webmcp
view libraries/json/json.c @ 152:7b5c13fdc2ec
Reject arrays that exceed INT_MAX elements in JSON library
| author | jbe | 
|---|---|
| date | Thu Jul 31 01:02:46 2014 +0200 (2014-07-31) | 
| parents | 6d2bb696f736 | 
| children | c8c91216255f | 
 line source
     1 #include <lua.h>
     2 #include <lauxlib.h>
     3 #include <stdlib.h>
     4 #include <string.h>
     6 // maximum number of nested JSON values (objects and arrays):
     7 // NOTE: The Lua reference states that the stack may typically contain at least
     8 //       "a few thousand elements". Since every nested level consumes
     9 //       3 elements on the Lua stack (the object/array, its shadow table,
    10 //       a string key or a placeholder), we limit the number of nested levels
    11 //       to 500. If a stack overflow would still happen in the import function,
    12 //       this is detected nevertheless and an error is thrown (instead of
    13 //       returning nil and an error string).
    14 #define JSON_MAXDEPTH 500
    16 // macros for usage of Lua registry:
    17 #define JSON_REGENT char
    18 #define JSON_REGPOINTER void *
    19 #define json_pushlightref(L, x) lua_pushlightuserdata((L), &json_reference.x)
    20 #define json_regpointer(x) (&json_registry.x)
    21 #define json_regfetchpointer(L, x) lua_rawgetp((L), LUA_REGISTRYINDEX, (x))
    22 #define json_regfetch(L, x) json_regfetchpointer(L, json_regpointer(x))
    23 #define json_regstore(L, x) lua_rawsetp(L, LUA_REGISTRYINDEX, json_regpointer(x))
    25 // generate dummy memory addresses that represent non-modifiable lightuserdata (dummy) objects:
    26 static struct {
    27   JSON_REGENT nullmark;  // magic value to indicate JSON null value in shadow table
    28 } json_reference;
    31 // generate dummy memory addresses that represent Lua objects
    32 // via lightuserdata keys and LUA_REGISTRYINDEX:
    33 static struct {
    34   JSON_REGENT shadowtbl;  // ephemeron table that maps tables to their corresponding shadow table
    35   JSON_REGENT unknownmt;  // metatable for tables that may be either JSON objects or JSON arrays
    36   JSON_REGENT objectmt;   // metatable for JSON objects
    37   JSON_REGENT arraymt;    // metatable for JSON arrays
    38 } json_registry;
    40 // marks a Lua table as JSON object or JSON array:
    41 // (returns its modified argument or a new table if argument is nil)
    42 static int json_mark(lua_State *L, JSON_REGPOINTER mt) {
    43   // check if argument is nil
    44   if (lua_isnoneornil(L, 1)) {
    45     // create new table at stack position 1:
    46     lua_settop(L, 0);
    47     lua_newtable(L);
    48     // create shadow table (leaving previously created table on stack position 1):
    49     json_regfetch(L, shadowtbl);
    50     lua_pushvalue(L, 1);
    51     lua_newtable(L);
    52     lua_rawset(L, -3);
    53   } else {
    54     // push shadow table on top of stack:
    55     json_regfetch(L, shadowtbl);
    56     lua_pushvalue(L, 1);
    57     lua_rawget(L, -2);
    58     // if shadow table does not exist:
    59     if (lua_isnil(L, -1)) {
    60       // create shadow table and leave it on top of stack:
    61       lua_newtable(L);
    62       lua_pushvalue(L, 1);
    63       lua_pushvalue(L, -2);
    64       lua_rawset(L, -5);
    65     }
    66     // move elements from original table to shadow table (that's expected on top of stack):
    67     for(lua_pushnil(L); lua_next(L, 1); lua_pop(L, 1)) {
    68       lua_pushvalue(L, -2);
    69       lua_pushnil(L);
    70       lua_rawset(L, 1);
    71       lua_pushvalue(L, -2);
    72       lua_pushvalue(L, -2);
    73       lua_rawset(L, -5);
    74     }
    75   }
    76   // discard everything but table to return:
    77   lua_settop(L, 1);
    78   // set metatable:
    79   json_regfetchpointer(L, mt);
    80   lua_setmetatable(L, 1);
    81   // return table:
    82   return 1;
    83 }
    85 // marks a table as JSON object:
    86 // (returns its modified argument or a new table if argument is nil)
    87 static int json_object(lua_State *L) {
    88   return json_mark(L, json_regpointer(objectmt));
    89 }
    91 // marks a table as JSON array:
    92 // (returns its modified argument or a new table if argument is nil)
    93 static int json_array(lua_State *L) {
