[bg0d-droid]

Summary

Two failure classes in cJSON_Utils.c turn a simple allocation failure into a crash or a leak:

1. NULL-pointer writes (crash). The path-building helpers use the result of cJSON_malloc without checking it and then write into it with sprintf/strcat. Any allocation failure segfaults the process. Affected: compose_patch(), create_patches() (array and object branches) and cJSONUtils_FindPointerFromObjectTo() (array and object branches).

2. Leaked values on failed insertion. cJSON_AddItemToObject()/cJSON_AddItemToArray() leave the item caller-owned when they fail (e.g. when duplicating the key runs out of memory), but several call sites ignored the result and dropped or never took ownership of the value:

   • merge_patch() — the detached replacement subtree (and the recreated target object could be NULL and was used unchecked)
   • apply_patch() — the duplicated patch value (value = NULL was set unconditionally after the add)
   • generate_merge_patch() — the created null / duplicated / recursively generated patch entries
   • compose_patch() — the created op/path/value strings

Changes

All in cJSON_Utils.c: check every cJSON_malloc result and fail cleanly; only transfer ownership of a value when the add actually succeeded, releasing the orphaned value otherwise (NULL return from the generators, or the existing status-code convention with goto cleanup in apply_patch()).

tests/utils_oom_tests.c (plus one line in tests/CMakeLists.txt) is a regression test that routes all cJSON allocations through cJSON_InitHooks and injects a failure at every allocation step of the patch, merge, and pointer operations, asserting after each attempt that nothing remains allocated.

Reproduction (unpatched)

The regression test segfaults against the unpatched code:

$ ./tests/utils_oom_tests
Segmentation fault (exit 139)

Found with allocation-failure injection: a sweep that fails each allocation of a call in turn produced 41 crashing or leaking injection points across cJSONUtils_GeneratePatches/ApplyPatches/MergePatch/GenerateMergePatch/FindPointerFromObjectTo (LeakSanitizer traces show the leaked subtree in merge_patch/apply_patch/generate_merge_patch, and the NULL-write stacks point into sprintf on the unchecked cJSON_malloc results).

Testing

• tests/utils_oom_tests passes after this fix (5 cases × 120 injection points each) and segfaults before it.
• Full suite passes: 23/23 (ctest).
• The same allocation-failure sweep is clean after the fix: 3,300 injection points across 11 scenarios (parse, invalid input, deep nesting, partial input, printing, builders, duplicate/compare, patch, merge, pointer) under ASan/LSan/UBSan with zero leaks and zero crashes.