feedc0de/ArduinoJson
1
0
Fork 0
forked from bblanchon/ArduinoJson
Code Pull Requests Activity

Added a nesting limit to the parser to prevent stack overflow that could be a security issue

Browse Source
This commit is contained in:
Benoit Blanchon
2014-11-06 10:24:37 +01:00
parent 2e4dd2d591
commit a3425a6306
5 changed files with 104 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
include/ArduinoJson/Internals/JsonParser.hpp
View File

@ -13,7 +13,8 @@ namespace Internals {
class JsonParser {
public:
JsonParser(JsonBuffer *buffer, char *json) : _buffer(buffer), _ptr(json) {}
JsonParser(JsonBuffer *buffer, char *json, uint8_t nestingLimit)
: _buffer(buffer), _ptr(json), _nestingLimit(nestingLimit) {}
JsonArray &parseArray();
JsonObject &parseObject();
@ -33,6 +34,7 @@ class JsonParser {
JsonBuffer *_buffer;
char *_ptr;
uint8_t _nestingLimit;
};
}
}

6
include/ArduinoJson/JsonBuffer.hpp
View File

@ -19,9 +19,11 @@ class JsonBuffer {
JsonArray &createArray();
JsonObject &createObject();
JsonArray &parseArray(char *json);
JsonObject &parseObject(char *json);
JsonArray &parseArray(char *json, uint8_t nestingLimit = DEFAULT_LIMIT);
JsonObject &parseObject(char *json, uint8_t nestingLimit = DEFAULT_LIMIT);
virtual void *alloc(size_t size) = 0;
static const uint8_t DEFAULT_LIMIT = 10;
};
}