# HG changeset patch # User Christian Brabandt # Date 1520943306 -3600 # Node ID 7495e3ee1a69383e4aecbb86796bba28d2b21e57 # Parent 2c2be346753ff0aa8ca805a2a1bb49afbe7f0df9 patch 8.0.1602: crash in parsing JSON commit https://github.com/vim/vim/commit/625f0c1eb75da08229843fa393b1ee4e6547d285 Author: Bram Moolenaar Date: Tue Mar 13 13:10:41 2018 +0100 patch 8.0.1602: crash in parsing JSON Problem: Crash in parsing JSON. Solution: Fail when using array or dict as dict key. (Damien) diff --git a/src/json.c b/src/json.c --- a/src/json.c +++ b/src/json.c @@ -621,7 +621,9 @@ json_decode_item(js_read_T *reader, typv if (top_item != NULL && top_item->jd_type == JSON_OBJECT_KEY && (options & JSON_JS) && reader->js_buf[reader->js_used] != '"' - && reader->js_buf[reader->js_used] != '\'') + && reader->js_buf[reader->js_used] != '\'' + && reader->js_buf[reader->js_used] != '[' + && reader->js_buf[reader->js_used] != '{') { char_u *key; @@ -642,6 +644,11 @@ json_decode_item(js_read_T *reader, typv switch (*p) { case '[': /* start of array */ + if (top_item && top_item->jd_type == JSON_OBJECT_KEY) + { + retval = FAIL; + break; + } if (ga_grow(&stack, 1) == FAIL) { retval = FAIL; @@ -668,6 +675,11 @@ json_decode_item(js_read_T *reader, typv continue; case '{': /* start of object */ + if (top_item && top_item->jd_type == JSON_OBJECT_KEY) + { + retval = FAIL; + break; + } if (ga_grow(&stack, 1) == FAIL) { retval = FAIL; diff --git a/src/testdir/test_json.vim b/src/testdir/test_json.vim --- a/src/testdir/test_json.vim +++ b/src/testdir/test_json.vim @@ -179,6 +179,9 @@ func Test_json_decode() call assert_fails('call json_decode("[1 2]")', "E474:") call assert_fails('call json_decode("[1,,2]")', "E474:") + + call assert_fails('call json_decode("{{}:42}")', "E474:") + call assert_fails('call json_decode("{[]:42}")', "E474:") endfunc let s:jsl5 = '[7,,,]' diff --git a/src/version.c b/src/version.c --- a/src/version.c +++ b/src/version.c @@ -767,6 +767,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 1602, +/**/ 1601, /**/ 1600,