From: Dmitry Plotnikov <d.plotnikov@f5.com>
Date: Tue, 18 Aug 2026 01:40:08 +0000 (+0000)
Subject: JSON: fixed overflow detection in length calculation
X-Git-Tag: release-1.31.5~5
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=032e181dad305e5f3d2cc6636069cb117a1c25ec;p=nginx.git

JSON: fixed overflow detection in length calculation
---

diff --git a/src/core/ngx_json.c b/src/core/ngx_json.c
index f826d4312..f99378fc5 100644
--- a/src/core/ngx_json.c
+++ b/src/core/ngx_json.c
@@ -96,10 +96,21 @@ ngx_json_obj_length(ngx_data_item_t *item)
 
     if (i) {
         for ( ;; ) {
-            len = sizeof("\"\":") - 1 + i->name.len
-                  + ngx_escape_json(NULL, i->name.data, i->name.len);
+            if (i->name.len > NGX_MAX_SIZE_T_VALUE - (sizeof("\"\":") - 1)) {
+                return NGX_ERROR;
+            }
 
-            if (total > NGX_MAX_SIZE_T_VALUE - len) {
+            len = sizeof("\"\":") - 1 + i->name.len;
+
+            if (len > NGX_MAX_SIZE_T_VALUE - total) {
+                return NGX_ERROR;
+            }
+
+            total += len;
+
+            len = ngx_escape_json(NULL, i->name.data, i->name.len);
+
+            if (len > NGX_MAX_SIZE_T_VALUE - total) {
                 return NGX_ERROR;
             }
 
@@ -110,7 +121,7 @@ ngx_json_obj_length(ngx_data_item_t *item)
                 return NGX_ERROR;
             }
 
-            if (total > NGX_MAX_SIZE_T_VALUE - len) {
+            if (len > NGX_MAX_SIZE_T_VALUE - total) {
                 return NGX_ERROR;
             }
 
@@ -190,7 +201,7 @@ ngx_json_list_length(ngx_data_item_t *item)
                 return NGX_ERROR;
             }
 
-            if (total > NGX_MAX_SIZE_T_VALUE - len) {
+            if (len > NGX_MAX_SIZE_T_VALUE - total) {
                 return NGX_ERROR;
             }
 
@@ -248,12 +259,24 @@ ngx_json_list_encode(u_char *p, ngx_data_item_t *item)
 static ssize_t
 ngx_json_string_length(ngx_data_item_t *item)
 {
+    size_t      len, total;
     ngx_str_t  *str;
 
     str = &item->data.string;
 
-    return sizeof("\"\"") - 1 + str->len
-           + ngx_escape_json(NULL, str->data, str->len);
+    if (str->len > NGX_MAX_SIZE_T_VALUE - (sizeof("\"\"") - 1)) {
+        return NGX_ERROR;
+    }
+
+    total = sizeof("\"\"") - 1 + str->len;
+
+    len = ngx_escape_json(NULL, str->data, str->len);
+
+    if (len > NGX_MAX_SIZE_T_VALUE - total) {
+        return NGX_ERROR;
+    }
+
+    return total + len;
 }