    94   return json_mark(L, json_regpointer(arraymt));
    95 }
    97 // internal states of JSON parser:
    98 #define JSON_STATE_VALUE 0
    99 #define JSON_STATE_OBJECT_KEY 1
   100 #define JSON_STATE_OBJECT_KEY_TERMINATOR 2
   101 #define JSON_STATE_OBJECT_VALUE 3
   102 #define JSON_STATE_OBJECT_SEPARATOR 4
   103 #define JSON_STATE_ARRAY_VALUE 5
   104 #define JSON_STATE_ARRAY_SEPARATOR 6
   105 #define JSON_STATE_END 7
   107 // special Lua stack indicies for json_import function:
   108 #define json_import_objectmt_idx 2
   109 #define json_import_arraymt_idx 3
   110 #define json_import_shadowtbl_idx 4
   111 #define json_import_nullmark_idx 5
   113 // decodes a JSON document:
   114 static int json_import(lua_State *L) {
   115   const char *str;   // string to parse
   116   size_t total;      // total length of string to parse
   117   size_t pos = 0;    // current position in string to parse
   118   size_t level = 0;  // nested levels of objects/arrays currently being processed
   119   int mode = JSON_STATE_VALUE;  // state of parser (i.e. "what's expected next?")
   120   char c;              // variable to store a single character to be processed
   121   luaL_Buffer luabuf;  // Lua buffer to decode JSON string values
   122   char *cbuf;          // C buffer to decode JSON string values
   123   size_t writepos;     // write position of decoded strings in C buffer
   124   size_t arraylen;     // variable to temporarily store the array length
   125   // stack shall contain one function argument:
   126   lua_settop(L, 1);
   127   // push objectmt onto stack position 2:
   128   json_regfetch(L, objectmt);
   129   // push arraymt onto stack position 3:
   130   json_regfetch(L, arraymt);
   131   // push shadowtbl onto stack position 4:
   132   json_regfetch(L, shadowtbl);
   133   // push nullmark onto stack position 5:
   134   json_pushlightref(L, nullmark);
   135   // require string as first argument:
   136   str = luaL_checklstring(L, 1, &total);
   137   // if string contains a NULL byte, this is a syntax error
   138   if (strlen(str) != total) goto json_import_syntax_error;
   139   // main loop of parser:
   140   json_import_loop:
   141   // skip whitespace and store next character in variable 'c':
   142   while (c = str[pos],
   143     c == ' ' ||
   144     c == '\f' ||
   145     c == '\n' ||
   146     c == '\r' ||
   147     c == '\t' ||
   148     c == '\v'
   149   ) pos++;
   150   // switch statement to handle certain (single) characters:
   151   switch (c) {
   152   // handle end of JSON document:
   153   case 0:
   154     // if end of JSON document was expected, then return top element of stack as result:
   155     if (mode == JSON_STATE_END) return 1;
   156     // otherwise, the JSON document was malformed:
   157     json_import_unexpected_eof:
   158     lua_pushnil(L);
   159     if (level == 0) lua_pushliteral(L, "Empty string");
   160     else lua_pushliteral(L, "Unexpected end of JSON document");
   161     return 2;
   162   // new JSON object:
   163   case '{':
   164     // if a JSON object is not expected here, then return an error:
   165     if (
   166       mode != JSON_STATE_VALUE &&
   167       mode != JSON_STATE_OBJECT_VALUE &&
   168       mode != JSON_STATE_ARRAY_VALUE
   169     ) goto json_import_syntax_error;
   170     // create JSON object on stack:
   171     lua_newtable(L);
   172     // set metatable of JSON object:
   173     lua_pushvalue(L, json_import_objectmt_idx);
   174     lua_setmetatable(L, -2);
   175     // create internal shadow table on stack:
   176     lua_newtable(L);
   177     // register internal shadow table:
   178     lua_pushvalue(L, -2);
   179     lua_pushvalue(L, -2);
   180     lua_rawset(L, json_import_shadowtbl_idx);
   181     // expect object key (or end of object) to follow:
   182     mode = JSON_STATE_OBJECT_KEY;
   183     // jump to common code for opening JSON object and JSON array:
   184     goto json_import_open;
   185   // new JSON array:
   186   case '[':
   187     // if a JSON array is not expected here, then return an error:
   188     if (
   189       mode != JSON_STATE_VALUE &&
   190       mode != JSON_STATE_OBJECT_VALUE &&
   191       mode != JSON_STATE_ARRAY_VALUE
