Fix heap-buffer-overflow in raw file loading
When `jv_string_append_buf` overflows the string length limit, it returns an invalid `jv`; `jv_load_file` then re-entered it on the invalid value and overran the heap. Break out of the loop once the value is invalid. Fixes CVE-2026-49839.
This commit is contained in:
1 parent
985abe534f
commit
e987df0d46
1 file changed
+2
@@ -57,6 +57,8 @@ jv jv_load_file(const char* filename, int raw) {
|
||||
|
||||
if (raw) {
|
||||
data = jv_string_append_buf(data, buf, n);
|
||||
if (!jv_is_valid(data))
|
||||
break;
|
||||
} else {
|
||||
jv_parser_set_buf(parser, buf, n, !feof(file));
|
||||
jv value;
|
||||
|
||||
Reference in new issue
Block a user