From cf1842dc6f64c49451a022308b4415e4d468be0a Mon Sep 17 00:00:00 2001
From: Max Bruckner <max@maxbruckner.de>
Date: Wed, 15 Mar 2017 00:09:45 +0100
Subject: [PATCH] fix: print_number didn't abort when out of memory

---
 cJSON.c | 44 +++++++++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 21 deletions(-)

diff --git a/cJSON.c b/cJSON.c
index 67804b2..1c44742 100644
--- a/cJSON.c
+++ b/cJSON.c
@@ -372,28 +372,30 @@ static cJSON_bool print_number(const cJSON * const item, printbuffer * const out
 
     /* This is a nice tradeoff. */
     output_pointer = ensure(output_buffer, 64, hooks);
-    if (output_pointer != NULL)
+    if (output_pointer == NULL)
     {
-        /* This checks for NaN and Infinity */
-        if ((d * 0) != 0)
-        {
-            length = sprintf((char*)output_pointer, "null");
-        }
-        else if ((fabs(floor(d) - d) <= DBL_EPSILON) && (fabs(d) < 1.0e60))
-        {
-            /* integer */
-            length = sprintf((char*)output_pointer, "%.0f", d);
-            trim_zeroes = false; /* don't remove zeroes for "big integers" */
-        }
-        else if ((fabs(d) < 1.0e-6) || (fabs(d) > 1.0e9))
-        {
-            length = sprintf((char*)output_pointer, "%e", d);
-            trim_zeroes = false; /* don't remove zeroes in engineering notation */
-        }
-        else
-        {
-            length = sprintf((char*)output_pointer, "%f", d);
-        }
+        return false;
+    }
+
+    /* This checks for NaN and Infinity */
+    if ((d * 0) != 0)
+    {
+        length = sprintf((char*)output_pointer, "null");
+    }
+    else if ((fabs(floor(d) - d) <= DBL_EPSILON) && (fabs(d) < 1.0e60))
+    {
+        /* integer */
+        length = sprintf((char*)output_pointer, "%.0f", d);
+        trim_zeroes = false; /* don't remove zeroes for "big integers" */
+    }
+    else if ((fabs(d) < 1.0e-6) || (fabs(d) > 1.0e9))
+    {
+        length = sprintf((char*)output_pointer, "%e", d);
+        trim_zeroes = false; /* don't remove zeroes in engineering notation */
+    }
+    else
+    {
+        length = sprintf((char*)output_pointer, "%f", d);
     }
 
     /* sprintf failed */