UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

@@ -575,7 +575,7 @@ static void Buffer_AppendIndentNewlineUnchecked(JSONObjectEncoder *enc)
 
 static void Buffer_AppendIndentUnchecked(JSONObjectEncoder *enc, JSINT32 value)
 {
-  int i;
+  ptrdiff_t i;
   if (enc->indent > 0)
     while (value-- > 0)
       for (i = 0; i < enc->indent; i++)
@@ -741,10 +741,11 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
 
       Buffer_AppendCharUnchecked (enc, '[');
 
+      // The extra 1 byte covers the optional newline.
+      size_t per_item_reserve = (enc->indent > 0 ? enc->indent : 0) * (enc->level + 1) + enc->itemSeparatorLength + 1;
       while (enc->iterNext(obj, &tc))
       {
-        // The extra 1 byte covers the optional newline.
-        Buffer_Reserve (enc, enc->indent * (enc->level + 1) + enc->itemSeparatorLength + 1);
+        Buffer_Reserve (enc, per_item_reserve);
 
         if (count > 0)
         {
@@ -769,7 +770,7 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
 
       enc->iterEnd(obj, &tc);
 
-      if (count > 0) {
+      if (count > 0 && enc->indent > 0) {
         // Reserve space for the indentation plus the newline.
         Buffer_Reserve (enc, enc->indent * enc->level + 1);
         Buffer_AppendIndentNewlineUnchecked (enc);
@@ -786,10 +787,11 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
 
       Buffer_AppendCharUnchecked (enc, '{');
 
+      // The extra 1 byte covers the optional newline.
+      size_t reserve_size = (enc->indent > 0 ? enc->indent : 0) * (enc->level + 1) + enc->itemSeparatorLength + 1;
       while ((res = enc->iterNext(obj, &tc)))
       {
-        // The extra 1 byte covers the optional newline.
-        Buffer_Reserve (enc, enc->indent * (enc->level + 1) + enc->itemSeparatorLength + 1);
+        Buffer_Reserve (enc, reserve_size);
 
         if(res < 0)
         {
@@ -823,7 +825,7 @@ static void encode(JSOBJ obj, JSONObjectEncoder *enc, const char *name, size_t c
 
       enc->iterEnd(obj, &tc);
 
-      if (count > 0) {
+      if (count > 0 && enc->indent > 0) {
         Buffer_Reserve (enc, enc->indent * enc->level + 1);
         Buffer_AppendIndentNewlineUnchecked (enc);
         Buffer_AppendIndentUnchecked (enc, enc->level);

@@ -54,6 +54,7 @@ tree doesn't have cyclic references.
 #define __ULTRAJSON_H__
 
 #include <stdio.h>
+#include <stddef.h>
 
 // Max decimals to encode double floating point numbers with
 #ifndef JSON_DOUBLE_MAX_DECIMALS
@@ -257,7 +258,7 @@ typedef struct __JSONObjectEncoder
 
   /*
   Configuration for spaces of indent */
-  int indent;
+  ptrdiff_t indent;
 
   /*
   If true, NaN will be encoded as a string matching the Python standard library's JSON behavior.

@@ -678,6 +678,7 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs)
   PyObject *separatorsKeyBytes = NULL;
   int allowNan = -1;
   int orejectBytes = -1;
+  int indent = 0;
   size_t retLen;
 
   JSONObjectEncoder encoder =
@@ -714,7 +715,7 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs)
 
   PRINTMARK();
 
-  if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|OOOOiiiOO", kwlist, &oinput, &oensureAscii, &oencodeHTMLChars, &oescapeForwardSlashes, &osortKeys, &encoder.indent, &allowNan, &orejectBytes, &odefaultFn, &oseparators))
+  if (!PyArg_ParseTupleAndKeywords(args, kwargs, "O|OOOOiiiOO", kwlist, &oinput, &oensureAscii, &oencodeHTMLChars, &oescapeForwardSlashes, &osortKeys, &indent, &allowNan, &orejectBytes, &odefaultFn, &oseparators))
   {
     return NULL;
   }
@@ -761,6 +762,19 @@ PyObject* objToJSON(PyObject* self, PyObject *args, PyObject *kwargs)
     encoder.rejectBytes = orejectBytes;
   }
 
+  if (indent < -1)
+  {
+    encoder.indent = -1;
+  }
+  else if (indent > 1000)
+  {
+    PyErr_SetString(PyExc_ValueError, "Maximum allowed indentation is 1000");
+    return NULL;
+  }
+  else {
+    encoder.indent = indent;
+  }
+
   if (oseparators != NULL && oseparators != Py_None)
   {
     if (!PyTuple_Check(oseparators))

@@ -1059,9 +1059,25 @@ def test_recursive_default(self):
             ujson.dumps(unjsonable_obj, default=self.default)
 
 
-@pytest.mark.parametrize("indent", list(range(65537, 65542)))
+@pytest.mark.parametrize("indent", [999, 1000, 1001, 1 << 30, 1 << 63, 1 << 128])
 def test_dump_huge_indent(indent):
-    ujson.encode({"a": True}, indent=indent)
+    obj = {"list": [1, [2, 3], 4], "nested": {"key": "value", "a": True}}
+    if indent <= 1000:
+        assert ujson.loads(ujson.encode(obj, indent=indent)) == obj
+    else:
+        with pytest.raises((ValueError, OverflowError)):
+            ujson.encode(obj, indent=indent)
+
+
+def test_negative_indent():
+    obj = {"a": [1, 2], "b": "c"}
+    assert ujson.dumps(obj) == '{"a":[1,2],"b":"c"}'
+    assert ujson.dumps(obj, 0) == '{"a":[1,2],"b":"c"}'
+    assert ujson.dumps(obj, indent=-1) == '{"a": [1,2],"b": "c"}'
+    assert ujson.dumps(obj, indent=-1000000) == '{"a": [1,2],"b": "c"}'
+    assert (
+        ujson.dumps(obj, indent=2) == '{\n  "a": [\n    1,\n    2\n  ],\n  "b": "c"\n}'
+    )
 
 
 @pytest.mark.parametrize("first_length", list(range(2, 7)))