krb5 commit: Correctly abort parse on invalid JSON array

ghudson at mit.edu ghudson at mit.edu
Fri Oct 30 17:36:24 EDT 2026


https://github.com/krb5/krb5/commit/27fccac69d0e81f7441e01f3d6446541b26a622a
commit 27fccac69d0e81f7441e01f3d6446541b26a622a
Author: Andrew Donnellan <andrew at donnellan.id.au>
Date:   Wed Oct 7 16:59:23 2026 +1100

    Correctly abort parse on invalid JSON array
    
    In parse_value(), don't ignore the error result from parse_array().
    
    (This bug was found as part of an LLM-assisted automated testing and
    fuzzing project, using Claude Opus 5.5, Claude Haiku 5.5 and GPT-5.6 Sol
    Daybreak Blue.)
    
    [ghudson at mit.edu: shortened commit message]
    
    ticket: 9253 (new)
    tags: pullup
    target_version: 1.22-next

 src/util/support/json.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/util/support/json.c b/src/util/support/json.c
index ac2e5be0b..efd6a2d13 100644
--- a/src/util/support/json.c
+++ b/src/util/support/json.c
@@ -1036,6 +1036,8 @@ parse_value(struct decode_ctx *ctx, k5_json_value *val_out)
         if (ctx->depth-- == 1)
             return EINVAL;
         ret = parse_array(ctx, &array);
+        if (ret)
+            return ret;
         ctx->depth++;
         *val_out = array;
     } else if (is_digit(*ctx->p) || *ctx->p == '-') {


More information about the cvs-krb5 mailing list