error.113 at byte 2
  • Artistic Style 3.4.13 and git diff --check — clean

Checklist

Signed-off-by: Joseph.Demarest <joseph@demarest.dev>
Comment on lines +1031 to +1032
return sax->parse_error(chars_read, last_token, parse_error::create(113, chars_read,
exception_message(input_format_t::cbor, concat("expected length specification (0x60-0x7B) or indefinite string type (0x7F); last byte: 0x", last_token), "string"), nullptr));

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can yield confusing error messages like

expected length specification (0x60-0x7B) or indefinite string type (0x7F); last byte: 0x7F

Maybe we should rather have something like

concat("indefinite-length string is not allowed inside indefinite-length string; last byte: 0x", last_token)

or just drop the or indefinite string type (0x7F).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CBOR: nested indefinite-length strings/byte strings are accepted (RFC 8949 3.2.3 requires definite-length chunks)

2 participants