[Security] JSON Pointer ~1 decoding error vulnerability inside decode_pointer_inplace

Open Beginner friendly
#1,050 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
c
Domain
security

Research direction

Start in decode_pointer_inplace(), using the linked research repository's reproduction to observe how a ~1 escape is decoded. Check the behavior through cJSONUtils_GetPointer() and cJSONUtils_ApplyPatches(); done means ~1 resolves to / and patch operations target the intended key.

Written by the indexing model from the issue text.

Description

Title: JSON Pointer ~1 decoding error in cJSON decode_pointer_inplace


Description

A logic error in cJSON's JSON Pointer decoder. When decode_pointer_inplace() processes a ~1 escape sequence (which should decode to / per RFC 6901), it writes the decoded / to an incorrect position — decoded_string[1] instead of the current output cursor. As a result, ~1 is decoded as ~/ instead of /, causing cJSONUtils_ApplyPatches() to target the wrong key.

Impact
  • cJSONUtils_GetPointer() / cJSONUtils_ApplyPatches() resolve incorrect keys
  • Data integrity issue when processing JSON Patch operations from untrusted sources
Reproduction

All materials are available in my research repository:

https://github.com/eglonnnn/opensource-fuzz-vulnerability-research/tree/main/JSON%20Pointer%20~1%20decoding%20error%20in%20cJSON%20decode_pointer_inplace

Dominant language
C
Stars
13k
Forks
3.5k
PR merge metrics
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from DaveGamble/cJSON

All issues in DaveGamble/cJSON

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.