Fix heap buffer overflow when formatting an empty string

The `jv_string_empty` did not properly null-terminate the string data,
which could lead to a heap buffer overflow. The test case of
GHSA-p7rr-28xf-3m5w (`0[""*0]`) was fixed by the commit dc849e9bb7,
but another case (`0[[]|implode]`) was still vulnerable. This commit
ensures string data is properly null-terminated, and fixes CVE-2025-48060.
This commit is contained in:
itchyny committed 2025-05-31 11:46:40 +09:00
1 parent 3b00981acd
commit c6e041699d
2 files changed
+5

No files matched your search

+4
View File
@@ -2362,6 +2362,10 @@ map(try implode catch .)
[123,["a"],[nan]]
["implode input must be an array","string (\"a\") can't be imploded, unicode codepoint needs to be numeric","number (null) can't be imploded, unicode codepoint needs to be numeric"]
try 0[implode] catch .
[]
"Cannot index number with string \"\""
# walk
walk(.)
{"x":0}