Fix heap-buffer-overflow in raw file loading

When `jv_string_append_buf` overflows the string length limit,
it returns an invalid `jv`; `jv_load_file` then re-entered it
on the invalid value and overran the heap. Break out of the loop
once the value is invalid.

Fixes CVE-2026-49839.
This commit is contained in:
itchyny committed 2026-06-08 22:15:06 +09:00
1 parent 985abe534f
commit e987df0d46
1 file changed
+2
+2
View File
@@ -57,6 +57,8 @@ jv jv_load_file(const char* filename, int raw) {
if (raw) {
data = jv_string_append_buf(data, buf, n);
if (!jv_is_valid(data))
break;
} else {
jv_parser_set_buf(parser, buf, n, !feof(file));
jv value;