   192     ) goto json_import_syntax_error;
   193     // create JSON array on stack:
   194     lua_newtable(L);
   195     // set metatable of JSON array:
   196     lua_pushvalue(L, json_import_arraymt_idx);
   197     lua_setmetatable(L, -2);
   198     // create internal shadow table on stack:
   199     lua_newtable(L);
   200     // register internal shadow table:
   201     lua_pushvalue(L, -2);
   202     lua_pushvalue(L, -2);
   203     lua_rawset(L, json_import_shadowtbl_idx);
   204     // add nil as key (needed to keep stack balance) and as magic to detect arrays:
   205     lua_pushnil(L);
   206     // expect array value (or end of array) to follow:
   207     mode = JSON_STATE_ARRAY_VALUE;
   208     // continue with common code for opening JSON object and JSON array:
   209   // common code for opening JSON object or JSON array:
   210   json_import_open:
   211     // limit nested levels:
   212     if (level >= JSON_MAXDEPTH) {
   213       lua_pushnil(L);
   214       lua_pushliteral(L, "Too many nested JSON levels");
   215       return 2;
   216     }
   217     // additional buffer overflow protection:
   218     if (!lua_checkstack(L, LUA_MINSTACK))
   219       return luaL_error(L, "Caught stack overflow in JSON import function (too many nested levels and stack size too small)");
   220     // increment level:
   221     level++;
   222     // consume input character:
   223     pos++;
   224     goto json_import_loop;
   225   // end of JSON object:
   226   case '}':
   227     // if end of JSON object is not expected here, then return an error:
   228     if (
   229       mode != JSON_STATE_OBJECT_KEY &&
   230       mode != JSON_STATE_OBJECT_SEPARATOR
   231     ) goto json_import_syntax_error;
   232     // jump to common code for end of JSON object and JSON array:
   233     goto json_import_close;
   234   // end of JSON array:
   235   case ']':
   236     // if end of JSON array is not expected here, then return an error:
   237     if (
   238       mode != JSON_STATE_ARRAY_VALUE &&
   239       mode != JSON_STATE_ARRAY_SEPARATOR
   240     ) goto json_import_syntax_error;
   241     // pop nil key/magic (that was needed to keep stack balance):
   242     lua_pop(L, 1);
   243     // continue with common code for end of JSON object and JSON array:
   244   // common code for end of JSON object or JSON array:
   245   json_import_close:
   246     // consume input character:
   247     pos++;
   248     // pop shadow table:
   249     lua_pop(L, 1);
   250     // check if nested:
   251     if (--level) {
   252       // if nested,
   253       // check if outer(!) structure is an array or object:
   254       if (lua_isnil(L, -2)) {
   255         // select array value processing:
   256         mode = JSON_STATE_ARRAY_VALUE;
   257       } else {
   258         // select object value processing:
   259         mode = JSON_STATE_OBJECT_VALUE;
   260       }
   261       // store value in outer structure:
   262       goto json_import_process_value;
   263     }
   264     // if not nested, then expect end of JSON document and continue with loop:
   265     mode = JSON_STATE_END;
   266     goto json_import_loop;
   267   // key terminator:
   268   case ':':
   269     // if key terminator is not expected here, then return an error:
   270     if (mode != JSON_STATE_OBJECT_KEY_TERMINATOR)
   271       goto json_import_syntax_error;
   272     // consume input character:
   273     pos++;
   274     // expect object value to follow:
   275     mode = JSON_STATE_OBJECT_VALUE;
   276     // continue with loop:
   277     goto json_import_loop;
   278   // value terminator (NOTE: trailing comma at end of value or key-value list is tolerated by this parser)
   279   case ',':
   280     // branch according to parser state:
   281     if (mode == JSON_STATE_OBJECT_SEPARATOR) {
   282       // expect an object key to follow:
   283       mode = JSON_STATE_OBJECT_KEY;
   284     } else if (mode == JSON_STATE_ARRAY_SEPARATOR) {
   285       // expect an array value to follow:
   286       mode = JSON_STATE_ARRAY_VALUE;
   287     } else {
   288        // if value terminator is not expected here, then return an error:
   289        goto json_import_syntax_error;
   290     }
   291     // consume input character:
   292     pos++;
