Merge pull request from GHSA-686w-5m7m-54vcjq-1.7.1

decNumberToString calls for a buffer that can hold a string of digits+14
characters, not a buffer of size digits+14.
We need to allocate an extra byte for the NUL byte.

-10E-1000010001, for example, will be stringified as -1.0E-1000010000
and decNumberToString will currently write an extra NUL byte after the
allocated buffer in the heap.

Originally reported by @SEU-SSL on GitHub.

Ref: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64574

Fixes GHSA-686w-5m7m-54vc

1 files changed, 1 insertions, 1 deletions

diff --git a/src/jv.c b/src/jv.c
index 6ca1e1d0..e23d8ec1 100644
--- a/src/jv.c
+++ b/src/jv.c
@@ -635,7 +635,7 @@ static const char* jvp_literal_number_literal(jv n) {
   }
 
   if (plit->literal_data == NULL) {
-    int len = jvp_dec_number_ptr(n)->digits + 14;
+    int len = jvp_dec_number_ptr(n)->digits + 15 /* 14 + NUL */;
     plit->literal_data = jv_mem_alloc(len);
 
     // Preserve the actual precision as we have parsed it