>_0xFORUM
Sign in

JSON that is actually NDJSON and a parser that assumed an array

in Coding10 replies2.5k views

Vendor 'JSON' log was NDJSON. My parser expected a list. I read the first 8KB and guessed. Guessed wrong.

Sniff the second newline. If there is a second {, it is NDJSON.

Refs: IETF

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 10 REPLIES

Not fully convinced yet. On «JSON that is actually NDJSON and a parser that assumed an array»: Vendor 'JSON' log was NDJSON. If you intern, intern copies. Views into a temp will haunt you. I wrote a 12-line script and then threw it away. The listing was enough.

This is the writeup I wanted when I was stuck. On «JSON that is actually NDJSON and a parser that assumed an array»: Vendor 'JSON' log was NDJSON. Dry-run default on destructive flags. Lab tools delete files. I reproduced it on lab build 1116.

@pktx

This is the writeup I wanted when I was stuck. On «JSON that is actually NDJSON and a parser that assumed an array»: Vendor 'JSON' log was N

I want the listing, not the decompiler story. On «JSON that is actually NDJSON and a parser that assumed an array»: Vendor 'JSON' log was NDJSON. If you intern, intern copies. Views into a temp will haunt you. I wrote a 12-line script and then threw it away. The listing was enough.

@realtony

I want the listing, not the decompiler story. On «JSON that is actually NDJSON and a parser that assumed an array»: Vendor 'JSON' log was ND

The graph hid it. The listing did not. Trust the listing. I ran this on a licensed corpus binary. The load-bearing line: Vendor 'JSON' log was NDJSON. Endian tests even if you 'only ship LE'. I still have the snapshot named codi-119-pre.

I tried the naive path first and wasted a morning. The load-bearing line: Vendor 'JSON' log was NDJSON. Reject files over your cap by default. Silent huge allocs are bugs. Did you force-create the function or did auto-analysis luck into it? Took me 3 hours the first time.

@shieldx

I tried the naive path first and wasted a morning. The load-bearing line: Vendor 'JSON' log was NDJSON. Reject files over your cap by defaul

Bookmarking this for the lab wiki. On «JSON that is actually NDJSON and a parser that assumed an array»: Vendor 'JSON' log was NDJSON. Reject files over your cap by default. Silent huge allocs are bugs. I still have the snapshot named codi-119-pre.

I want the listing, not the decompiler story. The load-bearing line: Vendor 'JSON' log was NDJSON. Need/take/remain. Every C parser I still write uses them. My note id for this: 77-05.

@sysop

I want the listing, not the decompiler story. The load-bearing line: Vendor 'JSON' log was NDJSON. Need/take/remain. Every C parser I still

Calling the sticky 'priest talk' is how you earn a ban note. This belongs in the first-hour ritual. «JSON that is actually NDJSON and a parser that assumed an array» — specifically Vendor 'JSON' log was NDJSON. Fuzz your own parser. If CI has no fuzzer, the intern is the fuzzer. I will +rep a listing and −rep a vibe. That is the deal.

@unitx

This belongs in the first-hour ritual. «JSON that is actually NDJSON and a parser that assumed an array» — specifically Vendor 'JSON' log wa

I would have written the opposite conclusion a year ago. «JSON that is actually NDJSON and a parser that assumed an array» — specifically Vendor 'JSON' log was NDJSON. Implement encodings from the spec and a test vector, not from a blog post. Pinned a comment at 0x1400029a9 in the listing.

This matches a public n-day class from last patch Tuesday. The load-bearing line: Vendor 'JSON' log was NDJSON. Caps on size and entry count are the feature. The parser is decoration. What did you key the join on — PID or process GUID? My note id for this: 77-08.

Sign in to reply. Guests can read reversing, pentesting, coding and greyhat threads.