All pull requests

Pull requests

• Fix setvaluestring ptr compare

  #1132·kanishk25249-sudo opened Nov 9, 2026·

  ·
  1

  1

• Fix: avoid strict-aliasing violation in parse_number

  #1131·YikunWei-dev opened Nov 9, 2026·

  ·

• Fix: reject invalid \uXXXX escape sequences

  #1130·YikunWei-dev opened Nov 9, 2026·

  ·

• Don't read from a zero-length buffer when growing print output

  #1129·ck0i opened Nov 8, 2026·

  ·
  1

• cJSON_Print: add CJSON_PRINT_LIMIT to bound the output buffer size

  #1128·gsmarcil opened Nov 5, 2026·

  ·

• cJSON_Utils: respect item ownership when a JSON Patch targets the root

  #1127·gsmarcil opened Nov 5, 2026·

  ·

• cjson: Add new fuzzer/corpus/dict targets input utils

  #1126·arthurscchan opened Nov 4, 2026·

  ·

• OSS-Fuzz: Add new fuzzer/corpus/dict targets builder process

  #1125·arthurscchan opened Nov 4, 2026·

  ·

• OSS-Fuzz: Add corpus generation and dict for json fuzzer

  #1124·arthurscchan opened Nov 4, 2026·

  ·

• cJSON: avoid undefined behavior when assigning NaN to valueint

  #1123·akashdeshmukh-git opened Nov 3, 2026·

  ·
  1

• honor case_sensitive in detach_path for object members

  #1121·nabhan06 opened Oct 27, 2026·

  ·

• utils: fix decode_pointer_inplace dropping bytes after escapes (CVE-2026-29036)

  #1120·w4ffl35 opened Oct 27, 2026·

  ·

• tests: regression test for object-patch-subtree-of-array merge_patch UAF (companion to #1109)

  #1119·w4ffl35 opened Oct 27, 2026·

  ·

• fuzzing: add a fuzzer for cJSON_Utils

  #1118·0xalpharush opened Oct 27, 2026·

  ·

• Guard print_string_ptr counters against 32-bit overflow (CVE-2026-16554)

  #1117·w4ffl35 opened Oct 26, 2026·

  ·

• Bound cJSON_Compare cost: sort-based objects, depth cap (CVE-2026-67216)

  #1116·w4ffl35 opened Oct 26, 2026·

  ·

• Cap JSON Patch graft depth at the nesting limit (CVE-2026-67215)

  #1115·w4ffl35 opened Oct 26, 2026·

  ·

• Apply JSON Patch arrays atomically (CVE-2026-67217)

  #1114·w4ffl35 opened Oct 26, 2026·

  ·

• cJSON_ReplaceItemViaPointer: reject items with NULL prev to prevent list corruption

  #1113·akashdeshmukh-git opened Oct 23, 2026·

  ·

• cmake: use relative install destinations for relocatable package exports

  #1112·akashdeshmukh-git opened Oct 23, 2026·

  ·
  1

• handle multi-byte locale decimal points in parse_number and print_number

  #1111·nabhan06 opened Oct 21, 2026·

  ·

• Fix: compare_double mishandles infinities (#1071)

  #1110·zhouyunding opened Oct 20, 2026·

  ·
  1

  1

• Fix: heap-use-after-free in merge_patch when target is not an object and contains patch (Variant of what #1060 fixed)

  #1109·Oculytic opened Oct 19, 2026·

  ·
  3

• reject numbers that are not valid JSON in parse_number

  #1108·nabhan06 opened Oct 18, 2026·

  ·

• Fix NaN conversion in cJSON_SetNumberHelper

  #1107·Yash-Petkar opened Oct 17, 2026·

  ·