Fix heap-buffer-overflow in raw file loading
When `jv_string_append_buf` overflows the string length limit, it returns an invalid `jv`; `jv_load_file` then re-entered it on the invalid value and overran the heap. Break out of the loop once the value is invalid. Fixes CVE-2026-49839.
This commit is contained in:
1 parent
985abe534f
commit
e987df0d46
1 file changed
+2
@@ -57,6 +57,8 @@ jv jv_load_file(const char* filename, int raw) {
|
|||||||
|
|
||||||
if (raw) {
|
if (raw) {
|
||||||
data = jv_string_append_buf(data, buf, n);
|
data = jv_string_append_buf(data, buf, n);
|
||||||
|
if (!jv_is_valid(data))
|
||||||
|
break;
|
||||||
} else {
|
} else {
|
||||||
jv_parser_set_buf(parser, buf, n, !feof(file));
|
jv_parser_set_buf(parser, buf, n, !feof(file));
|
||||||
jv value;
|
jv value;
|
||||||
|
|||||||
Reference in new issue
Block a user