# Integer overflow in _json_encode_unicode leads to crash

Integer overflow in CPython's _json escape_unicode output-size calculation causes heap buffer overflow and crash when encoding large strings of control characters.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: nilch
- Disclosed: 2015-06-27
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/73260
- Library page: https://bugbountylibrary.com/r/h1%3A73260
- Tags: area:oss domain:oss kind:bounty platform:hackerone sev:medium tech:python technique:source-review vuln:dos vuln:memory-corruption

**Target:** CPython Modules/_json.c escape_unicode
**Root cause:** output_size is accumulated as Py_ssize_t without overflow checks; a string of many <=0x1f control chars each adding 6 overflows the size, so PyUnicode_New allocates a too-small buffer that ENCODE_OUTPUT then overflows.
**Steps:**
1. Build CPython 3.6.0a0 (32-bit) with ASAN
2. Run `import json; sp = "\x13"*715827883; json.dumps([sp], ensure_ascii=False)`
3. Observe heap-buffer-overflow WRITE of size 1 in escape_unicode at _json.c:306
**How found:** Code review of escape_unicode: noticed output_size += 6 for control chars with no overflow check, then computed a string length that overflows the size calculation.
**Insight:** In C extension encoders, size-precomputation loops that multiply per-char expansion factors are prime integer-overflow targets; pick char counts near 2^32/expansion to wrap the allocation size.