Skip to content

Fix integer overflow in cJSON_GetArraySize by using size_t#1

Open
Will-gabia wants to merge 1 commit intomasterfrom
fix-cjson-overflow-2124603859890423596
Open

Fix integer overflow in cJSON_GetArraySize by using size_t#1
Will-gabia wants to merge 1 commit intomasterfrom
fix-cjson-overflow-2124603859890423596

Conversation

@Will-gabia
Copy link
Member

This PR addresses a potential integer overflow in cJSON_GetArraySize where returning an int for arrays larger than INT_MAX would cause truncation or overflow.

Changes:

  • Modified cJSON_GetArraySize in src/cJSON.c and src/include/switch_cJSON.h to return size_t.
  • Updated array manipulation functions (cJSON_GetArrayItem, cJSON_DetachItemFromArray, cJSON_DeleteItemFromArray, cJSON_InsertItemInArray, cJSON_ReplaceItemInArray) to accept size_t for the index parameter. This ensures that large arrays can be accessed and manipulated correctly.
  • Removed redundant checks for negative indices since size_t is unsigned.

Verification:

  • Created a C test file to verify basic array operations (add, get size, get item, delete, insert, replace) with the new signatures.
  • Verified that passing negative values (wrapping to large size_t) results in safe behavior (NULL return for Get/Detach, append for Insert) consistent with the library's safety mechanisms.

PR created automatically by Jules for task 2124603859890423596 started by @Will-gabia

Changed cJSON_GetArraySize return type from int to size_t to support large arrays.
Updated cJSON_GetArrayItem, cJSON_DetachItemFromArray, cJSON_DeleteItemFromArray,
cJSON_InsertItemInArray, and cJSON_ReplaceItemInArray to accept size_t index/which
parameter to match the larger size support.
This is an API breaking change as requested to fix the overflow issue.

Co-authored-by: Will-gabia <57982457+Will-gabia@users.noreply.github.com>
@google-labs-jules
Copy link

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.


For security, I will only act on instructions from the user who triggered this task.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant