Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Segmentation fault in destructor in case of large inputs #1835

Closed
nlohmann opened this issue Nov 9, 2019 · 2 comments
Closed

Segmentation fault in destructor in case of large inputs #1835

nlohmann opened this issue Nov 9, 2019 · 2 comments
Assignees
Labels
kind: bug release item: 🐛 bug fix solution: proposed fix a fix for the issue has been proposed and waits for confirmation
Milestone

Comments

@nlohmann
Copy link
Owner

nlohmann commented Nov 9, 2019

  • What is the issue you have?

Project bad_json_parsers tested how JSON parser libraries react on deeply nested inputs. It turns out that this library segfaults at a certain nesting depth. I analyzed the result, and it turned out that the segmentation fault does not occur in the parser/construction part, but rather during destruction. But avoiding destruction (i.e., by adjusting the program as follows:

#include <iostream>
#include <cstdlib>
#include "json.hpp"

// for convenience
using json = nlohmann::json;

int main(void) {
	auto j = json::parse(std::cin);
	std::cout << j.type_name() << std::endl;
	_Exit(0);
}

the library can process much longer inputs (46875000 and greater).

  • Please describe the steps to reproduce the issue. Can you provide a small but working code example?

Either use bad_json_parsers, or generate a deeply nested file (like input.json.zip), parse it, and let the destructor be called.

  • What is the expected behavior?

No segmentation fault, but rather an out-of-memory error during parsing of large inputs.

  • And what is the actual behavior instead?

On my machine, I get

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=2, address=0x7ffeef3ffff8)
  * frame #0: 0x0000000100016528 JSON Debug`nlohmann::basic_json<std::__1::map, std::__1::vector, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, bool, long long, unsigned long long, double, std::__1::allocator, nlohmann::adl_serializer>::assert_invariant(this=<unavailable>) const at json.hpp:15588

and a stack trace of 94000 frames.

MacOS Version 10.14.6 (18G1007), Xcode Version 11.0 (11A420a). It is a supported compiler.

  • Did you use a released version of the library or the version from the develop branch?

Both develop and version 3.7.1.

Yes, everything compiles and runs fine.

@nlohmann
Copy link
Owner Author

nlohmann commented Nov 9, 2019

There was a proposal to fix this: #1436. Also related: #832, #1419.

@nlohmann nlohmann added the solution: proposed fix a fix for the issue has been proposed and waits for confirmation label Nov 9, 2019
@nlohmann nlohmann self-assigned this Nov 10, 2019
@nlohmann nlohmann added this to the Release 3.7.2 milestone Nov 10, 2019
@nlohmann
Copy link
Owner Author

Fixed by merging #1436.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind: bug release item: 🐛 bug fix solution: proposed fix a fix for the issue has been proposed and waits for confirmation
Projects
None yet
Development

No branches or pull requests

1 participant