Posted by Ron E on Aug 26 UltraJSON contains an out-of-bounds read in its native C JSON decoder when

processing certain incomplete JSON values supplied through an explicitly

length-bounded input buffer.

The affected native entry point, JSON_DecodeObject(), accepts both a buffer

pointer and an explicit buffer length:

JSON_DecodeObject(

JSONObjectDecoder *dec,

const char *buffer,

size_t cbBuffer

)

The decoder establishes cbBuffer as the logical boundary of...