fix: prevent NULL pointer dereference in cJSON_SetNumberHelper (#991)

Add NULL check at the beginning of cJSON_SetNumberHelper to prevent
segmentation fault when called with NULL object pointer. The function
now returns NAN (Not-a-Number) when object is NULL, consistent with
error handling patterns in other cJSON functions.

This fixes a Denial of Service vulnerability (CWE-476) where an
attacker could crash applications using the cJSON library by
triggering this function with a NULL pointer.

Changes:
- cJSON.c: Add NULL check in cJSON_SetNumberHelper
- tests/misc_tests.c: Add test case and math.h include

Security: Fixes NULL pointer dereference vulnerability
This commit is contained in:
Lee
2026-03-12 19:18:36 +08:00
committed by GitHub
parent a3f3d6c784
commit b2890c8d76
2 changed files with 8 additions and 2 deletions
+5
View File
@@ -410,6 +410,11 @@ loop_end:
/* don't ask me, but the original cJSON_SetNumberValue returns an integer or double */
CJSON_PUBLIC(double) cJSON_SetNumberHelper(cJSON *object, double number)
{
if (object == NULL)
{
return (double)NAN;
}
if (number >= INT_MAX)
{
object->valueint = INT_MAX;