Skip to content

fix: report stackLimit exceedance as a parse error, not a thrown exception - #1717

Open
YuEfSaEDU wants to merge 1 commit into
open-source-parsers:masterfrom
YuEfSaEDU:fix/ourreader-stack-limit
Open

fix: report stackLimit exceedance as a parse error, not a thrown exception#1717
YuEfSaEDU wants to merge 1 commit into
open-source-parsers:masterfrom
YuEfSaEDU:fix/ourreader-stack-limit

Conversation

@YuEfSaEDU

Copy link
Copy Markdown

Exceeding the configured stackLimit made CharReader::parse() — the engine behind fromJson-style parsing — terminate the process instead of reporting a parse failure: OurReader::readValue() called throwRuntimeError(), and the resulting Json::RuntimeError escapes parse()'s bool-return plus error-string contract and goes uncaught in typical callers.

This change reports the depth violation through the reader's existing error collection instead, so deeply nested input (for example ~1100 consecutive [) yields false with Exceeded stackLimit for nested object and/or array values. at the offending offset, consistent with every other parse error and with the existing JSON_USE_EXCEPTION=0 behavior. The CharReaderBuilder documentation for stackLimit is updated to match.

CharReaderTest/parseWithStackLimit now asserts the clean-failure contract for both exception modes, and a new parseDeeplyNestedArrayFailsCleanly test covers the issue's payload. The full unit suite (133 tests) passes on MSVC x64.

Fixes #1704

…ption

OurReader::readValue() enforced the configured stackLimit by calling
throwRuntimeError() when JSON_USE_EXCEPTION is enabled (the default). The
Json::RuntimeError escapes CharReader::parse(), whose contract is to
return false and fill in the error string, so a document with ~1100
nested '[' characters terminates an application that does not catch the
exception. Report the depth failure through addError() instead,
mirroring the existing JSON_USE_EXCEPTION=0 path, and update the
CharReaderBuilder documentation accordingly.

Fixes open-source-parsers#1704
@greptile-apps

greptile-apps Bot commented Sep 8, 2026

Copy link
Copy Markdown

Greptile Summary

This PR changes CharReader stack-limit violations from escaping runtime exceptions into ordinary parse failures with location-aware diagnostics.

  • Replaces the exception-mode branch in OurReader::readValue() with the existing error-collection path.
  • Documents the non-throwing CharReaderBuilder contract.
  • Extends unit coverage across configured limits, mixed nesting, default limits, and deeply nested fuzz-style input.

Confidence Score: 5/5

The PR appears safe to merge because the depth guard remains active while its failure now follows the documented Boolean parse-result and diagnostic contract.

The changed branch records the depth violation before nested grammar recovery unwinds, preserving the error and returning a clean parse failure; the updated tests cover configured boundaries, mixed nesting, the default limit, and the reported location.

Important Files Changed

Filename Overview
include/json/reader.h Updates the CharReaderBuilder stack-limit documentation to describe parse failure and diagnostic reporting rather than an exception.
src/lib_json/json_reader.cpp Routes OurReader depth-limit violations through addError() so recursive parsing unwinds and returns false without an escaping exception.
src/test_lib_json/main.cpp Updates stack-limit assertions for both exception modes and adds regression coverage for deeply nested arrays and exact diagnostic locations.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[CharReader parse input] --> B[OurReader readValue]
  B --> C{Depth exceeds stackLimit?}
  C -- No --> D[Tokenize and build Value tree]
  C -- Yes --> E[Record stack-limit parse error]
  E --> F[Unwind nested grammar]
  F --> G[Return false with formatted diagnostics]
  D --> H[Return parse result]
Loading

Reviews (1): Last reviewed commit: "fix: report stackLimit exceedance as a p..." | Re-trigger Greptile

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Denial-of-service from uncontrolled deep recursion in OurReader::readValue (exceed stackLimit)

2 participants