-
Notifications
You must be signed in to change notification settings - Fork 3.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
bug for cJSON_SetValuestring #803
Comments
Looks this issue got a CVE assigned, CVE-2023-50472 |
My POC if I'm understanding this problem correctly: cJSON *corruptedItem = cJSON_CreateString("corrupted");
corruptedItem->valuestring = NULL;
return_value = cJSON_SetValuestring(corruptedItem, "test"); |
Add NULL checkings in cJSON_InsertItemInArray and cJSON_SetValuestring Fixing DaveGamble#802(CVE-2023-50471) and DaveGamble#803(CVE-2023-50472)
Why is this considered a security issue? This crosses no security boundary, it only lacks sanity handling for broken use of a function? |
@mmuehlenhoff FWIW, I do not know, I'm not related with requesting the CVE, I was just relaying it here after doing some CVE triage in a downstream distribution. It might be sensible to ask the assigning CNA for rejection if the issue is not considered valid security issue. |
Description
If the the object passed in cJSON_SetValuestring dont have
valuestring
, theobject->valuestring
will be null. The null pointer dereference will cause SEGV in function cJSON_SetValuestring cJSON.c:408Version
Related Code
Impact
Potentially causing DoS
The text was updated successfully, but these errors were encountered: