| 标题 | tencent RapidJSON 1.1.0 Buffer Overflow |
|---|
| 描述 | A SEGV (out-of-bounds read) vulnerability exists in RapidJSON v1.0.0 when parsing floating-point numbers with extremely large negative exponents.
Vulnerability Location:
- File: include/rapidjson/internal/strtod.h
- Function: FastPath()
- Line: 31
Root Cause:
The exponent overflows the 'int' variable in ParseNumber(). The corrupted exponent is passed to Pow10(exp), which uses it as an array index. This causes an out-of-bounds read and SEGV.
PoC:
Input: 12222222228222222221e-3022222222223
ASan Report:
ERROR: AddressSanitizer: SEGV
READ of size 1
#0 FastPath() at strtod.h:31
#1 StrtodNormalPrecision() at strtod.h:43
Independence Statement:
This vulnerability is independent from CVE-2024-38517:
- Crash point: strtod.h FastPath() vs reader.h ParseNumber()
- Trigger: extreme negative exponent vs specific integer input
Impact:
- Denial of Service (DoS)
GitHub Issue: https://github.com/Tencent/rapidjson/issues/2408 |
|---|
| 来源 | ⚠️ https://github.com/Tencent/rapidjson/issues/2408 |
|---|
| 用户 | shuidajiao (UID 102056) |
|---|
| 提交 | 2026-10-17 16時01分 (23 日前) |
|---|
| 管理 | 2026-11-09 16時25分 (23 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 270921 [Tencent RapidJSON 直到 1.1.0 File reader.h ParseNumber 内存损坏] |
|---|
| 积分 | 0 |
|---|