   293     // continue with loop:
   294     goto json_import_loop;
   295   // string literal:
   296   case '"':
   297     // consume quote character:
   298     pos++;
   299     // prepare buffer to decode string (with maximum possible length) and set write position to zero:
   300     cbuf = luaL_buffinitsize(L, &luabuf, total-pos);
   301     writepos = 0;
   302     // loop through the characters until encountering end quote:
   303     while ((c = str[pos++]) != '"') {
   304       if (c == 0) {
   305         // handle unexpected end of JSON document:
   306         goto json_import_unexpected_eof;
   307       } else if (c < 32 || c == 127) {
   308         // do not allow ASCII control characters:
   309         // NOTE: illegal UTF-8 sequences and extended control characters are not sanitized
   310         //       by this parser to allow different encodings than Unicode
   311         lua_pushnil(L);
   312         lua_pushliteral(L, "Unexpected control character in JSON string");
   313         return 2;
   314       } else if (c == '\\') {
   315         // read next char after backslash escape:
   316         c = str[pos++];
   317         switch (c) {
   318         // unexpected end-of-string:
   319         case 0:
   320           goto json_import_unexpected_eof;
   321         // unescaping of quotation mark, slash, and backslash:
   322         case '"':
   323         case '/':
   324         case '\\':
   325           cbuf[writepos++] = c;
   326           break;
   327         // unescaping of backspace:
   328         case 'b': cbuf[writepos++] = '\b'; break;
   329         // unescaping of form-feed:
   330         case 'f': cbuf[writepos++] = '\f'; break;
   331         // unescaping of new-line:
   332         case 'n': cbuf[writepos++] = '\n'; break;
   333         // unescaping of carriage-return:
   334         case 'r': cbuf[writepos++] = '\r'; break;
   335         // unescaping of tabulator:
   336         case 't': cbuf[writepos++] = '\t'; break;
   337         // unescaping of UTF-16 characters
   338         case 'u':
   339           lua_pushnil(L);
   340           lua_pushliteral(L, "JSON unicode escape sequences are not implemented yet");  // TODO
   341           return 2;
   342         // unexpected escape sequence:
   343         default:
   344           lua_pushnil(L);
   345           lua_pushliteral(L, "Unexpected string escape sequence in JSON document");
   346           return 2;
   347         }
   348       } else {
   349         // normal character:
   350         cbuf[writepos++] = c;
   351       }
   352     }
   353     // process buffer to Lua string:
   354     luaL_pushresultsize(&luabuf, writepos);
   355     // continue with processing of decoded string:
   356     goto json_import_process_value;
   357   }
   358   // process values whose type is is not deducible from a single character:
   359   if ((c >= '0' && c <= '9') || c == '-' || c == '+') {
   360     // for numbers,
   361     // use strtod() call to parse a (double precision) floating point number:
   362     char *endptr;
   363     double numval;
   364     numval = strtod(str+pos, &endptr);
   365     // catch parsing errors:
   366     if (endptr == str+pos) goto json_import_syntax_error;
   367     // consume characters that were parsed:
   368     pos += endptr - (str+pos);
   369     // push parsed (double precision) floating point number on Lua stack:
   370     lua_pushnumber(L, numval);
   371   } else if (!strncmp(str+pos, "true", 4)) {
   372     // consume 4 input characters for "true":
   373     pos += 4;
   374     // put Lua true value onto stack:
   375     lua_pushboolean(L, 1);
   376   } else if (!strncmp(str+pos, "false", 5)) {
   377     // consume 5 input characters for "false":
   378     pos += 5;
   379     // put Lua false value onto stack:
   380     lua_pushboolean(L, 0);
   381   } else if (!strncmp(str+pos, "null", 4)) {
   382     // consume 4 input characters for "null":
   383     pos += 4;
   384     // put special null-marker onto stack:
   385     lua_pushvalue(L, json_import_nullmark_idx);
   386   } else {
   387     // all other cases are a syntax error:
   388     goto json_import_syntax_error;
   389   }
   390   // process a decoded value or key value pair (expected on top of Lua stack):
