| 标题 | tencent RapidJSON 1.1.0 Out-of-Bounds Read |
|---|
| 描述 | A heap-buffer-overflow (out-of-bounds read) vulnerability exists in RapidJSON v1.1.0 when parsing floating-point numbers with kParseFullPrecisionFlag. An integer underflow in decimalPosition leads to an out-of-bounds array access in GetCachedPowerByIndex().
Vulnerability Location:
- File: include/rapidjson/internal/diyfp.h
- Function: GetCachedPowerByIndex()
- Line: 223
Root Cause:
During full-precision float parsing, the decimalPosition value underflows to 0xFFFFFFFFFFFFFFF0 (-16). This value is passed to StrtodDiyFp(), which computes an array index of 536870895. The kCachedPowers_F array only has about 87 elements, causing an out-of-bounds read.
PoC (46 bytes):
"1.1" followed by 192 zeros triggers the crash.
ASan Report:
ERROR: AddressSanitizer: SEGV on unknown address 0x58d6267d2c08
#0 GetCachedPowerByIndex(index=536870895) at diyfp.h:223
#1 StrtodDiyFp() at strtod.h:154
#2 StrtodFullPrecision() at strtod.h:259
#3 ParseNumber<16u>() at reader.h:1362
GDB Evidence:
r13 = 0x1999999999999999 (underflow artifact)
Independence Statement:
This vulnerability is independent from CVE-2024-38517:
- Crash point: diyfp.h:223 vs reader.h ParseNumber()
- Trigger: requires kParseFullPrecisionFlag vs default parsing mode
- Affected: v1.1.0 (latest) vs v1.0.0
Impact:
- Denial of Service (DoS)
- Potential information disclosure
GitHub Issue: https://github.com/Tencent/rapidjson/issues/2405 |
|---|
| 来源 | ⚠️ https://github.com/Tencent/rapidjson/issues/2401 |
|---|
| 用户 | shuidajiao (UID 102056) |
|---|
| 提交 | 2026-10-16 12時53分 (23 日前) |
|---|
| 管理 | 2026-11-08 21時24分 (23 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 433010 [Tencent RapidJSON 1.1.0 diyfp.h GetCachedPowerByIndex decimalPosition 信息公开] |
|---|
| 积分 | 20 |
|---|