Merge 24aeeb340f into c859b25da0

this fixes CVE-2025-57052

CHANGELOG.md

@@ -1,3 +1,15 @@
+1.7.19 (Sep 9, 2025)
+======
+Fixes:
+------
+* Fix indentation (should use spaces), see #814
+* Fix spelling errors found by CodeSpell, see #841
+* Check for NULL in cJSON_DetachItemViaPointer, fixes #882, see #886
+* Fix #881, check overlap before calling strcpy in cJSON_SetValuestring, see #885
+* Fix #880 Max recursion depth for cJSON_Duplicate to prevent stack exhaustion, see #888
+* Allocate memory for the temporary buffer when paring numbers, see #939
+* fix the incorrect check in decode_array_index_from_pointer, see #957
+
 1.7.18 (May 13, 2024)
 ======
 Fixes:

CMakeLists.txt

@@ -2,7 +2,7 @@ set(CMAKE_LEGACY_CYGWIN_WIN32 0)
 cmake_minimum_required(VERSION 3.0)
 
 project(cJSON
-    VERSION 1.7.18
+    VERSION 1.7.19
     LANGUAGES C)
 
 cmake_policy(SET CMP0054 NEW)  # set CMP0054 policy

CONTRIBUTORS.md

@@ -24,6 +24,7 @@ Contributors:
 * [Debora Grosse](https://github.com/DeboraG)
 * [dieyushi](https://github.com/dieyushi)
 * [Dōngwén Huáng (黄东文)](https://github.com/DongwenHuang)
+* [Dominik](https://github.com/DL6ER)
 * [Donough Liu](https://github.com/ldm0)
 * [Erez Oxman](https://github.com/erez-o)
 * Eswar Yaganti
@@ -80,6 +81,8 @@ Contributors:
 * [Stephan Gatzka](https://github.com/gatzka)
 * [Tony Langhammer](https://github.com/BigBrainAFK)
 * [Vemake](https://github.com/vemakereporter)
+* [vwvw](https://github.com/vwvw)
+* [warmsocks](https://github.com/warmsocks)
 * [Wei Tan](https://github.com/tan-wei)
 * [Weston Schmidt](https://github.com/schmidtw)
 * [xiaomianhehe](https://github.com/xiaomianhehe)

Makefile

@@ -8,7 +8,7 @@ CJSON_TEST_SRC = cJSON.c test.c
 
 LDLIBS = -lm
 
-LIBVERSION = 1.7.18
+LIBVERSION = 1.7.19
 CJSON_SOVERSION = 1
 UTILS_SOVERSION = 1
 

cJSON.c

@@ -117,7 +117,7 @@ CJSON_PUBLIC(double) cJSON_GetNumberValue(const cJSON * const item)
 }
 
 /* This is a safeguard to prevent copy-pasters from using incompatible C and header files */
-#if (CJSON_VERSION_MAJOR != 1) || (CJSON_VERSION_MINOR != 7) || (CJSON_VERSION_PATCH != 18)
+#if (CJSON_VERSION_MAJOR != 1) || (CJSON_VERSION_MINOR != 7) || (CJSON_VERSION_PATCH != 19)
     #error cJSON.h and cJSON.c have different versions. Make sure that both have the same.
 #endif
 
@@ -1592,6 +1592,7 @@ static cJSON_bool print_array(const cJSON * const item, printbuffer * const outp
     unsigned char *output_pointer = NULL;
     size_t length = 0;
     cJSON *current_element = item->child;
+    size_t i;
 
     if (output_buffer == NULL)
     {
@@ -1610,6 +1611,25 @@ static cJSON_bool print_array(const cJSON * const item, printbuffer * const outp
     output_buffer->offset++;
     output_buffer->depth++;
 