   391   json_import_process_value:
   392   switch (mode) {
   393   // an object key has been read:
   394   case JSON_STATE_OBJECT_KEY:
   395     // if an object key is not a string, then this is a syntax error:
   396     if (lua_type(L, -1) != LUA_TSTRING) goto json_import_syntax_error;
   397     // expect key terminator to follow:
   398     mode = JSON_STATE_OBJECT_KEY_TERMINATOR;
   399     // continue with loop:
   400     goto json_import_loop;
   401   // a key value pair has been read:
   402   case JSON_STATE_OBJECT_VALUE:
   403     // store key value pair in outer shadow table:
   404     lua_rawset(L, -3);
   405     // expect value terminator (or end of object) to follow:
   406     mode = JSON_STATE_OBJECT_SEPARATOR;
   407     // continue with loop:
   408     goto json_import_loop;
   409   // an array value has been read:
   410   case JSON_STATE_ARRAY_VALUE:
   411     // get current array length:
   412     arraylen = lua_rawlen(L, -3);
   413     // throw error if array would exceed INT_MAX elements:
   414     // TODO: Lua 5.3 may support more elements
   415     if (arraylen >= INT_MAX) {
   416       lua_pushnil(L);
   417       lua_pushfstring(L, "Array exceeded length of %d elements", INT_MAX);
   418     }
   419     // store value in outer shadow table:
   420     lua_rawseti(L, -3, arraylen + 1);
   421     // expect value terminator (or end of object) to follow:
   422     mode = JSON_STATE_ARRAY_SEPARATOR;
   423     // continue with loop
   424     goto json_import_loop;
   425   // a single value has been read:
   426   case JSON_STATE_VALUE:
   427     // leave value on top of stack, expect end of JSON document, and continue with loop:
   428     mode = JSON_STATE_END;
   429     goto json_import_loop;
   430   }
   431   // syntax error handling (reachable by goto statement):
   432   json_import_syntax_error:
   433   lua_pushnil(L);
   434   lua_pushliteral(L, "Syntax error in JSON document");
   435   return 2;
   436 }
   438 // special Lua stack indicies for json_path function:
   439 #define json_path_shadowtbl_idx 1
   440 #define json_path_nullmark_idx 2
   442 // stack offset of arguments to json_path function:
   443 #define json_path_idxshift 2
   445 // gets a value or its type from a JSON document (passed as first argument)
   446 // using a path (passed as variable number of keys after first argument):
   447 static int json_path(lua_State *L, int type_mode) {
   448   int stacktop;                      // stack index of top of stack (after shifting)
   449   int idx = 2 + json_path_idxshift;  // stack index of current argument to process
   450   // insert shadowtbl into stack at position 1 (shifting the arguments):
   451   json_regfetch(L, shadowtbl);
   452   lua_insert(L, 1);
   453   // insert nullmark into stack at position 2 (shifting the arguments):
   454   json_pushlightref(L, nullmark);
   455   lua_insert(L, 2);
   456   // store stack index of top of stack:
   457   stacktop = lua_gettop(L);
   458   // use first argument as "current value" (stored on top of stack):
   459   lua_pushvalue(L, 1 + json_path_idxshift);
   460   // process each "path key" (2nd argument and following arguments):
   461   while (idx <= stacktop) {
   462     // if "current value" (on top of stack) is nil, then the path cannot be walked and nil is returned:
   463     if (lua_isnil(L, -1)) return 1;
   464     // try to get shadow table of "current value":
   465     lua_pushvalue(L, -1);
   466     lua_rawget(L, json_path_shadowtbl_idx);
   467     if (lua_isnil(L, -1)) {
   468       // if no shadow table is found,
   469       if (lua_type(L, -1) == LUA_TTABLE) {
   470         // and if "current value" is a table,
   471         // drop nil from stack:
   472         lua_pop(L, 1);
   473         // get "next value" using the "path key":
   474         lua_pushvalue(L, idx++);
   475         lua_gettable(L, -2);
   476       } else {
   477         // if "current value" is not a table,
   478         // then the path cannot be walked and nil (already on top of stack) is returned:
   479         return 1;
   480       }
   481     } else {
   482       // if a shadow table is found,
   483       // set "current value" to its shadow table:
   484       lua_replace(L, -2);
