| タイトル | tencent RapidJSON 1.1.0 Buffer Overflow |
|---|
| 説明 | A SEGV (out-of-bounds read) vulnerability exists in RapidJSON v1.0.0 when parsing floating-point numbers with extremely large negative exponents.
Vulnerability Location:
- File: include/rapidjson/internal/strtod.h
- Function: FastPath()
- Line: 31
Root Cause:
The exponent overflows the 'int' variable in ParseNumber(). The corrupted exponent is passed to Pow10(exp), which uses it as an array index. This causes an out-of-bounds read and SEGV.
PoC:
Input: 12222222228222222221e-3022222222223
ASan Report:
ERROR: AddressSanitizer: SEGV
READ of size 1
#0 FastPath() at strtod.h:31
#1 StrtodNormalPrecision() at strtod.h:43
Independence Statement:
This vulnerability is independent from CVE-2024-38517:
- Crash point: strtod.h FastPath() vs reader.h ParseNumber()
- Trigger: extreme negative exponent vs specific integer input
Impact:
- Denial of Service (DoS)
GitHub Issue: https://github.com/Tencent/rapidjson/issues/2408 |
|---|
| ソース | ⚠️ https://github.com/Tencent/rapidjson/issues/2408 |
|---|
| ユーザー | shuidajiao (UID 102056) |
|---|
| 送信 | 2026年10月17日 16:01 (23 日 ago) |
|---|
| モデレーション | 2026年11月09日 16:25 (23 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 270921 [Tencent RapidJSON 迄 1.1.0 File reader.h ParseNumber メモリ破損] |
|---|
| ポイント | 0 |
|---|