Undefined-Behavior in function cJSON_SetNumberHelper
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 70/100
Research direction
The bug is in cJSON_SetNumberHelper in cJSON.c. NaN fails both range comparisons, so it reaches the else branch and the (int)number cast is undefined behaviour. Read cJSON_CreateNumber, which the issue cites as the similar case, to see how NaN is handled there. Done when a NaN input no longer casts to int and the valueint result is defined, with a test added under tests/ covering NaN.
Written by the indexing model from the issue text.
Description
CJSON_PUBLIC(double) cJSON_SetNumberHelper(cJSON *object, double number)
{
if (object == NULL)
{
return (double)NAN;
}
if (number >= INT_MAX)
{
object->valueint = INT_MAX;
}
else if (number <= (double)INT_MIN)
{
object->valueint = INT_MIN;
}
else
{
object->valueint = (int)number;
}
return object->valuedouble = number;
}
this UB is similar to that UB: cJSON_CreateNumber when input number is NaN
then cause NAN cast : int(NaN)
- Dominant language
- C
- Stars
- 13k
- Forks
- 3.5k
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from DaveGamble/cJSON
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
DaveGamble/cJSON#1094 · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
DaveGamble/cJSON#1093 ·
-
Use-after-free in cJSONUtils_ApplyPatches when a patch removes the patch arrayPossibly taken @iliasabk claimed this 27 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
DaveGamble/cJSON#1082 ·
-
Use-after-free in cJSON_ReplaceItemInObject when the key is the item's own namePossibly taken @iliasabk claimed this 28 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
DaveGamble/cJSON#1081 ·
-
buffer_skip_whitespace accepts every byte below 0x21 as whitespacePossibly taken @AetherAI3 claimed this 39 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
DaveGamble/cJSON#1074 ·
All issues in DaveGamble/cJSON
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 2 days
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
ChrisTitusTech/dwm-titus#397 ·
Maintainers usually reply within 1 day
-
good first issue help wanted language:fr translation
Difficulty 1/5 1-3 hours Newbie friendliness 85/100
mrvi0/cli-cheatsheet#160 ·
-
Test modules use volatile int for cross-thread flags instead of atomicsPossibly taken @rahimuddin140 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
valkey-io/valkey#4899 · 1 comment ·
Maintainers usually reply within 2 days
-
Profiler (Remotery) leaks a socket for every connection that fails the WebSocket handshakePossibly taken @rthery claimed this today. Opentriage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day