Repository navigation
Conversation
…and contains patch
When cJSONUtils_MergePatch(target, patch) is called with an object
patch that is a subtree of a non-object target (for example, target
is the array [{"a":1}] and patch is its element), merge_patch() called
cJSON_Delete(target), which also freed patch, and then read
patch->child, triggering a heap-use-after-free.
This is the same situation as DaveGamble#1060, fixed in 6d9f244 for non-object
patches; that fix did not cover the branch where the patch is an
object and the target is not.
Fix: in that branch, duplicate the patch and create the new object
before deleting target, then merge from the copy into the new object
and free the copy. On allocation failure, free both and return NULL
without touching target.
Reproducer:
cJSON *target = cJSON_Parse("[{\"a\":1}]");
cJSON *patch = target->child;
cJSON *out = cJSONUtils_MergePatch(target, patch);
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When
cJSONUtils_MergePatch(target, patch)is called with an object patch that is a subtree of a non-object target (for example, target is the array[{"a":1}]and patch is its element),merge_patch()calledcJSON_Delete(target), which also freed patch, and then readpatch->child, triggering a heap-use-after-free.This is the same situation as #1060, fixed in 6d9f244 for non-object patches; that fix did not cover the branch where the patch is an object and the target is not.
Fix: in that branch, duplicate the patch and create the new object before deleting target, then merge from the copy into the new object and free the copy. On allocation failure, free both and return NULL without touching target.
Reproducer: