mirror/cJSON
1
0
Fork 0
mirror of https://github.com/DaveGamble/cJSON.git synced 2023-08-10 21:13:26 +03:00
Code Issues Projects Releases Wiki Activity

cJSON_ApplyPatches: Don't allow adding to array out of bounds

Browse Source
This commit is contained in:
Max Bruckner 2017-04-11 17:40:43 +02:00
parent 62ba68fc7d
commit d058a9cd8f
1 changed files with 44 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
cJSON_Utils.c
View File

@ -364,6 +364,44 @@ static int cJSONUtils_Compare(cJSON *a, cJSON *b)
return 0;
}
/* non broken version of cJSON_InsertItemInArray */
static cJSON_bool insert_item_in_array(cJSON *array, size_t which, cJSON *newitem)
{
cJSON *child = array->child;
while (child && (which > 0))
{
child = child->next;
which--;
}
if (which > 0)
{
/* item is after the end of the array */
return 0;
}
if (child == NULL)
{
cJSON_AddItemToArray(array, newitem);
return 1;
}
/* insert into the linked list */
newitem->next = child;
newitem->prev = child->prev;
child->prev = newitem;
/* was it at the beginning */
if (child == array->child)
{
array->child = newitem;
}
else
{
newitem->prev->next = newitem;
}
return 1;
}
static int cJSONUtils_ApplyPatch(cJSON *object, cJSON *patch)
{
cJSON *op = NULL;
@ -505,7 +543,12 @@ static int cJSONUtils_ApplyPatch(cJSON *object, cJSON *patch)
}
else
{
cJSON_InsertItemInArray(parent, atoi((char*)childptr), value);
if (!insert_item_in_array(parent, (size_t)atoi((char*)childptr), value))
{
free(parentptr);
cJSON_Delete(value);
return 10;
}
}
}
else if (cJSON_IsObject(parent))