Control: tags -1 + patch Hi,
There is still no fix in upstream master (last commit 6d9f244, 2026-09-16), but an open PR targets this CVE: https://www.google.com/url?q=https://github.com/DaveGamble/cJSON/pull/1117&source=gmail&ust=1793765146315000&sa=E "Guard print_string_ptr counters against 32-bit overflow (CVE-2026-16554)" commit 527bbde4c66993ed0153c30ad5045a4e4e24df9a The PR author could only check the arithmetic on a 64-bit host, so I reproduced the bug on a real 32-bit (i386, gcc -m32) build. Review: the patch guards escape_characters before each ++ and += 5, then checks that input_length + escape_characters + sizeof("\"\"") cannot wrap before calling ensure(). ensure()'s own `needed > INT_MAX` check does not help here, because the wrapped size (~859 MB) is below INT_MAX. On 64-bit the new checks never trigger. Test (i386, cJSON master vs master + PR #1117): a string of 858993460 bytes of 0x01, created with cJSON_CreateStringReference() and printed with cJSON_PrintPreallocated() into an mmap'ed buffer with a PROT_NONE guard page right after it. 5 * 858993460 = 2^32 + 4, so escape_characters wraps to 4 and the output is sized as ~len + 6 bytes, while the true escaped output is 5153960762 bytes. - unpatched: SIGSEGV on the guard page, i.e. a heap/buffer overflow past the end of the output buffer - with PR #1117: cJSON_PrintPreallocated() returns false, no overflow Regression: I built all tests/*.c with the PR applied and Unity directly (no cmake on this box). 21/21 pass on x86_64 with -fsanitize=address,undefined and 21/21 pass on i386. This includes the PR's new print_string_should_print_escape_heavy_strings_exactly test. The cJSON.c hunk applies to the 1.7.19-2 source with a -5 line offset (patch -p1 --dry-run against cJSON.c from https://www.google.com/url?q=http://sources.debian.org&source=gmail&ust=1793765146315000&sa=E ). Thanks!
