btcjson: fix infinite recursion in StringOrArray.MarshalJSON
What the developer wrote
Authored by Eric Grill
btcjson: fix infinite recursion in StringOrArray.MarshalJSON
The MarshalJSON method was calling json.Marshal(h) where h is of type
StringOrArray. Since StringOrArray implements json.Marshaler, this
caused json.Marshal to call MarshalJSON again, resulting in infinite
recursion and a stack overflow.
Fix by converting to the underlying []string type before marshaling,
which breaks the interface lookup cycle.
Closes #2369
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
What changed, and why it matters
This commit fixes a bug where a piece of code responsible for turning a list of text strings into JSON format accidentally called itself forever, eventually crashing the program with a stack overflow. The fix changes the code to convert the custom type to a plain list of strings before handing it to the JSON encoder, breaking the endless loop.
Upgrade to a btcd version containing this commit. If running an affected version, avoid serializing StringOrArray values from untrusted RPC paths until patched, and monitor for stack-overflow crashes.
Security signals we found
Stack overflow / infinite recursion in JSON marshaler
Custom json.Marshaler interface dispatch cycle
Denial-of-service vector via crafted or normal serialization path
Evidence from the diff
The MarshalJSON method on the btcjson.StringOrArray type previously called json.Marshal(h) on a value of its own type. Because StringOrArray implements json.Marshaler, json.Marshal dispatched back to MarshalJSON, creating unbounded recursion and a stack overflow. The patch converts h to its underlying []string type before marshaling, which no longer implements json.Marshaler and therefore terminates normally.
Changed components
btcjson/chainsvrresults.gobtcjson.StringOrArrayMarshalJSON methodInspect captured patch +3 / −1
diff --git a/btcjson/chainsvrresults.go b/btcjson/chainsvrresults.go
index b4e4f66..b511d3c 100644
--- a/btcjson/chainsvrresults.go
+++ b/btcjson/chainsvrresults.go
@@ -371,7 +371,9 @@ type StringOrArray []string
// MarshalJSON implements the json.Marshaler interface.
func (h StringOrArray) MarshalJSON() ([]byte, error) {
- return json.Marshal(h)
+ // Convert to []string to avoid infinite recursion since calling
+ // json.Marshal on StringOrArray would invoke MarshalJSON again.
+ return json.Marshal([]string(h))
}
// UnmarshalJSON implements the json.Unmarshaler interface.
Why this scored 39/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.