Skip to content

Conversation

@PeterAlfredLee
Copy link
Contributor

Currently a temporary buffer with size of 64 is used when parsing numbers. Long numbers with length of 64 or more could not be correctly parsed, as CVE-2023-26819 described.

This PR allocate memory for the temporary buffer when paring numbers.
This also fixes CVE-2023-26819.

Allocate memory for the temporary buffer when paring numbers.
This fixes CVE-2023-26819
@Alanscut Alanscut merged commit 8f2beb5 into DaveGamble:master May 7, 2025
13 checks passed
@mahavirj
Copy link

mahavirj commented May 7, 2025

@Alanscut Would there be a new cJSON release that includes this fix - any time soon?

@DL6ER
Copy link
Contributor

DL6ER commented Sep 9, 2025

I have been sent here from the release notes ein would like to question the general usage of heap memory introduced through this change. We know that this effects performance in a bad way.

How do you feel about a conditional decision if we need to allocate memory or if we can go with the fixed 64 characters buffer? I also wonder if memory allocation is needed at all? How about simply increasing the buffer's size? Do we really expect numbers larger than, say, 256 characters?

If we want to keep the current change, are we sure that number_string_length, fed to allocate cannot grow infinitely?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants