Merge pull request #4046 from icsharpcode/fix/lightjson-parser-depth-limit

Cap LightJson parser nesting depth to prevent stack overflow

ICSharpCode.Decompiler.Tests/LightJsonParserTests.cs

@@ -0,0 +1,71 @@
+// Copyright (c) 2026 Christoph Wille
+// 
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this
+// software and associated documentation files (the "Software"), to deal in the Software
+// without restriction, including without limitation the rights to use, copy, modify, merge,
+// publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons
+// to whom the Software is furnished to do so, subject to the following conditions:
+// 
+// The above copyright notice and this permission notice shall be included in all copies or
+// substantial portions of the Software.
+// 
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+// PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
+// FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+// DEALINGS IN THE SOFTWARE.
+
+using System.Text;
+
+using LightJson.Serialization;
+
+using NUnit.Framework;
+
+namespace ICSharpCode.Decompiler.Tests
+{
+	[TestFixture]
+	public class LightJsonParserTests
+	{
+		[Test]
+		public void DeeplyNestedArrays_ThrowCatchableException_InsteadOfOverflowingTheStack()
+		{
+			// A crafted .deps.json (see DotNetCorePathFinder) nested far beyond any real
+			// dependency graph must fail with a catchable parse exception, not an
+			// uncatchable StackOverflowException that terminates the process.
+			const int depth = 500;
+			var json = new string('[', depth) + new string(']', depth);
+
+			Assert.Throws<JsonParseException>(() => JsonReader.Parse(json));
+		}
+
+		[Test]
+		public void DeeplyNestedObjects_ThrowCatchableException_InsteadOfOverflowingTheStack()
+		{
+			const int depth = 500;
+			var builder = new StringBuilder();
+			for (int i = 0; i < depth; i++)
+				builder.Append("{\"a\":");
+			builder.Append("1");
+			builder.Append('}', depth);
+
+			Assert.Throws<JsonParseException>(() => JsonReader.Parse(builder.ToString()));
+		}
+
+		[Test]
+		public void ModeratelyNestedJson_ParsesSuccessfully()
+		{
+			// Depth well within the limit must still round-trip; the guard must not
+			// reject legitimately structured documents.
+			const int depth = 32;
+			var json = new string('[', depth) + "42" + new string(']', depth);
+
+			var value = JsonReader.Parse(json);
+
+			var current = value;
+			for (int i = 0; i < depth; i++)
+				current = current[0];
+			Assert.That((int)current, Is.EqualTo(42));
+		}
+	}
+}

ICSharpCode.Decompiler/Metadata/LightJson/Serialization/JsonParseException.cs

@@ -68,6 +68,11 @@ namespace LightJson.Serialization
 			/// Indicates that the parser encountered and invalid or unexpected character.
 			/// </summary>
 			InvalidOrUnexpectedCharacter,
+
+			/// <summary>
+			/// Indicates that the input nested arrays/objects deeper than the parser allows.
+			/// </summary>
+			MaximumNestingDepthExceeded,
 		}
 
 		/// <summary>
@@ -95,6 +100,9 @@ namespace LightJson.Serialization
 				case ErrorType.DuplicateObjectKeys:
 					return "The parser encountered a JsonObject with duplicate keys.";
 
+				case ErrorType.MaximumNestingDepthExceeded:
+					return "The parser exceeded the maximum allowed nesting depth.";
+
 				default:
 					return "An error occurred while parsing the JSON message.";
 			}

ICSharpCode.Decompiler/Metadata/LightJson/Serialization/JsonReader.cs

@@ -17,6 +17,15 @@ namespace LightJson.Serialization
 	{
 		private TextScanner scanner;
 
+		/// <summary>
+		/// The deepest array/object nesting the parser will descend into before failing.
+		/// Guards against uncontrolled recursion (CWE-674): without it, deeply nested input
+		/// such as a crafted .deps.json overflows the stack with an uncatchable
+		/// StackOverflowException. 64 matches the ecosystem default (System.Text.Json) and is
+		/// far beyond any real dependency manifest.
+		/// </summary>
+		private const int MaxNestingDepth = 64;
+
 		private JsonReader(TextReader reader)
 		{
 			this.scanner = new TextScanner(reader);
@@ -60,8 +69,15 @@ namespace LightJson.Serialization
 			return this.ReadString();
 		}
 
-		private JsonValue ReadJsonValue()
+		private JsonValue ReadJsonValue(int depth)
 		{
+			if (depth > MaxNestingDepth)
+			{
+				throw new JsonParseException(
+					ErrorType.MaximumNestingDepthExceeded,
+					this.scanner.Position);
+			}
+
 			this.scanner.SkipWhitespace();
 
 			var next = this.scanner.Peek();
@@ -74,10 +90,10 @@ namespace LightJson.Serialization
 			switch (next)
 			{
 				case '{':
-					return this.ReadObject();
+					return this.ReadObject(depth);
 
 				case '[':
-					return this.ReadArray();
+					return this.ReadArray(depth);
 
 				case '"':
 					return this.ReadString();
@@ -320,12 +336,12 @@ namespace LightJson.Serialization
 			return (char)value;
 		}
 
-		private JsonObject ReadObject()
+		private JsonObject ReadObject(int depth)
 		{
-			return this.ReadObject(new JsonObject());
+			return this.ReadObject(new JsonObject(), depth);
 		}
 
-		private JsonObject ReadObject(JsonObject jsonObject)
+		private JsonObject ReadObject(JsonObject jsonObject, int depth)
 		{
 			this.scanner.Assert('{');
 
@@ -357,7 +373,7 @@ namespace LightJson.Serialization
 
 					this.scanner.SkipWhitespace();
 
-					var value = this.ReadJsonValue();
+					var value = this.ReadJsonValue(depth + 1);
 
 					jsonObject.Add(key, value);
 
@@ -395,12 +411,12 @@ namespace LightJson.Serialization
 			return jsonObject;
 		}
 
-		private JsonArray ReadArray()
+		private JsonArray ReadArray(int depth)
 		{
-			return this.ReadArray(new JsonArray());
+			return this.ReadArray(new JsonArray(), depth);
 		}
 
-		private JsonArray ReadArray(JsonArray jsonArray)
+		private JsonArray ReadArray(JsonArray jsonArray, int depth)
 		{
 			this.scanner.Assert('[');
 
@@ -416,7 +432,7 @@ namespace LightJson.Serialization
 				{
 					this.scanner.SkipWhitespace();
 
-					var value = this.ReadJsonValue();
+					var value = this.ReadJsonValue(depth + 1);
 
 					jsonArray.Add(value);
 
@@ -457,7 +473,7 @@ namespace LightJson.Serialization
 		private JsonValue Parse()
 		{
 			this.scanner.SkipWhitespace();
-			return this.ReadJsonValue();
+			return this.ReadJsonValue(0);
 		}
 	}
 }