/ 
JSON-XS-4.05

Changes for version 4.05

  • the incremental parser would not properly reset parsing offset after removing a top-level number json number, causing memory corruption. this is potentially a very serious vulnerability. (reported by Albert Gierlach).
  • the ignore initial whitespace optimisation in the incremental parser could result in the parser reading beyond the end of string, potentially leading to parsing errors or skipping json texts.
  • FREEZE method calls could move the stack and cause a use-after-free. requires allow_tags and a suitable FREEZE method to be exploited (reported by Albert Gierlach).
  • json_sv_grow would not allocate space for the trailing 0 byte. possibly exploitable. (reported by Albert Gierlach).
  • the incremental parser did not properly detect embedded NUL characters as an error (reported by Peter Juhasz and his LLM).
  • string and object decoding failures could leak a partially constructed perl scalar (reported by Peter Juhasz).
  • tag decoding ("(tag)value") ignored the recursion limit, potentially causing stack overflow (reported by Peter Juhasz).

Documentation

json_xs
JSON::XS commandline utility

Modules

JSON::XS
JSON serialising/deserialising, done correctly and fast
JSON::XS::Boolean
dummy module providing JSON::XS::Boolean

Examples

Other files