Skip to content

Bound cJSON_Compare cost: sort-based objects, depth cap (CVE-2026-67216) - #1116

Open
w4ffl35 wants to merge 1 commit into
DaveGamble:masterfrom
w4ffl35:fix/compare-complexity-budget
Open

w4ffl35 wants to merge 1 commit into
DaveGamble:masterfrom
w4ffl35:fix/compare-complexity-budget

Conversation

@w4ffl35

@w4ffl35 w4ffl35 commented Oct 26, 2026

Copy link
Copy Markdown

Object comparison scanned the other member list per member, twice, so cost grew exponentially with nesting depth (measured ~148x for two added levels at width 6: depth-4 0.004s vs depth-6 0.593s); recursion was also unbounded.

This compares objects by sorting member-pointer copies once and comparing pairwise -- O(n log n) per level, caller's trees untouched (no reordering, unlike compare_json's in-place sort) -- and fails safe past CJSON_NESTING_LIMIT in cJSON_Compare and the TEST-operation compare_json. One sorted pass also replaces the old compare-twice subset check.

Evidence:

  • depth-6 identical docs still compare true in 0.016s (was 0.593s); 336k-node identical docs still true (no false negatives); 5k-deep nesting returns false instantly; ordinary equal/different cases unchanged. Full ctest suite passes (19/19), including the pre-existing compare_tests.
  • Adds cjson_compare_should_compare_nested_objects and cjson_compare_should_fail_safe_past_nesting_limit to tests/compare_tests.c.

Related: open PR #1078 guards recursion depth in the same functions; this additionally fixes the complexity class rather than only capping depth. Happy to rebase onto #1078 if it lands first.

Object comparison scanned the other member list per member, twice,
so cost grew exponentially with nesting depth; recursion was also
unbounded. Compare objects by sorting member-pointer copies once and
comparing pairwise (O(n log n) per level, caller's trees untouched),
and fail safe past CJSON_NESTING_LIMIT in cJSON_Compare and the
TEST-operation compare_json (which additionally no longer reorders
the compared trees). Add regression tests for nested/order-insensitive
equality and over-limit fail-safe.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant