| शीर्षक | marcobambini gravity v0.9.7 Out-of-bounds Pointer Arithmetic |
|---|
| विवरण | The recursive-descent JSON parser scans its input with for (state.ptr = json; ; ++state.ptr) (src/utils/gravity_json.c:640) and performs an unconditional post-increment at the end of every iteration. When the input is malformed and the parser is still in a scanning state at the end of the buffer (e.g. an unterminated string/comment or a truncated literal), the end-of-buffer guard makes b read as 0 but the loop still runs ++state.ptr, advancing the pointer past the one-past-the-end pointer of the array. Forming that out-of-range pointer is itself undefined behavior, which UBSan's pointer-overflow check reports as pointer arithmetic overflowed bounds.
Affected versions: Gravity v0.9.7 / HEAD 17a280b83c10424597bf4d130d208b72de731c2a
Severity: Medium (undefined pointer arithmetic; mis-scans memory; SIGILL DoS in UBSan builds)
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) |
|---|
| स्रोत | ⚠️ https://github.com/marcobambini/gravity/issues/448 |
|---|
| उपयोगकर्ता | lrrh (UID 100159) |
|---|
| सबमिशन | 08/08/2026 09:59 AM (1 महीना पहले) |
|---|
| संयम | 13/09/2026 11:53 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403268 [marcobambini Gravity तक 0.9.7 JSON parser src/utils/gravity_json.c बफ़र ओवरफ़्लो] |
|---|
| अंक | 20 |
|---|