CVE-2023-50471

Se descubrió que cJSON v1.7.16 contenía una infracción de segmentación a través de la función cJSON_InsertItemInArray en cJSON.c.

A flaw was discovered in the cJSON package. Certain input conditions may trigger a null pointer dereference, which can lead to a denial of service.

An update that fixes three vulnerabilities is now available. This update for cJSON fixes the following issues. NULL pointer dereference via cJSON_SetValuestring Remove non-functional list handling of compiler flags. Fixed heap buffer overflow remove misused optimization flag -01 Set free'd pointers to NULL whenever they are not reassigned immediately after CVE-2023-50471). Fixed null reference in cJSON_SetValuestring. Fixed null reference in cJSON_InsertItemInArray. Add an option for ENABLE_CJSON_VERSION_SO in CMakeLists.txt Add cmake_policy to CMakeLists.txt Add cJSON_SetBoolValue Add meson documentation. Fixed memory leak in merge_patch. Fixed conflicting target names 'uninstall' Bump cmake version to 3.0 and use new version syntax Print int without decimal places. Fixed 'cjson_utils-static' target not exist Add allocate check for replace_item_in_object. Fixed a null pointer crash in cJSON_ReplaceItemViaPointer.