wt/cJSON
1
0
Fork 0
mirror of https://github.com/DaveGamble/cJSON.git synced 2026-10-13 10:15:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: heap-use-after-free in merge_patch when patch is subtree of target (#1065)

Browse Source 
When cJSONUtils_MergePatch(target, patch) is called with a non-object
patch (scalar, array, or NULL) that happens to be a subtree of target,
merge_patch() called cJSON_Delete(target) first, which freed the patch
memory, and then cJSON_Duplicate(patch, 1) read the already-freed memory,
triggering a heap-use-after-free (detected by AddressSanitizer at
cJSON_Duplicate_rec, cJSON.c:2808).

Fix: duplicate the patch first into a local variable, then delete the
target, then return the duplicate. This matches the Option B approach
proposed in issue #1060.

Verified locally:
- Reproduced the UAF with a minimal PoC under ASan before the fix.
- After the fix the PoC runs cleanly (exit 0, correct result [1,2,3]).
- Added a regression unit test
  (merge_patch_should_not_read_freed_memory_when_patch_is_subtree).
- Full ctest suite passes (22/22 tests).

Fixes #1060

Signed-off-by: lilu <lilu@kylinos.cn>
This commit is contained in:
lilu5458
2026-09-16 09:55:35 +08:00
committed by GitHub
parent fb16e5cf35
commit 6d9f2443ab
2 changed files with 40 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cJSON_Utils.c
+6 -2
View File
@@ -1324,9 +1324,13 @@ static cJSON *merge_patch(cJSON *target, const cJSON * const patch, const cJSON_
if (!cJSON_IsObject(patch))
{
/* scalar value, array or NULL, just duplicate */
/* scalar value, array or NULL, just duplicate.
* Duplicate the patch first in case it is a subtree of target,
* otherwise cJSON_Delete(target) would free the patch memory
* and the subsequent cJSON_Duplicate would read freed memory. */
cJSON *duplicate = cJSON_Duplicate(patch, 1);
cJSON_Delete(target);
return cJSON_Duplicate(patch, 1);
return duplicate;
}
if (!cJSON_IsObject(target))