+    if (output_buffer->format)
+    {
+        output_pointer = ensure(output_buffer, output_buffer->depth + 1);
+        if (output_pointer == NULL)
+        {
+            return false;
+        }
+
+        *output_pointer++ = '\n';
+
+        for (i = 0; i < output_buffer->depth; i++)
+        {
+            *output_pointer++ = '\t';
+        }
+
+        output_buffer->offset += output_buffer->depth + 1;
+    }
+
+
     while (current_element != NULL)
     {
         if (!print_value(current_element, output_buffer))
@@ -1620,7 +1640,7 @@ static cJSON_bool print_array(const cJSON * const item, printbuffer * const outp
         if (current_element->next)
         {
             length = (size_t) (output_buffer->format ? 2 : 1);
-            output_pointer = ensure(output_buffer, length + 1);
+            output_pointer = ensure(output_buffer, length);
             if (output_pointer == NULL)
             {
                 return false;
@@ -1636,6 +1656,24 @@ static cJSON_bool print_array(const cJSON * const item, printbuffer * const outp
         current_element = current_element->next;
     }
 
+    if (output_buffer->format)
+    {
+        output_pointer = ensure(output_buffer, output_buffer->depth);
+        if (output_pointer == NULL)
+        {
+            return false;
+        }
+
+        *output_pointer++ = '\n';
+
+        for (i = 0; i < output_buffer->depth - 1; i++)
+        {
+            *output_pointer++ = '\t';
+        }
+
+        output_buffer->offset += output_buffer->depth;
+    }
+
     output_pointer = ensure(output_buffer, 2);
     if (output_pointer == NULL)
     {
@@ -1771,6 +1809,7 @@ static cJSON_bool print_object(const cJSON * const item, printbuffer * const out
 {
     unsigned char *output_pointer = NULL;
     size_t length = 0;
+    size_t i;
     cJSON *current_item = item->child;
 
     if (output_buffer == NULL)
@@ -1779,20 +1818,48 @@ static cJSON_bool print_object(const cJSON * const item, printbuffer * const out
     }
 
     /* Compose the output: */
-    length = (size_t) (output_buffer->format ? 2 : 1); /* fmt: {\n */
-    output_pointer = ensure(output_buffer, length + 1);
-    if (output_pointer == NULL)
-    {
-        return false;
-    }
-
-    *output_pointer++ = '{';
-    output_buffer->depth++;
     if (output_buffer->format)
     {
+        /* Compose the output: */
+        length = (size_t) (output_buffer->depth ? output_buffer->depth + 1: 0) + 2 ; /* fmt: { more \t \n */
+        output_pointer = ensure(output_buffer, length + 1);
+        if (output_pointer == NULL)
+        {
+            return false;
+        }
+
+        if(output_buffer->depth)
+        {
+            *output_pointer++ = '\n';
+        }
+
+        for (i = 0; i < output_buffer->depth; i++)
+        {
+            *output_pointer++ = '\t';
+        }
+
+        *output_pointer++ = '{';
         *output_pointer++ = '\n';
+
+        output_buffer->depth++;
+        output_buffer->offset += length;
+
+    }
+    else
+    {
+        /* Compose the output: */
+        length = (size_t)1; /* fmt: {\n */
+        output_pointer = ensure(output_buffer, length + 1);
+        if (output_pointer == NULL)
+        {
+            return false;
+        }
+
+        *output_pointer++ = '{';
+
+        output_buffer->depth++;
+        output_buffer->offset += length;
     }
-    output_buffer->offset += length;
 
     while (current_item)
     {
@@ -1827,7 +1894,7 @@ static cJSON_bool print_object(const cJSON * const item, printbuffer * const out
         *output_pointer++ = ':';
         if (output_buffer->format)
         {
-            *output_pointer++ = '\t';
+            *output_pointer++ = ' ';
         }
         output_buffer->offset += length;
 

cJSON.h

@@ -81,7 +81,7 @@ then using the CJSON_API_VISIBILITY flag to "export" the same symbols the way CJ
 /* project version */
 #define CJSON_VERSION_MAJOR 1
 #define CJSON_VERSION_MINOR 7
-#define CJSON_VERSION_PATCH 18
+#define CJSON_VERSION_PATCH 19
 
 #include <stddef.h>
 

cJSON_Utils.c

@@ -282,7 +282,7 @@ static cJSON_bool decode_array_index_from_pointer(const unsigned char * const po
         return 0;
     }
 
-    for (position = 0; (pointer[position] >= '0') && (pointer[0] <= '9'); position++)
+    for (position = 0; (pointer[position] >= '0') && (pointer[position] <= '9'); position++)
     {
         parsed_index = (10 * parsed_index) + (size_t)(pointer[position] - '0');