#1063: bound BigDecimal->BigInteger expansion in objectToBigInteger

mechko · claude · mechko · commit fce83c91bb22 · 2026-07-14T11:59:27.000+02:00
Completes the CVE-2026-59171 fix started in ab92bb9 / #1065. The 1000-char length guard in stringToValue admits short exponent-notation literals (e.g. 1e100000000, 11 chars) which are stored compactly as BigDecimal and only expand when getBigInteger/optBigInteger calls BigDecimal.toBigInteger(), materialising ~10^8 digits and stalling the thread or throwing OOM. Guard both toBigInteger() sites in objectToBigInteger by rejecting any BigDecimal whose integer part would exceed ParserConfiguration.DEFAULT_MAX_NUMBER_LENGTH decimal digits (precision() - scale(), both O(1) reads). Returns defaultValue on overflow, matching the method's existing behaviour for non-finite and unparseable values. Covers JSONObject.getBigInteger/optBigInteger and JSONArray.getBigInteger/optBigInteger (all delegate to this helper). Adds JSONObjectTest.getBigIntegerHugeExponentReturnsDefault with a 5s timeout so a regression fails fast rather than hanging CI. Co-Authored-By: Claude <noreply@anthropic.com>
diff --git a/src/main/java/org/json/JSONObject.java b/src/main/java/org/json/JSONObject.java
@@ -1399,7 +1399,15 @@ static BigInteger objectToBigInteger(Object val, BigInteger defaultValue) {
             return (BigInteger) val;
         }
         if (val instanceof BigDecimal){
-            return ((BigDecimal) val).toBigInteger();
+            BigDecimal bd = (BigDecimal) val;
+            // Same ceiling as the parse-time maxNumberLength guard: refuse to
+            // materialise an integer whose decimal representation would exceed
+            // DEFAULT_MAX_NUMBER_LENGTH digits. Prevents DoS via short exponent
+            // literals like 1e100000000 (CVE-2026-59171, see issue #1063).
+            if ((long) bd.precision() - bd.scale() > ParserConfiguration.DEFAULT_MAX_NUMBER_LENGTH) {
+                return defaultValue;
+            }
+            return bd.toBigInteger();
         }
         if (val instanceof Double || val instanceof Float){
             if (!numberIsFinite((Number)val)) {
@@ -1422,7 +1430,11 @@ static BigInteger objectToBigInteger(Object val, BigInteger defaultValue) {
              */
             final String valStr = val.toString();
             if(isDecimalNotation(valStr)) {
-                return new BigDecimal(valStr).toBigInteger();
+                BigDecimal bd = new BigDecimal(valStr);
+                if ((long) bd.precision() - bd.scale() > ParserConfiguration.DEFAULT_MAX_NUMBER_LENGTH) {
+                    return defaultValue;
+                }
+                return bd.toBigInteger();
             }
             return new BigInteger(valStr);
         } catch (Exception e) {
diff --git a/src/test/java/org/json/junit/JSONObjectTest.java b/src/test/java/org/json/junit/JSONObjectTest.java
@@ -1367,6 +1367,43 @@ public void bigNumberOperations() {
 		Util.checkJSONArrayMaps(jsonArray1, jsonObject0.getMapType());
 	}
 
+	/**
+	 * Verifies that getBigInteger / optBigInteger do not attempt to materialise a
+	 * BigInteger whose decimal representation would exceed
+	 * ParserConfiguration.DEFAULT_MAX_NUMBER_LENGTH digits. A short exponent-notation
+	 * literal such as 1e100000000 is stored compactly as a BigDecimal at parse time
+	 * but would otherwise expand to ~100 000 000 digits in BigDecimal.toBigInteger(),
+	 * stalling the thread / OOM (CVE-2026-59171, issue #1063).
+	 */
+	@Test(timeout = 5000)
+	public void getBigIntegerHugeExponentReturnsDefault() {
+		// BigDecimal path: value arrives via the parser as a BigDecimal
+		JSONObject jo = new JSONObject("{\"x\":1e100000000}");
+		assertTrue("huge-exponent literal parses to BigDecimal", jo.get("x") instanceof BigDecimal);
+		assertNull("optBigInteger returns default for huge exponent", jo.optBigInteger("x", null));
+		try {
+			jo.getBigInteger("x");
+			fail("getBigInteger should throw for huge exponent");
+		} catch (JSONException expected) {
+		}
+
+		// String path: value put() as a String, exercised via objectToBigInteger's
+		// isDecimalNotation branch
+		JSONObject jo2 = new JSONObject();
+		jo2.put("x", "1e100000000");
+		assertNull("optBigInteger returns default for huge-exponent string", jo2.optBigInteger("x", null));
+
+		// JSONArray accessors delegate to the same helper
+		JSONArray ja = new JSONArray("[1e100000000]");
+		assertTrue("optBigInteger returns default for huge exponent (array)",
+				BigInteger.ONE.equals(ja.optBigInteger(0, BigInteger.ONE)));
+
+		// Boundary: a value at the limit still converts correctly
+		JSONObject jo3 = new JSONObject("{\"x\":1e999}");
+		assertEquals("1e999 still converts", 0,
+				jo3.getBigInteger("x").compareTo(BigInteger.TEN.pow(999)));
+	}
+
 	/**
 	 * The purpose for the static method getNames() methods are not clear. This
 	 * method is not called from within JSON-Java. Most likely uses are to prep
