Avoid JSON separator recursion for CWE-674

AArnott · AArnott · commit 66ad0894bcbd · 2026-05-15T10:07:03.000-06:00
TinyJsonReader previously skipped JSON separators with a recursive ReadNextToken call, so a long separator sequence supplied to ConvertFromJson could consume one stack frame per separator and terminate the process. Change separator skipping to stay within the tokenizer loop instead, preserving the existing tokenization behavior without stack growth.

Add regression coverage that converts a long separator-prefixed JSON value successfully.
diff --git a/src/MessagePack/Internal/TinyJsonReader.cs b/src/MessagePack/Internal/TinyJsonReader.cs
@@ -137,62 +137,64 @@ private static bool IsWordBreak(char c)
 
         private void ReadNextToken()
         {
-            this.SkipWhiteSpace();
-
-            var intChar = this.reader.Peek();
-            if (intChar == -1)
+            while (true)
             {
-                this.TokenType = TinyJsonToken.None;
-                return;
-            }
+                this.SkipWhiteSpace();
 
-            var c = (char)intChar;
-            switch (c)
-            {
-                case '{':
-                    this.TokenType = TinyJsonToken.StartObject;
-                    return;
-                case '}':
-                    this.TokenType = TinyJsonToken.EndObject;
-                    return;
-                case '[':
-                    this.TokenType = TinyJsonToken.StartArray;
-                    return;
-                case ']':
-                    this.TokenType = TinyJsonToken.EndArray;
-                    return;
-                case '"':
-                    this.TokenType = TinyJsonToken.String;
-                    return;
-                case '0':
-                case '1':
-                case '2':
-                case '3':
-                case '4':
-                case '5':
-                case '6':
-                case '7':
-                case '8':
-                case '9':
-                case '-':
-                    this.TokenType = TinyJsonToken.Number;
-                    return;
-                case 't':
-                    this.TokenType = TinyJsonToken.True;
-                    return;
-                case 'f':
-                    this.TokenType = TinyJsonToken.False;
-                    return;
-                case 'n':
-                    this.TokenType = TinyJsonToken.Null;
-                    return;
-                case ',':
-                case ':':
-                    this.reader.Read();
-                    this.ReadNextToken();
+                var intChar = this.reader.Peek();
+                if (intChar == -1)
+                {
+                    this.TokenType = TinyJsonToken.None;
                     return;
-                default:
-                    throw new TinyJsonException("Invalid String:" + c);
+                }
+
+                var c = (char)intChar;
+                switch (c)
+                {
+                    case '{':
+                        this.TokenType = TinyJsonToken.StartObject;
+                        return;
+                    case '}':
+                        this.TokenType = TinyJsonToken.EndObject;
+                        return;
+                    case '[':
+                        this.TokenType = TinyJsonToken.StartArray;
+                        return;
+                    case ']':
+                        this.TokenType = TinyJsonToken.EndArray;
+                        return;
+                    case '"':
+                        this.TokenType = TinyJsonToken.String;
+                        return;
+                    case '0':
+                    case '1':
+                    case '2':
+                    case '3':
+                    case '4':
+                    case '5':
+                    case '6':
+                    case '7':
+                    case '8':
+                    case '9':
+                    case '-':
+                        this.TokenType = TinyJsonToken.Number;
+                        return;
+                    case 't':
+                        this.TokenType = TinyJsonToken.True;
+                        return;
+                    case 'f':
+                        this.TokenType = TinyJsonToken.False;
+                        return;
+                    case 'n':
+                        this.TokenType = TinyJsonToken.Null;
+                        return;
+                    case ',':
+                    case ':':
+                        this.reader.Read();
+                        continue;
+                    default:
+                        throw new TinyJsonException("Invalid String:" + c);
+                }
             }
         }
 
diff --git a/tests/MessagePack.Tests/ToJsonTest.cs b/tests/MessagePack.Tests/ToJsonTest.cs
@@ -47,6 +47,16 @@ public void ComplexToJson()
             this.JsonConvert(json, LZ4Standard).Is(json);
         }
 
+        [Fact]
+        [Trait("CWE", "674")]
+        public void ConvertFromJsonSkipsLongSeparatorRunIteratively()
+        {
+            var json = new string(',', 200_000) + "null";
+            var msgpack = MessagePackSerializer.ConvertFromJson(json);
+
+            MessagePackSerializer.ConvertToJson(msgpack).Is("null");
+        }
+
         [Fact]
         public void FloatJson()
         {
