Submit #1024236: tencent RapidJSON 1.1.0 Buffer Overflow

RapidJSON v1.1.0 (and likely earlier) contains a heap-buffer-overflow
in GenericStringStream<UTF8<char>>::Take() at stream.h:116. When the
regex parser in GenericRegex::Parse() processes crafted regular
expressions containing an invalid UTF-8 sequence (e.g., a trailing
\xf0 byte), the UTF-8 decoder requests additional bytes beyond the
allocated buffer, causing an out-of-bounds read of 1 byte.

A 22-byte PoC triggers the crash:
printf '[-z`+.7;]a-z`+.7;]<)\xf0' > poc

ASan report:
heap-buffer-overflow READ of size 1
#0 GenericStringStream<UTF8<char>>::Take() stream.h:116:24
#1 UTF8<char>::Decode() encodings.h:170:39
#2 GenericRegex::DecodedStream::Decode() regex.h:174:18
#3 GenericRegex::DecodedStream::Take() regex.h:168:17
#4 GenericRegex::Parse() regex.h:213:36

Impact: any application using RapidJSON's regex or JSON Schema
pattern validation can be crashed by user-supplied input.

Reported at: https://github.com/Tencent/rapidjson/issues/2401

• Source: ⚠️ https://github.com/Tencent/rapidjson/issues/2401
• User: shuidajiao (UID 102056)
• Submission: 10/11/2026 06:18 (22 days ago)
• Moderation: 10/26/2026 18:19 (16 days later)
• Status: Accepted
• VulDB entry: 426552 [Tencent RapidJSON up to 1.1.0 Regex Parser stream.h Take out-of-bounds]
• Points: 20