Release version 1.4.6

Fix copy pasting with MSVC

CMakeLists.txt

@@ -1,7 +1,5 @@
 set(CMAKE_LEGACY_CYGWIN_WIN32 0)
-cmake_minimum_required(VERSION 2.8)
-
-subdirs(tests fuzzing)
+cmake_minimum_required(VERSION 2.8.5)
 
 include(GNUInstallDirs)
 
@@ -9,7 +7,7 @@ project(cJSON C)
 
 set(PROJECT_VERSION_MAJOR 1)
 set(PROJECT_VERSION_MINOR 4)
-set(PROJECT_VERSION_PATCH 1)
+set(PROJECT_VERSION_PATCH 6)
 set(CJSON_VERSION_SO 1)
 set(CJSON_UTILS_VERSION_SO 1)
 set(PROJECT_VERSION "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}")
@@ -78,10 +76,13 @@ foreach(compiler_flag ${custom_compiler_flags})
 
     CHECK_C_COMPILER_FLAG(${compiler_flag} "FLAG_SUPPORTED_${current_variable}")
     if (FLAG_SUPPORTED_${current_variable})
+        list(APPEND supported_compiler_flags)
         set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${compiler_flag}")
     endif()
 endforeach()
 
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${supported_compiler_flags}")
+
 #variables for pkg-config
 set(prefix "${CMAKE_INSTALL_PREFIX}")
 set(libdir "${CMAKE_INSTALL_LIBDIR}")
@@ -167,9 +168,30 @@ if(ENABLE_CJSON_TEST)
     add_executable("${TEST_CJSON}" test.c)
     target_link_libraries("${TEST_CJSON}" "${CJSON_LIB}")
 
+    add_test(NAME ${TEST_CJSON} COMMAND "${CMAKE_CURRENT_BINARY_DIR}/${TEST_CJSON}")
+
+    # Disable -fsanitize=float-divide-by-zero for cJSON_test
+    if (FLAG_SUPPORTED_fsanitizefloatdividebyzero)
+        if ("${CMAKE_VERSION}" VERSION_LESS "2.8.12")
+            set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fno-sanitize=float-divide-by-zero")
+        else()
+            target_compile_options(${TEST_CJSON} PRIVATE "-fno-sanitize=float-divide-by-zero")
+        endif()
+    endif()
+
     if(ENABLE_CJSON_UTILS)
         set(TEST_CJSON_UTILS cJSON_test_utils)
         add_executable("${TEST_CJSON_UTILS}" test_utils.c)
         target_link_libraries("${TEST_CJSON_UTILS}" "${CJSON_UTILS_LIB}")
+
+        add_test(NAME ${TEST_CJSON_UTILS} COMMAND "${CMAKE_CURRENT_BINARY_DIR}/${TEST_CJSON_UTILS}")
     endif()
+
+    #"check" target that automatically builds everything and runs the tests
+    add_custom_target(check
+        COMMAND ${CMAKE_CTEST_COMMAND} --output-on-failure
+        DEPENDS ${TEST_CJSON} ${TEST_CJSON_UTILS})
 endif()
+
+add_subdirectory(tests)
+add_subdirectory(fuzzing)

Makefile

@@ -10,7 +10,7 @@ UTILS_TEST_SRC = cJSON.c cJSON_Utils.c test_utils.c
 
 LDLIBS = -lm
 
-LIBVERSION = 1.4.1
+LIBVERSION = 1.4.6
 CJSON_SOVERSION = 1
 UTILS_SOVERSION = 1
 

README.md

@@ -9,6 +9,7 @@ Ultralightweight JSON parser in ANSI C.
   * [Building](#building)
   * [Some JSON](#some-json)
   * [Here's the structure](#heres-the-structure)
+  * [Caveats](#caveats)
   * [Enjoy cJSON!](#enjoy-cjson)
 
 ## License
@@ -62,7 +63,7 @@ Because the entire library is only one C file and one header file, you can just
 cJSON is written in ANSI C (C89) in order to support as many platforms and compilers as possible.
 
