cocos2d-x icon indicating copy to clipboard operation
cocos2d-x copied to clipboard

Fix: buffer overflow vulnerability in Json::parseString

Open yannaingtun opened this issue 9 months ago • 0 comments

Description of the Change: This PR fixes a buffer overflow vulnerability (CVE-2016-4303) in the Json::parseString function. The fix addresses improper handling of UTF-16 surrogate pairs during JSON string conversion, preventing potential heap corruption and arbitrary code execution. This vulnerability was identified in the cloned function and was not patched after cJSON's original fix.

Key improvements: Added robust buffer allocation for UTF-8 character expansion Implemented comprehensive bounds checking Enhanced error handling and input validation

References CVE-2016-4303 Original Patch: https://github.com/esnet/iperf/commit/91f2fa59e8ed80dfbf400add0164ee0e508e412a

yannaingtun avatar Feb 26 '25 21:02 yannaingtun