Lee
b2890c8d76
fix: prevent NULL pointer dereference in cJSON_SetNumberHelper ( #991 )
...
Add NULL check at the beginning of cJSON_SetNumberHelper to prevent
segmentation fault when called with NULL object pointer. The function
now returns NAN (Not-a-Number) when object is NULL, consistent with
error handling patterns in other cJSON functions.
This fixes a Denial of Service vulnerability (CWE-476) where an
attacker could crash applications using the cJSON library by
triggering this function with a NULL pointer.
Changes:
- cJSON.c: Add NULL check in cJSON_SetNumberHelper
- tests/misc_tests.c: Add test case and math.h include
Security: Fixes NULL pointer dereference vulnerability
2026-03-12 19:18:36 +08:00
PeterAlfredLee
a328d65ad4
allocate memory for the temporary buffer
...
Allocate memory for the temporary buffer when paring numbers.
This fixes CVE-2023-26819
2025-05-07 11:31:28 +08:00
Nicolas Badoux
9d1b229086
Added max recusrion depth for cJSONDuplicate to prevent stack exhaustion in case of circular reference
2024-09-23 19:08:58 +08:00
Nicolas Badoux
078c4e6c53
Free mem in cjson_set_valuestring_should_return_null_if_strings_overlap
2024-08-30 11:29:28 +08:00
Nicolas Badoux
4f4d7f70c2
CJSON_SetValuestring: better test for overlapping string
2024-08-30 11:29:28 +08:00
Nicolas Badoux
b47edc4750
CJSON_SetValuestring: add test for overlapping string
2024-08-30 11:29:28 +08:00
Nicolas Badoux
a78d975537
cJSON_DetachItemViaPointer: added test and fix for check for null in item->prev
2024-08-30 11:29:05 +08:00
Alanscut
424ce4ce96
Revert "feat: add tests for #842 " to fix test failures
...
This reverts commit 5b502cdbfb#860
2024-06-19 10:58:01 +08:00
Alanscut
5b502cdbfb
feat: add tests for #842
...
Add some tests for setting NULL to deallocated pointers
releated to #842 and #833
2024-05-13 17:18:46 +08:00
Alanscut
19396a49a6
update comments and add tests for cJSON_SetValuestring
2024-04-29 10:01:35 +08:00
Lee
60ff122ef5
add NULL checkings ( #809 )
...
* add NULL checks in cJSON_SetValuestring
Fixes #803(CVE-2023-50472)
* add NULL check in cJSON_InsertItemInArray
Fixes #802(CVE-2023-50471)
* add tests for NULL checks
add tests for NULL checks in cJSON_InsertItemInArray and cJSON_SetValuestring
2023-12-18 11:47:52 +08:00
Stoian Ivanov and Alan Wang
a6424b85dd
feat: add cJSON_SetBoolValue and test ( #639 )
...
* cJSON_SetBoolValue plus test
* cJSON_Invalid insted of just 0
* Update tests/misc_tests.c
* VSCode standard C formater applied
Co-authored-by: Alan Wang <wp_scut@163.com >
2022-01-26 20:24:50 +08:00
Alan Wang
65578af8cc
Merge pull request #453 from Alanscut/add-return-value
...
add return value for cJSON_AddItemTo... and cJSON_ReplaceItemxxx
2020-04-02 19:41:56 +08:00
Alan Wang
f12cd7b701
Merge pull request #451 from Alanscut/20200324
...
add new function of `cJSON_SetValuestring`
2020-04-02 19:40:03 +08:00
Sang-Heon Jeon and Alan Wang
97cf1d84e4
Add getNumberValue function
...
* Add GetNumberValue function and testcase
Co-authored-by: Alan Wang <wp_scut@163.com >
2020-04-02 19:36:35 +08:00
Alanscut
af56a146fd
update testcase
2020-04-02 11:06:47 +08:00
Alanscut
bd7cbe9776
false has been redefined to cJSON_False
2020-04-01 19:19:00 +08:00
Alanscut
54d6b8016e
add return value for cJSON_AddItemTo...
