-
Notifications
You must be signed in to change notification settings - Fork 3.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
An infinite loop found in cJSON_DeleteItemFromObjectCaseSensitive #807
Comments
Interesting find. I boiled the POC down a bit:
Specifically, the circular reference is created in But aside from this analysis, I'm not sure what the best course of action on this would be. |
Adding the same item to object for more than one time is a broken use of cJSON* root = cJSON_CreateObject();
cJSON* item1 = cJSON_CreateNumber(42);
cJSON* item2 = cJSON_CreateNumber(42);
cJSON_AddItemToObject(root, "item1", item1);
cJSON_AddItemToObject(root, "item2", item2);
cJSON_AddItemToObject(root, "item3", item1); // circular reference
cJSON_Print(root); To prevent this, we need to check all items in a object/array if the added item already exist when adding a item to a object/array. No doubt this will cause performance problems. I can't find a elegant enough solution. Ideas? |
Hi,
when fuzzing cJSON, there is a timeout reported by ASAN. There might is an infinite loop bug in cJSON_DeleteItemFromObjectCaseSensitive.
My environment:
CentOS 5.4
PoC:
poc.tar.gz
The text was updated successfully, but these errors were encountered: