lilu5458 6d9f2443ab Fix: heap-use-after-free in merge_patch when patch is subtree of target (#1065) ...

When cJSONUtils_MergePatch(target, patch) is called with a non-object
patch (scalar, array, or NULL) that happens to be a subtree of target,
merge_patch() called cJSON_Delete(target) first, which freed the patch
memory, and then cJSON_Duplicate(patch, 1) read the already-freed memory,
triggering a heap-use-after-free (detected by AddressSanitizer at
cJSON_Duplicate_rec, cJSON.c:2808).

Fix: duplicate the patch first into a local variable, then delete the
target, then return the duplicate. This matches the Option B approach
proposed in issue #1060.

Verified locally:
- Reproduced the UAF with a minimal PoC under ASan before the fix.
- After the fix the PoC runs cleanly (exit 0, correct result [1,2,3]).
- Added a regression unit test
  (merge_patch_should_not_read_freed_memory_when_patch_is_subtree).
- Full ctest suite passes (22/22 tests).

Fixes #1060

Signed-off-by: lilu <[email protected]>

2026-09-16 09:55:35 +08:00

..

inputs

Remove trailing space

2017-11-04 21:19:15 +08:00

json-patch-tests

Update json-patch-tests

2018-10-11 00:30:43 +02:00

unity

Fix spelling errors found by CodeSpell. See https://github.com/codespell-project/codespell

2024-05-14 09:43:59 +08:00

cjson_add.c

Fix spelling errors found by CodeSpell. See https://github.com/codespell-project/codespell

2024-05-14 09:43:59 +08:00

CMakeLists.txt

Revert "feat: add tests for #842" to fix test failures

2024-06-19 10:58:01 +08:00

common.h

Fix tests when building as static library

2017-11-28 16:44:24 +01:00

compare_tests.c

update testcase, fixes #433

2020-04-02 16:24:10 +08:00

json_patch_tests.c

Typos found by codespell (#607)

2021-08-25 15:01:12 +08:00

minify_tests.c

Fix infinite loop in cJSON_Minify

2019-05-16 20:01:02 +02:00

misc_tests.c

fix: prevent NULL pointer dereference in cJSON_SetNumberHelper (#991)

2026-03-12 19:18:36 +08:00

misc_utils_tests.c

misc_utils_tests: call all utils function with NULL pointers

2017-06-28 16:01:20 +02:00

old_utils_tests.c

Fix: heap-use-after-free in merge_patch when patch is subtree of target (#1065)

2026-09-16 09:55:35 +08:00

parse_array.c

array's item should be in the list

2020-05-06 17:18:42 +08:00

parse_examples.c

Add test for heap buffer overflow

2024-05-06 11:33:33 +08:00

parse_hex4.c

Support default __stdcall calling convention on tests as well

2018-09-12 15:32:30 -05:00

parse_number.c

allocate memory for the temporary buffer

2025-05-07 11:31:28 +08:00

parse_object.c

Support default __stdcall calling convention on tests as well

2018-09-12 15:32:30 -05:00

parse_string.c

Support default __stdcall calling convention on tests as well

2018-09-12 15:32:30 -05:00

parse_value.c

Support default __stdcall calling convention on tests as well

2018-09-12 15:32:30 -05:00

parse_with_opts.c

Support default __stdcall calling convention on tests as well

2018-09-12 15:32:30 -05:00

print_array.c

Support default __stdcall calling convention on tests as well

2018-09-12 15:32:30 -05:00

print_number.c

fix issue#327

2019-11-28 09:56:04 +08:00

print_object.c

Fix spelling errors found by CodeSpell. See https://github.com/codespell-project/codespell

2024-05-14 09:43:59 +08:00

print_string.c

Support default __stdcall calling convention on tests as well

2018-09-12 15:32:30 -05:00

print_value.c

Support default __stdcall calling convention on tests as well

2018-09-12 15:32:30 -05:00

readme_examples.c

docs: fix simple typo, transfering -> transferring (#527)

2020-11-16 08:57:02 +08:00

unity_setup.c

Add newline to end of unity_setup.c

2018-09-17 09:10:20 -05:00