When cJSONUtils_MergePatch(target, patch) is called with a non-object
patch (scalar, array, or NULL) that happens to be a subtree of target,
merge_patch() called cJSON_Delete(target) first, which freed the patch
memory, and then cJSON_Duplicate(patch, 1) read the already-freed memory,
triggering a heap-use-after-free (detected by AddressSanitizer at
cJSON_Duplicate_rec, cJSON.c:2808).
Fix: duplicate the patch first into a local variable, then delete the
target, then return the duplicate. This matches the Option B approach
proposed in issue #1060.
Verified locally:
- Reproduced the UAF with a minimal PoC under ASan before the fix.
- After the fix the PoC runs cleanly (exit 0, correct result [1,2,3]).
- Added a regression unit test
(merge_patch_should_not_read_freed_memory_when_patch_is_subtree).
- Full ctest suite passes (22/22 tests).
Fixes#1060
Signed-off-by: lilu <lilu@kylinos.cn>
Add NULL check at the beginning of cJSON_SetNumberHelper to prevent
segmentation fault when called with NULL object pointer. The function
now returns NAN (Not-a-Number) when object is NULL, consistent with
error handling patterns in other cJSON functions.
This fixes a Denial of Service vulnerability (CWE-476) where an
attacker could crash applications using the cJSON library by
triggering this function with a NULL pointer.
Changes:
- cJSON.c: Add NULL check in cJSON_SetNumberHelper
- tests/misc_tests.c: Add test case and math.h include
Security: Fixes NULL pointer dereference vulnerability
The README stated that CMake 2.8.5+ was required, but CMakeLists.txt
requires CMake 3.5+. This inconsistency caused confusion for users
with CMake versions between 2.8.5 and 3.5.
Also updated library_config/uninstall.cmake to match for consistency.
Fixes#988
If the valuestring passed to cJSON_SetValuestring is NULL, a null pointer dereference will happen.
This commit adds the NULL check of valuestring before it is dereferenced.
If the parent passed in cJSON_ReplaceItemViaPointer has not a child, which means parent->child is null, a null pointer dereference crash will be happened inside cJSON_ReplaceItemViaPointer.
This commit adds the NULL check of `parent->child` beforehand to inform user such incorrect usage.
Signed-off-by: hopper-vul <hopper.vul@gmail.com>
* cJSON_SetBoolValue plus test
* cJSON_Invalid insted of just 0
* Update tests/misc_tests.c
* VSCode standard C formater applied
Co-authored-by: Alan Wang <wp_scut@163.com>
* Update CMakeLists.txt
fix the bug:when build with cmake using option '-DBUILD_SHARED_AND_STATIC_LIBS=ON -DENABLE_CJSON_UTILS=ON', build sucess,
but use cmake comand 'find_package(cjson CONFIG)', 'cjson_utils' target is available,but 'cjson_utils-static' target not exist.
lilu5458