CVE-2023-34620

@@ -11,6 +11,8 @@ class HJSONParser
     private $ch;   // The current character
     private $escapee = [];
     private $keepWsc; // keep whitespace
+    private $maxNestingDepth = 10000;
+    private $nestingDepth;
 
     public function __construct()
     {
@@ -44,6 +46,7 @@ public function parse($source, $options = [])
 
     private function resetAt()
     {
+        $this->nestingDepth = 0;
         $this->at = 0;
         $this->ch = ' ';
     }
@@ -99,9 +102,15 @@ private function value()
         $this->white();
         switch ($this->ch) {
             case '{':
-                return $this->object();
+                $this->nestingDepth++;
+                $ret = $this->object();
+                $this->nestingDepth--;
+                return $ret;
             case '[':
-                return $this->_array();
+                $this->nestingDepth++;
+                $ret = $this->_array();
+                $this->nestingDepth--;
+                return $ret;
             case '"':
                 return $this->string('"');
             case '\'':
@@ -157,6 +166,10 @@ private function _array()
         // Parse an array value.
         // assumeing ch === '['
 
+        if ($this->nestingDepth > $this->maxNestingDepth) {
+            $this->error("Exceeded max depth (".$this->maxNestingDepth.")");
+        }
+
         $array = [];
         $kw = null;
         $wat = null;
@@ -210,6 +223,11 @@ private function _array()
     private function object($withoutBraces = false)
     {
         // Parse an object value.
+
+        if ($this->nestingDepth > $this->maxNestingDepth) {
+            $this->error("Exceeded max depth (".$this->maxNestingDepth.")");
+        }
+
         $key = null;
         $object = new \stdClass();
         $kw = null;

@@ -12,6 +12,9 @@ import (
 
 const maxPointerDepth = 512
 
+// This limits the max nesting depth to prevent stack overflow.
+const maxNestingDepth = 10000
+
 type commentInfo struct {
 	hasComment bool
 	cmStart    int
@@ -73,6 +76,7 @@ type hjsonParser struct {
 	structTypeCache   map[reflect.Type]structFieldMap
 	willMarshalToJSON bool
 	nodeDestination   bool
+	nestingDepth      int
 }
 
 var unmarshalerText = reflect.TypeOf((*encoding.TextUnmarshaler)(nil)).Elem()
@@ -95,6 +99,7 @@ func (p *hjsonParser) setComment2(pCm *string, ciA, ciB commentInfo) {
 
 func (p *hjsonParser) resetAt() {
 	p.at = 0
+	p.nestingDepth = 0
 	p.next()
 }
 
@@ -549,6 +554,11 @@ func getElemTyperType(rv reflect.Value, t reflect.Type) reflect.Type {
 
 func (p *hjsonParser) readArray(dest reflect.Value, t reflect.Type) (value interface{}, err error) {
 	var node Node
+
+	if p.nestingDepth > maxNestingDepth {
+		return nil, p.errAt(fmt.Sprintf("Exceeded max depth (%d)", maxNestingDepth))
+	}
+
 	array := make([]interface{}, 0, 1)
 
 	// Skip '['.
@@ -624,6 +634,11 @@ func (p *hjsonParser) readObject(
 	// Parse an object value.
 	var node Node
 	var elemNode *Node
+
+	if p.nestingDepth > maxNestingDepth {
+		return nil, p.errAt(fmt.Sprintf("Exceeded max depth (%d)", maxNestingDepth))
+	}
+
 	object := NewOrderedMap()
 
 	// If withoutBraces == true we use the input argument ciBefore as
@@ -775,9 +790,13 @@ func (p *hjsonParser) readValue(dest reflect.Value, t reflect.Type) (ret interfa
 	// Parse an Hjson value. It could be an object, an array, a string, a number or a word.
 	switch p.ch {
 	case '{':
+		p.nestingDepth++
 		ret, err = p.readObject(false, dest, t, ciBefore)
+		p.nestingDepth--
 	case '[':
+		p.nestingDepth++
 		ret, err = p.readArray(dest, t)
+		p.nestingDepth--
 	case '"', '\'':
 		s, err := p.readString(true)
 		if err != nil {
@@ -942,6 +961,7 @@ func orderedUnmarshal(
 		structTypeCache:   map[reflect.Type]structFieldMap{},
 		willMarshalToJSON: willMarshalToJSON,
 		nodeDestination:   nodeDestination,
+		nestingDepth:      0,
 	}
 	parser.resetAt()
 	value, err := parser.rootValue(rv)

@@ -65,23 +65,25 @@ func run(t *testing.T, file string) {
 	if err := Unmarshal(testContent, &data); err != nil {
 		if !shouldFail {
 			t.Error(err)
-		} else {
-			return
 		}
+		return
 	} else if shouldFail {
 		t.Error(errors.New(name + " should_fail!"))
+		return
 	}
 
 	rjson, rhjson, cm2, cm3 := getResultContent(name)
 
 	actualHjson, err := Marshal(data)
 	if err != nil {
 		t.Error(err)
+		return
 	}
 	actualHjson = append(actualHjson, '\n')
 	actualJSON, err := json.MarshalIndent(data, "", "  ")
 	if err != nil {
 		t.Error(err)
+		return
 	}
 	actualJSON = append(actualJSON, '\n')
 	actualJSON = fixJSON(actualJSON)
@@ -92,10 +94,12 @@ func run(t *testing.T, file string) {
 		decOpt.WhitespaceAsComments = false
 		if err := UnmarshalWithOptions(testContent, &node, decOpt); err != nil {
 			t.Error(err)
+			return
 		}
 		actualCm2, err = Marshal(node)
 		if err != nil {
 			t.Error(err)
+			return
 		}
 		if len(actualCm2) > 0 && actualCm2[len(actualCm2)-1] != '\n' {
 			actualCm2 = append(actualCm2, '\n')
@@ -106,10 +110,12 @@ func run(t *testing.T, file string) {
 		var node Node
 		if err := Unmarshal(testContent, &node); err != nil {
 			t.Error(err)
+			return
 		}
 		actualCm3, err = Marshal(node)
 		if err != nil {
 			t.Error(err)
+			return
 		}
 		if len(actualCm3) > 0 && actualCm3[len(actualCm3)-1] != '\n' {
 			actualCm3 = append(actualCm3, '\n')
@@ -146,6 +152,7 @@ func run(t *testing.T, file string) {
 		err = Unmarshal(actualCm2, &roundTrip)
 		if err != nil {
 			t.Error(err)
+			return
 		}
 		if !reflect.DeepEqual(data, roundTrip) {
 			t.Errorf("cm2 roundtrip failed!")
@@ -163,6 +170,7 @@ func run(t *testing.T, file string) {
 		err = Unmarshal(actualCm3, &roundTrip)
 		if err != nil {
 			t.Error(err)
+			return
 		}
 		if !reflect.DeepEqual(data, roundTrip) {
 			t.Errorf("cm3 roundtrip failed!")