Proof Portal

Projects

jsonparser

ProbeLabs23 findings · 123 requirements

The fastest JSON parser for Go — formally verified with ReqProof (real library, master).

Back to findings
Problem reportDEFECT-260727-ARR1

ArrayEach on non-array root emitted spurious callback before erroring

FixedFixedMedium

This defect has been fixed and verified.

Closure: Requirement re-verified
Verified by 1 regression test

Introduced

When and where this issue first entered the codebase — the commit it traces back to, and the audit run that first flagged it.

Inception (latent from the first version)
Origin
Audit Finding

Change history

Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.

Every recorded revision of this object's source — newest first, each with the commit message and its file-level diff.

Severity, explained

Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).

MediumRated severity — the impact if this issue is exploited or hit.
risk area
Error Handling

Root cause

What actually went wrong underneath — how it is classified, and the coverage gap that let it slip through.

parser.go:ArrayEach lacked a root-token-type guard in the no-keys path. The main loop unconditionally parsed the first token after the assumed `[` as an array element; for object/number input, this misinterpreted the first content byte as an element and invoked the callback with bogus data before the structural-malformed check triggered.

Why this escaped
Missing test partition

Disposition: Covered by a requirement

Proof it's fixed

The tests, tightened requirements and new obligations that prove this defect is gone — and can't quietly return.

Covered by a requirement.

verified by
regression tests
strengthened requirements

Blast radius

If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them.

Nothing to trace into

This finding links no requirements, so there is no dependency graph to follow. Everything we know about it is in the evidence above.

Discussions

Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.

Sign in to discuss this with the proof team.Sign in