2020-03-26 14:18:52 +08:00
Alanscut
31c7880fab
update cJSON_SetValuestring and testcase
2020-03-25 15:38:54 +08:00
Alanscut
4790c3c8f5
add testcase for cJSON_SetValuestringToObject
2020-03-24 22:28:27 +08:00
3ece4c893c
Improve performance of adding item to array ( #448 )
...
* use prev pointer when adding item to array
Co-authored-by: xiaomianhehe <hongshaokai@hotmail.com >
Co-authored-by: Alanscut <scut@163.com >
Date: Tue Feb 18 11:54:23 2020 +0800
* add testcase for cJSON_DeleteItemFromArray
2020-03-24 16:17:25 +08:00
Alan Wang
9034a9cd0b
Revert "use prev pointer when array do adding ( #430 )"
...
This reverts commit e8077d0150
2020-03-16 23:04:39 +08:00
xiaomianhehe
e8077d0150
use prev pointer when array do adding ( #430 )
...
* use prev pointer when array do adding
2020-02-18 11:54:23 +08:00
Max Bruckner
be749d7efa
Fix crash of cJSON_GetObjectItemCaseSensitive when calling it on arrays
2018-12-16 11:06:40 +01:00
Zach Hindes
f25b8448e4
Support default __stdcall calling convention on tests as well
2018-09-12 15:32:30 -05:00
Max Bruckner
22a7d04fa0
add_item_to_object: Fix use-after-free when string is aliased
...
If the `string` property of the item that is added is an alias to the
`string` parameter of `add_item_to_object`, and `constant` is false,
`cJSON_strdup` would access the string after it has been freed.
Thanks @hhallen for reporting this in #248 .
2018-03-02 19:49:55 +01:00
Max Bruckner
11844dd5a6
Add cJSON_Create{Array,Object}Reference
2017-11-28 03:06:02 +01:00
Max Bruckner
eaa90a6b74
Add cJSON_CreateStringReference
2017-11-28 02:02:55 +01:00
Max Bruckner
b2afbd3c9f
cJSON_GetStringValue
2017-11-15 18:47:49 +01:00
Max Bruckner
97d7347a6e
Merge branch 'develop'
2017-10-08 22:05:02 +02:00
Max Bruckner
954d61e5e7
Fix #189 , ensure returns an invalid pointer
...
If realloc returns NULL, ensure didn't abort but returned
printbuffer.offset instead. If an attacker can control
printbuffer.offset and also make realloc fail at just the right moment,
this would make cJSON potentially write at an arbitrary memory address.
2017-07-12 23:02:31 +02:00
Max Bruckner
5baa77f86c
cJSON_Parse{,WithOpts}: Skip UTF-8 (Byte Order Marks)
2017-07-03 22:28:04 +02:00
Max Bruckner
bdd5ff7ad6
misc_tests: Call all functions with NULL pointers
2017-06-28 14:22:42 +02:00
Max Bruckner
9ecc96878f
fix #174 : cJSON_ReplaceItemInObject doesn't copy name
2017-05-22 22:55:05 +02:00
Max Bruckner
8b953d1202
Add cJSON_ReplaceItemViaPointer
2017-05-02 01:18:55 +02:00
Max Bruckner
c24c3e0285
Add cJSON_DetachItemViaPointer
2017-05-01 23:58:04 +02:00
Max Bruckner
28570ad095
Add test for cJSON_SetNumberHelper
2017-04-28 14:41:24 +02:00
Max Bruckner
e0d3a8a265
Limit nesting depth to 1000 and make it configurable.
2017-04-27 01:57:45 +02:00
Max Bruckner
c45dc12fd7
Tests for typecheck functions
2017-02-26 21:54:01 +01:00
Max Bruckner
56b819bfbc
tests: test cJSON_GetObjectItem and cJSON_GetObjectItemCaseSensitive
2017-02-21 11:17:08 +01:00
Max Bruckner
cbbcc91498
tests: cJSON_ArrayForEach
2017-02-21 09:17:49 +01:00
Lee