Skip to content

Conversation

SindriFr
Copy link
Contributor

Summary of the changes (Less than 80 chars)

  • Improve performance of JsonSerializer.Parse
  • Avoid buffer overflow bug in System.Text.Json WriteTo for complex nested JSON objects

…rse with Clone

The JsonSerializer.Parse method was performing an unnecessary round-trip
serialization (JsonElement -> Utf8JsonWriter -> Utf8JsonReader -> JsonElement).

More critically, the WriteTo() operation triggered a buffer overflow bug in
System.Text.Json's WriteComplexElement when processing complex nested JSON objects larger
than Utf8JsonWriter's internal buffer of 4KB, leading to memory corruption and undefined behaviour.

Replace the round-trip with JsonElement.Clone() which:
- Preserves identical semantics
- Eliminates the buffer overflow risk entirely
- Improves performance by avoiding unnecessary serialization
- Maintains proper memory management for the cloned element
@CLAassistant
Copy link

CLAassistant commented Aug 14, 2025

CLA assistant check
All committers have signed the CLA.

@SindriFr
Copy link
Contributor Author

SindriFr commented Aug 14, 2025

The JsonSerializer.Parse method was performing an unnecessary round-trip serialization (JsonElement -> Utf8JsonWriter -> Utf8JsonReader -> JsonElement).

More critically, the WriteTo() operation triggered a buffer overflow bug in System.Text.Json's WriteComplexElement when processing complex nested JSON objects larger than Utf8JsonWriter's internal buffer of 4KB, leading to memory corruption and undefined behaviour.

Replace the round-trip with JsonElement.Clone() which:

  • Preserves identical semantics
  • Eliminates the buffer overflow risk entirely
  • Improves performance by avoiding unnecessary serialization
  • Maintains proper memory management for the cloned element

Sorry I didn't set up a bug report before opening the pull request, but reproducing this bug outside my application has been a challenge.
I hope the performance improvement and simplification is enough to warrant a merge.

@michaelstaib
Copy link
Member

@SindriFr thanks for the PR!

@michaelstaib michaelstaib merged commit f921856 into ChilliCream:main Aug 14, 2025
108 checks passed
@SindriFr SindriFr deleted the fix/unnecessary-json-serializer-round-trip branch August 14, 2025 17:15
@michaelstaib michaelstaib added the 🍒 cherry-pick Consider cherry-picking these changes into the previous major version. label Aug 27, 2025
@michaelstaib michaelstaib added this to the HC-15.1.9 milestone Aug 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🍒 cherry-pick Consider cherry-picking these changes into the previous major version. 🌶️ strawberry shake

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants