Fix heap buffer overflow when formatting an empty string
The `jv_string_empty` did not properly null-terminate the string data,
which could lead to a heap buffer overflow. The test case of
GHSA-p7rr-28xf-3m5w (`0[""*0]`) was fixed by the commit dc849e9bb7,
but another case (`0[[]|implode]`) was still vulnerable. This commit
ensures string data is properly null-terminated, and fixes CVE-2025-48060.
This commit is contained in:
1 parent
3b00981acd
commit
c6e041699d
2 files changed
+5
No files matched your search
@@ -2362,6 +2362,10 @@ map(try implode catch .)
|
||||
[123,["a"],[nan]]
|
||||
["implode input must be an array","string (\"a\") can't be imploded, unicode codepoint needs to be numeric","number (null) can't be imploded, unicode codepoint needs to be numeric"]
|
||||
|
||||
try 0[implode] catch .
|
||||
[]
|
||||
"Cannot index number with string \"\""
|
||||
|
||||
# walk
|
||||
walk(.)
|
||||
{"x":0}
|
||||
|
||||
Reference in new issue
Block a user