buffer_skip_whitespace skips any byte <= 32, so NUL, 0x01, 0x0b, 0x1f, and every other control byte are accepted as whitespace between tokens. JSON whitespace is only space, tab, LF, and CR. With cJSON_ParseWithLengthOpts the NUL case is reachable too:
cJSON_ParseWithLengthOpts("[\x0b1]", 5, NULL, 1); /* [1] */
cJSON_ParseWithLengthOpts("[\x011]", 5, NULL, 1); /* [1] */
cJSON_ParseWithLengthOpts("\x00null", 6, NULL, 1); /* null */Form feed is in the JSONTestSuite list in #877 and control characters inside strings are #871; the other bytes between tokens are not in either. Found on v1.7.19 with a property that splices one control byte at a random offset of a valid document. A fix is to accept only ' ', '\t', '\n', '\r' in that loop.
buffer_skip_whitespaceskips any byte<= 32, so NUL, 0x01, 0x0b, 0x1f, and every other control byte are accepted as whitespace between tokens. JSON whitespace is only space, tab, LF, and CR. WithcJSON_ParseWithLengthOptsthe NUL case is reachable too:Form feed is in the JSONTestSuite list in #877 and control characters inside strings are #871; the other bytes between tokens are not in either. Found on v1.7.19 with a property that splices one control byte at a random offset of a valid document. A fix is to accept only
' ','\t','\n','\r'in that loop.