cocos2d-x
cocos2d-x copied to clipboard
Fix: buffer overflow vulnerability in Json::parseString
Description of the Change: This PR fixes a buffer overflow vulnerability (CVE-2016-4303) in the Json::parseString function. The fix addresses improper handling of UTF-16 surrogate pairs during JSON string conversion, preventing potential heap corruption and arbitrary code execution. This vulnerability was identified in the cloned function and was not patched after cJSON's original fix.
Key improvements: Added robust buffer allocation for UTF-8 character expansion Implemented comprehensive bounds checking Enhanced error handling and input validation
References CVE-2016-4303 Original Patch: https://github.com/esnet/iperf/commit/91f2fa59e8ed80dfbf400add0164ee0e508e412a