de2287f574
Sync these patches from 24.03 branch: - Fix-a-null-pointer-crash-in-cJSON_ReplaceItemViaPoin.patch - backport-Add-test-for-heap-buffer-overflow.patch - backport-Fix-heap-buffer-overflow.patch - backport-fix-add-allocate-check-for-replace_item_in_object-67.patch - backport-fix-print-int-without-decimal-places-630.patch - backport-Set-free-d-pointers-to-NULL-whenever-they-are-not-re.patch Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
81 lines
2.4 KiB
Diff
81 lines
2.4 KiB
Diff
From b45f48e600671feade0b6bd65d1c69de7899f2be Mon Sep 17 00:00:00 2001
|
|
From: Junbo Zheng <3273070@qq.com>
|
|
Date: Tue, 29 Mar 2022 15:02:59 +0800
|
|
Subject: [PATCH] fix: add allocate check for replace_item_in_object (#675)
|
|
|
|
Signed-off-by: Junbo Zheng <zhengjunbo1@xiaomi.com>
|
|
---
|
|
cJSON.c | 19 ++++++++++++-------
|
|
1 file changed, 12 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/cJSON.c b/cJSON.c
|
|
index c78aac6..524ba46 100644
|
|
--- a/cJSON.c
|
|
+++ b/cJSON.c
|
|
@@ -96,9 +96,9 @@ CJSON_PUBLIC(const char *) cJSON_GetErrorPtr(void)
|
|
return (const char*) (global_error.json + global_error.position);
|
|
}
|
|
|
|
-CJSON_PUBLIC(char *) cJSON_GetStringValue(const cJSON * const item)
|
|
+CJSON_PUBLIC(char *) cJSON_GetStringValue(const cJSON * const item)
|
|
{
|
|
- if (!cJSON_IsString(item))
|
|
+ if (!cJSON_IsString(item))
|
|
{
|
|
return NULL;
|
|
}
|
|
@@ -106,9 +106,9 @@ CJSON_PUBLIC(char *) cJSON_GetStringValue(const cJSON * const item)
|
|
return item->valuestring;
|
|
}
|
|
|
|
-CJSON_PUBLIC(double) cJSON_GetNumberValue(const cJSON * const item)
|
|
+CJSON_PUBLIC(double) cJSON_GetNumberValue(const cJSON * const item)
|
|
{
|
|
- if (!cJSON_IsNumber(item))
|
|
+ if (!cJSON_IsNumber(item))
|
|
{
|
|
return (double) NAN;
|
|
}
|
|
@@ -511,7 +511,7 @@ static unsigned char* ensure(printbuffer * const p, size_t needed)
|
|
|
|
return NULL;
|
|
}
|
|
-
|
|
+
|
|
memcpy(newbuffer, p->buffer, p->offset + 1);
|
|
p->hooks.deallocate(p->buffer);
|
|
}
|
|
@@ -1107,7 +1107,7 @@ CJSON_PUBLIC(cJSON *) cJSON_ParseWithLengthOpts(const char *value, size_t buffer
|
|
}
|
|
|
|
buffer.content = (const unsigned char*)value;
|
|
- buffer.length = buffer_length;
|
|
+ buffer.length = buffer_length;
|
|
buffer.offset = 0;
|
|
buffer.hooks = global_hooks;
|
|
|
|
@@ -2361,6 +2361,11 @@ static cJSON_bool replace_item_in_object(cJSON *object, const char *string, cJSO
|
|
cJSON_free(replacement->string);
|
|
}
|
|
replacement->string = (char*)cJSON_strdup((const unsigned char*)string, &global_hooks);
|
|
+ if (replacement->string == NULL)
|
|
+ {
|
|
+ return false;
|
|
+ }
|
|
+
|
|
replacement->type &= ~cJSON_StringIsConst;
|
|
|
|
return cJSON_ReplaceItemViaPointer(object, get_object_item(object, string, case_sensitive), replacement);
|
|
@@ -2693,7 +2698,7 @@ CJSON_PUBLIC(cJSON *) cJSON_CreateStringArray(const char *const *strings, int co
|
|
if (a && a->child) {
|
|
a->child->prev = n;
|
|
}
|
|
-
|
|
+
|
|
return a;
|
|
}
|
|
|
|
--
|
|
2.9.3.windows.1
|
|
|