open-source-parsers / jsoncpp / 23129907561

90%

push

github

Fix use-after-free in Reader::parse(std::istream&) (#1665)

The istream overload stored the document in a local String then
passed raw pointers into it to parse(const char*, const char*),
which kept those pointers in begin_/end_. After parse() returned
the local String was destroyed, leaving begin_/end_ dangling.
Any subsequent call to getFormattedErrorMessages() would then
read freed memory.

Fix by reading the stream into the member document_ instead, matching
the behavior of parse(const std::string&).

Also document the lifetime requirement on parse(const char*, const
char*): the caller's buffer must outlive the Reader if error-reporting
methods are used after parsing.

Fixes #1623

2182 of 2588 branches covered (84.31%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

2574 of 2691 relevant lines covered (95.65%)

23739.33 hits per line