[Security] JSON Pointer ~1 decoding error vulnerability inside decode_pointer_inplace

[eglonnnn]

Title: JSON Pointer ~1 decoding error in cJSON decode_pointer_inplace

---

Description

A logic error in cJSON's JSON Pointer decoder. When decode_pointer_inplace() processes a ~1 escape sequence (which should decode to / per RFC 6901), it writes the decoded / to an incorrect position — decoded_string[1] instead of the current output cursor. As a result, ~1 is decoded as ~/ instead of /, causing cJSONUtils_ApplyPatches() to target the wrong key.

Impact

• cJSONUtils_GetPointer() / cJSONUtils_ApplyPatches() resolve incorrect keys
• Data integrity issue when processing JSON Patch operations from untrusted sources

Reproduction

All materials are available in my research repository:

https://github.com/eglonnnn/opensource-fuzz-vulnerability-research/tree/main/JSON%20Pointer%20~1%20decoding%20error%20in%20cJSON%20decode_pointer_inplace

[yayong3]

Confirming on 1.7.19. One correction and a short in-tree repro:

cJSONUtils_GetPointer / GetPointerCaseSensitive do not call decode_pointer_inplace. They walk with compare_pointers, which already treats ~1 as /. On {"a/b":1}, GetPointer(..., "/a~1b") finds the member.

The broken callers are detach_path and apply_patch (JSON Patch). Those decode the last path token in place, then look it up as a plain object key. After the bad ~1 store, the key is not a/b, so remove / replace miss.

#include <stdio.h>
#include "cJSON.h"
#include "cJSON_Utils.h"

int main(void)
{
    cJSON *root = cJSON_Parse("{\"a/b\":1}");
    cJSON *patches = cJSON_Parse("[{\"op\":\"remove\",\"path\":\"/a~1b\"}]");
    cJSON *found = cJSONUtils_GetPointerCaseSensitive(root, "/a~1b");
    int status = cJSONUtils_ApplyPatchesCaseSensitive(root, patches);

    printf("GetPointer: %s\n", found ? "found" : "NULL");
    printf("ApplyPatches remove: %d (0 = success)\n", status);
    printf("key still present: %s\n",
           cJSON_GetObjectItemCaseSensitive(root, "a/b") ? "yes" : "no");

    cJSON_Delete(root);
    cJSON_Delete(patches);
    return 0;
}

Observed:

GetPointer: found
ApplyPatches remove: 13 (0 = success)
key still present: yes