Skip to content

v1.7.19 added Undefined Behavior to cJSON_SetValuestring() #919

@imaami

Description

@imaami

This is incorrect C:

cJSON/cJSON.c

Line 425 in 12c4bf1

if (!( valuestring + v1_len < object->valuestring || object->valuestring + v2_len < valuestring ))

The C17 standard (6.5.8.5) says this about pointer comparisons:

When two pointers are compared, the result depends on the relative locations in the address space of the objects pointed to. If two pointers to object types both point to the same object, or both point one past the last element of the same array object, they compare equal. If the objects pointed to are members of the same aggregate object, pointers to structure members declared later compare greater than pointers to members declared earlier in the structure, and pointers to array elements with larger subscript values compare greater than pointers to elements of the same array with lower subscript values. All pointers to members of the same union object compare equal. If the expression P points to an element of an array object and the expression Q points to the last element of the same array object, the pointer expression Q+1 compares greater than P. In all other cases, the behavior is undefined.

In other words you can't legally determine whether or not two unrelated arrays overlap. It is only well-defined if those arrays belong to the same object. The current test case is free of UB because it happens to use pointers to addresses within the same array. That's not representative of real use.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions