JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse.
The parser appends each chunk to its buffer and compares max_size with how far it has progressed, not with the buffer length. It treats a NUL byte as the end of the input, so a NUL within the first max_size bytes keeps it short of the limit. The buffer keeps growing, and incr_skip cannot remove the NUL.
A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.
Bu kayıt NIST NVD kaynağından aktarılmıştır. Etkilenen sürümler, güncel değerlendirme ve üretici referansları için kaynak kaydı inceleyin.