| Título | tencent RapidJSON 1.1.0 Out-of-Bounds Read |
|---|
| Descripción | A heap-buffer-overflow (out-of-bounds read) vulnerability exists in RapidJSON v1.1.0 when parsing floating-point numbers with kParseFullPrecisionFlag. An integer underflow in decimalPosition leads to an out-of-bounds array access in GetCachedPowerByIndex().
Vulnerability Location:
- File: include/rapidjson/internal/diyfp.h
- Function: GetCachedPowerByIndex()
- Line: 223
Root Cause:
During full-precision float parsing, the decimalPosition value underflows to 0xFFFFFFFFFFFFFFF0 (-16). This value is passed to StrtodDiyFp(), which computes an array index of 536870895. The kCachedPowers_F array only has about 87 elements, causing an out-of-bounds read.
PoC (46 bytes):
"1.1" followed by 192 zeros triggers the crash.
ASan Report:
ERROR: AddressSanitizer: SEGV on unknown address 0x58d6267d2c08
#0 GetCachedPowerByIndex(index=536870895) at diyfp.h:223
#1 StrtodDiyFp() at strtod.h:154
#2 StrtodFullPrecision() at strtod.h:259
#3 ParseNumber<16u>() at reader.h:1362
GDB Evidence:
r13 = 0x1999999999999999 (underflow artifact)
Independence Statement:
This vulnerability is independent from CVE-2024-38517:
- Crash point: diyfp.h:223 vs reader.h ParseNumber()
- Trigger: requires kParseFullPrecisionFlag vs default parsing mode
- Affected: v1.1.0 (latest) vs v1.0.0
Impact:
- Denial of Service (DoS)
- Potential information disclosure
GitHub Issue: https://github.com/Tencent/rapidjson/issues/2405 |
|---|
| Fuente | ⚠️ https://github.com/Tencent/rapidjson/issues/2401 |
|---|
| Usuario | shuidajiao (UID 102056) |
|---|
| Sumisión | 2026-10-16 12:53 (hace 23 días) |
|---|
| Moderación | 2026-11-08 21:24 (23 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 433010 [Tencent RapidJSON 1.1.0 diyfp.h GetCachedPowerByIndex decimalPosition divulgación de información] |
|---|
| Puntos | 20 |
|---|