[31593] in CVS-changelog-for-Kerberos-V5
krb5 commit: Correctly abort parse on invalid JSON array
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Fri Oct 30 17:36:43 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261030213624.C606510580A@krbdev.mit.edu>
Date: Fri, 30 Oct 2026 17:36:24 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/27fccac69d0e81f7441e01f3d6446541b26a622a
commit 27fccac69d0e81f7441e01f3d6446541b26a622a
Author: Andrew Donnellan <andrew@donnellan.id.au>
Date: Wed Oct 7 16:59:23 2026 +1100
Correctly abort parse on invalid JSON array
In parse_value(), don't ignore the error result from parse_array().
(This bug was found as part of an LLM-assisted automated testing and
fuzzing project, using Claude Opus 5.5, Claude Haiku 5.5 and GPT-5.6 Sol
Daybreak Blue.)
[ghudson@mit.edu: shortened commit message]
ticket: 9253 (new)
tags: pullup
target_version: 1.22-next
src/util/support/json.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/util/support/json.c b/src/util/support/json.c
index ac2e5be0b..efd6a2d13 100644
--- a/src/util/support/json.c
+++ b/src/util/support/json.c
@@ -1036,6 +1036,8 @@ parse_value(struct decode_ctx *ctx, k5_json_value *val_out)
if (ctx->depth-- == 1)
return EINVAL;
ret = parse_array(ctx, &array);
+ if (ret)
+ return ret;
ctx->depth++;
*val_out = array;
} else if (is_digit(*ctx->p) || *ctx->p == '-') {
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