   485       // get "next value" using the "path key":
   486       lua_pushvalue(L, idx++);
   487       lua_rawget(L, -2);
   488     }
   489     // the "next value" replaces the "current value":
   490     lua_replace(L, -2);
   491   }
   492   if (!type_mode) {
   493     // if a value (and not its type) was requested,
   494     // check if value is the null-marker, and store nil on top of Lua stack in that case:
   495     if (lua_rawequal(L, -1, json_path_nullmark_idx)) lua_pushnil(L);
   496   } else {
   497     // if the type was requested,
   498     // check if value is the null-marker:
   499     if (lua_rawequal(L, -1, json_path_nullmark_idx)) {
   500       // if yes, store string "null" on top of Lua stack:
   501       lua_pushliteral(L, "null");
   502     } else {
   503       // otherwise,
   504       // check if metatable indicates "object" or "array":
   505       if (lua_getmetatable(L, -1)) {
   506         json_regfetch(L, objectmt);
   507         if (lua_rawequal(L, -2, -1)) {
   508           // if value has metatable for JSON objects,
   509           // return string "object":
   510           lua_pushliteral(L, "object");
   511           return 1;
   512         }
   513         json_regfetch(L, arraymt);
   514         if (lua_rawequal(L, -3, -1)) {
   515           // if value has metatable for JSON arrays,
   516           // return string "object":
   517           lua_pushliteral(L, "array");
   518           return 1;
   519         }
   520         // remove 3 metatables (one of the value, two for comparison) from stack:
   521         lua_pop(L, 3);
   522       }
   523       // otherwise, get the Lua type:
   524       lua_pushstring(L, lua_typename(L, lua_type(L, -1)));
   525     }
   526   }
   527   // return the top most value on the Lua stack:
   528   return 1;
   529 }
   531 // gets a value from a JSON document (passed as first argument)
   532 // using a path (passed as variable number of keys after first argument):
   533 static int json_get(lua_State *L) {
   534   return json_path(L, 0);
   535 }
   537 // gets a value's type from a JSON document (passed as first argument)
   538 // using a path (variable number of keys after first argument):
   539 static int json_type(lua_State *L) {
   540   return json_path(L, 1);
   541 }
   543 // checks if a value in a JSON document (first argument) is
   544 // explicitly set to null:
   545 static int json_isnull(lua_State *L) {
   546   const char *jsontype;
   547   // call json_type function with variable arguments:
   548   lua_pushcfunction(L, json_type);
   549   lua_insert(L, 1);
   550   lua_call(L, lua_gettop(L) - 1, 1);
   551   // return true if result equals to string "null", otherwise return false:
   552   jsontype = lua_tostring(L, -1);
   553   if (jsontype && !strcmp(jsontype, "null")) lua_pushboolean(L, 1);
   554   else lua_pushboolean(L, 0);
   555   return 1;
   556 }
   558 // special Lua stack indicies for json_setnull function:
   559 #define json_setnull_unknownmt_idx 3
   560 #define json_setnull_objectmt_idx 4
   561 #define json_setnull_arraymt_idx 5
   562 #define json_setnull_shadowtbl_idx 6
   564 // sets a value in a JSON object or JSON array explicitly to null:
   565 // NOTE: JSON null is different than absence of a key
   566 static int json_setnull(lua_State *L) {
   567   // stack shall contain two function arguments:
   568   lua_settop(L, 2);
   569   // push unknownmt onto stack position 3:
   570   json_regfetch(L, unknownmt);
   571   // push objectmt onto stack position 4:
   572   json_regfetch(L, objectmt);
   573   // push arraymt onto stack position 5:
   574   json_regfetch(L, arraymt);
   575   // push shadowtbl onto stack position 6:
   576   json_regfetch(L, shadowtbl);
   577   // set metatable if necessary (leaves unknown number of elements on stack):
   578   if (
   579     !lua_getmetatable(L, 1) || (
   580       !lua_rawequal(L, -1, json_setnull_unknownmt_idx) &&
   581       !lua_rawequal(L, -1, json_setnull_objectmt_idx) &&
   582       !lua_rawequal(L, -1, json_setnull_arraymt_idx)
   583     )
   584   ) {
   585     lua_pushvalue(L, json_setnull_unknownmt_idx);
   586     lua_setmetatable(L, 1);
   587   }
   588   // try to get shadow table:
   589   lua_pushvalue(L, 1);
