Stack Overflow in JSON RPC Server

How it was found

Summary:

There is a stack overflow bug in json_parser when parsing nesting objects.

Description: Monero's json parser (handled by epee libraries) doesn't check object tree depth while parsing

Steps To Reproduce:

Up the service

> monerod

run

> python2 poc.py

backtrace

SUMMARY: AddressSanitizer: stack-overflow /home/bug/monero/contrib/epee/include/storages/portable_storage_from_json.h:47 in void epee::serialization::json::run_handler<epee::serialization::portable_storage>(epee::serialization::portable_storage::hsection, __gnu_cxx::__normal_iterator<char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >&, __gnu_cxx::__normal_iterator<char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, epee::serialization::portable_storage&)
Thread T6 created by T0 here:
    #0 0x7fe374230a51 in __interceptor_pthread_create /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cc:202
    #1 0x7fe371b463db in boost::thread::start_thread_noexcept(boost::thread_attributes const&) (/usr/lib/libboost_thread.so.1.67.0+0x133db)

==4088==ABORTING

Tested on

> monerod --version
Monero 'Lithium Luna' (v0.12.3.0-master-0dddfeac)

Supporting Material/References:

poc.py > Malicious json rpc request

Impact

Attacker could run arbitrary code