Skip to content

Commit 8a2f731

Browse files
committed
Reduce the JSONCPP_DEPRECATED_STACK_LIMIT to 500.
This seems to fix the issues that the security team found here: TechSmith/CamtasiaWin#23300.
1 parent 642fee9 commit 8a2f731

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

src/lib_json/json_reader.cpp

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,16 @@
4444

4545
// Define JSONCPP_DEPRECATED_STACK_LIMIT as an appropriate integer at compile
4646
// time to change the stack limit
47+
// NOTE:LEA: reduced JSONCPP_DEPRECATED_STACK_LIMIT from 1000 to 500. This is the stack limit
48+
// of the Reader::nodes_ and not the call stack limit of the system. At 1000, with a
49+
// json file designed to cause stack overflow (as a hacking tool) this would overflow
50+
// the system callstack when the Reader::nodes_ was only at 662 or so
51+
// For Techsmith's purposes, we never have project nodes nested so deeply, so 500 seems
52+
// like a perfectly reasonable limit and should not cause any projects to fail to load.
53+
// Also, when trying to create that deep a nesting by repeated grouping of a media,
54+
// Camtasiaa failed at ~150 levels deep so I could not get anywhere near 500.
4755
#if !defined(JSONCPP_DEPRECATED_STACK_LIMIT)
48-
#define JSONCPP_DEPRECATED_STACK_LIMIT 1000
56+
#define JSONCPP_DEPRECATED_STACK_LIMIT 500
4957
#endif
5058

5159
static size_t const stackLimit_g =

0 commit comments

Comments
 (0)