   590   lua_rawget(L, json_setnull_shadowtbl_idx);
   591   if (lua_isnil(L, -1)) {
   592     // if no shadow table is found,
   593     // create new shadow table (and leave it on top of stack):
   594     lua_newtable(L);
   595     // register shadow table:
   596     lua_pushvalue(L, 1);
   597     lua_pushvalue(L, -2);
   598     lua_rawset(L, json_setnull_shadowtbl_idx);
   599   }
   600   // push key (second argument) and null-marker after shadow table onto stack:
   601   lua_pushvalue(L, 2);
   602   json_pushlightref(L, nullmark);
   603   // store key and null-marker in shadow table:
   604   lua_rawset(L, -3);
   605   // return nothing:
   606   return 0;
   607 }
   609 // returns the length of a JSON array (or zero for a table without numeric keys):
   610 static int json_len(lua_State *L) {
   611   // stack shall contain one function argument:
   612   lua_settop(L, 1);
   613   // try to get corresponding shadow table for first argument:
   614   json_regfetch(L, shadowtbl);
   615   lua_pushvalue(L, 1);
   616   lua_rawget(L, -2);
   617   // if shadow table does not exist, return length of argument, else length of shadow table:
   618   lua_pushnumber(L, lua_rawlen(L, lua_isnil(L, -1) ? 1 : -1));
   619   return 1;
   620 }
   622 // special Lua stack indicies for json_index function:
   623 #define json_index_nullmark_idx 3
   624 #define json_index_shadowtbl_idx 4
   626 static int json_index(lua_State *L) {
   627   // stack shall contain two function arguments:
   628   lua_settop(L, 2);
   629   // push nullmark onto stack position 3:
   630   json_pushlightref(L, nullmark);
   631   // push shadowtbl onto stack position 4:
   632   json_regfetch(L, shadowtbl);
   633   // get corresponding shadow table for first argument:
   634   lua_pushvalue(L, 1);
   635   lua_rawget(L, json_index_shadowtbl_idx);
   636   // throw error if no shadow table was found:
   637   if (lua_isnil(L, -1)) return luaL_error(L, "Shadow table not found");
   638   // use key passed as second argument to lookup value in shadow table:
   639   lua_pushvalue(L, 2);
   640   lua_rawget(L, -2);
   641   // if value is null-marker, then push nil onto stack:
   642   if (lua_rawequal(L, -1, json_index_nullmark_idx)) lua_pushnil(L);
   643   // return either looked up value, or nil
   644   return 1;
   645 }
   647 static int json_newindex(lua_State *L) {
   648   // stack shall contain three function arguments:
   649   lua_settop(L, 3);
   650   // get corresponding shadow table for first argument:
   651   json_regfetch(L, shadowtbl);
   652   lua_pushvalue(L, 1);
   653   lua_rawget(L, -2);
   654   // throw error if no shadow table was found:
   655   if (lua_isnil(L, -1)) return luaL_error(L, "Shadow table not found");
   656   // replace first argument with shadow table:
   657   lua_replace(L, 1);
   658   // reset stack and use second and third argument to write to shadow table:
   659   lua_settop(L, 3);
   660   lua_rawset(L, 1);
   661   // return nothing:
   662   return 0;
   663 }
   665 // special Lua stack indicies for json_pairs_iterfunc function:
   666 #define json_pairs_iterfunc_nullmark_idx 3
   667 #define json_pairs_iterfunc_shadowtbl_idx 4
   669 static int json_pairs_iterfunc(lua_State *L) {
   670   // stack shall contain two function arguments:
   671   lua_settop(L, 2);
   672   // push nullmark onto stack position 3:
   673   json_pushlightref(L, nullmark);
   674   // push shadowtbl onto stack position 4:
   675   json_regfetch(L, shadowtbl);
   676   // get corresponding shadow table for first argument:
   677   lua_pushvalue(L, 1);
   678   lua_rawget(L, json_pairs_iterfunc_shadowtbl_idx);
   679   // throw error if no shadow table was found:
   680   if (lua_isnil(L, -1)) return luaL_error(L, "Shadow table not found");
   681   // get next key value pair from shadow table (using previous key from argument 2)
   682   // and return nothing if there is no next pair:
   683   lua_pushvalue(L, 2);
   684   if (!lua_next(L, -2)) return 0;
   685   // replace null-marker with nil:
   686   if (lua_rawequal(L, -1, json_pairs_iterfunc_nullmark_idx)) {
   687     lua_pop(L, 1);
   688     lua_pushnil(L);
   689   }
   690   // return key and value (or key and nil, if null-marker was found):
   691   return 2;
   692 }
