| タイトル | tencent RapidJSON 1.1.0 Out-of-Bounds Read |
|---|
| 説明 | A heap-buffer-overflow (out-of-bounds read) vulnerability exists in RapidJSON v1.1.0 when parsing floating-point numbers with kParseFullPrecisionFlag. An integer underflow in decimalPosition leads to an out-of-bounds array access in GetCachedPowerByIndex().
Vulnerability Location:
- File: include/rapidjson/internal/diyfp.h
- Function: GetCachedPowerByIndex()
- Line: 223
Root Cause:
During full-precision float parsing, the decimalPosition value underflows to 0xFFFFFFFFFFFFFFF0 (-16). This value is passed to StrtodDiyFp(), which computes an array index of 536870895. The kCachedPowers_F array only has about 87 elements, causing an out-of-bounds read.
PoC (46 bytes):
"1.1" followed by 192 zeros triggers the crash.
ASan Report:
ERROR: AddressSanitizer: SEGV on unknown address 0x58d6267d2c08
#0 GetCachedPowerByIndex(index=536870895) at diyfp.h:223
#1 StrtodDiyFp() at strtod.h:154
#2 StrtodFullPrecision() at strtod.h:259
#3 ParseNumber<16u>() at reader.h:1362
GDB Evidence:
r13 = 0x1999999999999999 (underflow artifact)
Independence Statement:
This vulnerability is independent from CVE-2024-38517:
- Crash point: diyfp.h:223 vs reader.h ParseNumber()
- Trigger: requires kParseFullPrecisionFlag vs default parsing mode
- Affected: v1.1.0 (latest) vs v1.0.0
Impact:
- Denial of Service (DoS)
- Potential information disclosure
GitHub Issue: https://github.com/Tencent/rapidjson/issues/2405 |
|---|
| ソース | ⚠️ https://github.com/Tencent/rapidjson/issues/2401 |
|---|
| ユーザー | shuidajiao (UID 102056) |
|---|
| 送信 | 2026年10月16日 12:53 (23 日 ago) |
|---|
| モデレーション | 2026年11月08日 21:24 (23 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 433010 [Tencent RapidJSON 1.1.0 diyfp.h GetCachedPowerByIndex decimalPosition 情報漏えい] |
|---|
| ポイント | 20 |
|---|