   694 // returns a triple such that 'for key, value in pairs(obj) do ... end'
   695 // iterates through all key value pairs (including JSON null keys represented as Lua nil):
   696 static int json_pairs(lua_State *L) {
   697   // return triple of function json_pairs_iterfunc, first argument, and nil:
   698   lua_pushcfunction(L, json_pairs_iterfunc);
   699   lua_pushvalue(L, 1);
   700   lua_pushnil(L);
   701   return 3;
   702 }
   704 // special Lua stack indicies for json_ipairs_iterfunc function:
   705 #define json_ipairs_iterfunc_nullmark_idx 3
   706 #define json_ipairs_iterfunc_shadowtbl_idx 4
   708 static int json_ipairs_iterfunc(lua_State *L) {
   709   lua_Integer idx;
   710   // stack shall contain two function arguments:
   711   lua_settop(L, 2);
   712   // push nullmark onto stack position 3:
   713   json_pushlightref(L, nullmark);
   714   // push shadowtbl onto stack position 4:
   715   json_regfetch(L, shadowtbl);
   716   // calculate new index by incrementing second argument:
   717   idx = lua_tointeger(L, 2) + 1;
   718   // get corresponding shadow table for first argument:
   719   lua_pushvalue(L, 1);
   720   lua_rawget(L, json_ipairs_iterfunc_shadowtbl_idx);
   721   // throw error if no shadow table was found:
   722   if (lua_isnil(L, -1)) return luaL_error(L, "Shadow table not found");
   723   // do integer lookup in shadow table:
   724   lua_rawgeti(L, -1, idx);
   725   // return nothing if there was no value:
   726   if (lua_isnil(L, -1)) return 0;
   727   // return new index and
   728   // either the looked up value if it is not equal to the null-marker
   729   // or nil instead of null-marker:
   730   lua_pushinteger(L, idx);
   731   if (lua_rawequal(L, -2, json_ipairs_iterfunc_nullmark_idx)) lua_pushnil(L);
   732   else lua_pushvalue(L, -2);
   733   return 2;
   734 }
   736 // returns a triple such that 'for idx, value in ipairs(ary) do ... end'
   737 // iterates through all values (including JSON null represented as Lua nil):
   738 static int json_ipairs(lua_State *L) {
   739   // return triple of function json_ipairs_iterfunc, first argument, and zero:
   740   lua_pushcfunction(L, json_ipairs_iterfunc);
   741   lua_pushvalue(L, 1);
   742   lua_pushinteger(L, 0);
   743   return 3;
   744 }
   746 // functions in library module:
   747 static const struct luaL_Reg json_module_functions[] = {
   748   {"object", json_object},
   749   {"array", json_array},
   750   {"import", json_import},
   751   {"get", json_get},
   752   {"type", json_type},
   753   {"isnull", json_isnull},
   754   {"setnull", json_setnull},
   755   {NULL, NULL}
   756 };
   758 // metamethods for JSON objects, JSON arrays, and unknown JSON collections (object or array):
   759 static const struct luaL_Reg json_metatable_functions[] = {
   760   {"__len", json_len},
   761   {"__index", json_index},
   762   {"__newindex", json_newindex},
   763   {"__pairs", json_pairs},
   764   {"__ipairs", json_ipairs},
   765   {NULL, NULL}
   766 };
   768 // initializes json library:
   769 int luaopen_json(lua_State *L) {
   770   // empty stack:
   771   lua_settop(L, 0);
   772   // push library module onto stack position 1:
   773   lua_newtable(L);
   774   // register library functions:
   775   luaL_setfuncs(L, json_module_functions, 0);
   776   // create and store unknownmt:
   777   lua_newtable(L);
   778   luaL_setfuncs(L, json_metatable_functions, 0);
   779   json_regstore(L, unknownmt);
   780   // create and store objectmt:
   781   lua_newtable(L);
   782   luaL_setfuncs(L, json_metatable_functions, 0);
   783   json_regstore(L, objectmt);
   784   // create and store arraymt:
   785   lua_newtable(L);
   786   luaL_setfuncs(L, json_metatable_functions, 0);
   787   json_regstore(L, arraymt);
   788   // create and store ephemeron table to store shadow tables for each JSON object/array
   789   // to allow NULL values returned as nil
   790   lua_newtable(L);
   791   lua_newtable(L);  // metatable for ephemeron table
   792   lua_pushliteral(L, "__mode");
   793   lua_pushliteral(L, "k");
   794   lua_rawset(L, -3);
   795   lua_setmetatable(L, -2);
   796   json_regstore(L, shadowtbl);
   797   // return library module stored on lowest stack position:
   798   lua_settop(L, 1);
   799   return 1;
   800 }