 #### CMake
-With CMake, cJSON supports a full blown build system. This way you get the most features. With CMake it is recommended to do an out of tree build, meaning the compiled files are put in a directory separate from the source files. So in order to build cJSON with CMake on a Unix platform, make a `build` directory and run CMake inside it.
+With CMake, cJSON supports a full blown build system. This way you get the most features. CMake with an equal or higher version than 2.8.5 is supported. With CMake it is recommended to do an out of tree build, meaning the compiled files are put in a directory separate from the source files. So in order to build cJSON with CMake on a Unix platform, make a `build` directory and run CMake inside it.
 
 ```
 mkdir build
@@ -97,10 +98,8 @@ make
 make DESTDIR=$pkgdir install
 ```
 
-CMake supports a lot of different platforms, not only UNIX Makefiles, but only UNIX Makefiles have been tested. It works on GNU/Linux and has been confirmed to compile on some versions of macOS, Cygwin, FreeBSD, Solaris and OpenIndiana.
-
 #### Makefile
-If you don't have CMake available, but still have make. You can use the makefile to build cJSON:
+If you don't have CMake available, but still have GNU make. You can use the makefile to build cJSON:
 
 Run this command in the directory with the source code and it will automatically compile static and shared libraries and a little test program.
 
@@ -138,13 +137,19 @@ What's the framerate?
 
 ```c
 cJSON *format = cJSON_GetObjectItem(root, "format");
-int framerate = cJSON_GetObjectItem(format, "frame rate")->valueint;
+cJSON *framerate_item = cJSON_GetObjectItem(format, "frame rate");
+double framerate = 0;
+if (cJSON_IsNumber(framerate_item))
+{
+  framerate = framerate_item->valuedouble;
+}
 ```
 
 Want to change the framerate?
 
 ```c
-cJSON_GetObjectItem(format, "frame rate")->valueint = 25;
+cJSON *framerate_item = cJSON_GetObjectItem(format, "frame rate");
+cJSON_SetNumberValue(framerate_item, 25);
 ```
 
 Back to disk?
@@ -203,7 +208,7 @@ typedef struct cJSON {
     int type;
 
     char *valuestring;
-    int valueint;
+    int valueint; /* writing to valueint is DEPRECATED, please use cJSON_SetNumberValue instead */
     double valuedouble;
 
     char *string;
@@ -219,8 +224,7 @@ A `child` entry will have `prev == 0`, but next potentially points on. The last
 The type expresses *Null*/*True*/*False*/*Number*/*String*/*Array*/*Object*, all of which are `#defined` in
 `cJSON.h`.
 
-A *Number* has `valueint` and `valuedouble`. If you're expecting an `int`, read `valueint`, if not read
-`valuedouble`.
+A *Number* has `valueint` and `valuedouble`. `valueint` is a relict of the past, so always use `valuedouble`.
 
 Any entry which is in the linked list which is the child of an object will have a `string`
 which is the "name" of the entry. When I said "name" in the above example, that's `string`.
@@ -237,8 +241,8 @@ void parse_and_callback(cJSON *item, const char *prefix)
 {
     while (item)
     {
-        char *newprefix = malloc(strlen(prefix) + strlen(item->name) + 2);
-        sprintf(newprefix, "%s/%s", prefix, item->name);
+        char *newprefix = malloc(strlen(prefix) + strlen(item->string) + 2);
+        sprintf(newprefix, "%s/%s", prefix, item->string);
         int dorecurse = callback(newprefix, item->type, item);
         if (item->child && dorecurse)
         {
@@ -261,22 +265,22 @@ int callback(const char *name, int type, cJSON *item)
     {
         /* populate name */
     }
-    else if (!strcmp(name, "format/type")
+    else if (!strcmp(name, "format/type"))
     {
         /* handle "rect" */ }
-    else if (!strcmp(name, "format/width")
+    else if (!strcmp(name, "format/width"))
     {
         /* 800 */
     }
-    else if (!strcmp(name, "format/height")
+    else if (!strcmp(name, "format/height"))
     {
         /* 600 */
     }
-    else if (!strcmp(name, "format/interlace")
+    else if (!strcmp(name, "format/interlace"))
     {
         /* false */
     }
-    else if (!strcmp(name, "format/frame rate")
+    else if (!strcmp(name, "format/frame rate"))
     {
         /* 24 */
     }
@@ -369,6 +373,29 @@ The `test.c` code shows how to handle a bunch of typical cases. If you uncomment
 the code, it'll load, parse and print a bunch of test files, also from [json.org](http://json.org),
 which are more complex than I'd care to try and stash into a `const char array[]`.
 
+### Caveats
+
+#### C Standard
+
+cJSON is written in ANSI C (or C89, C90). If your compiler or C library doesn't follow this standard, correct behavior is not guaranteed.
+
+NOTE: ANSI C is not C++ therefore it shouldn't be compiled by a C++ compiler. You can compile it with a C compiler and link it with your C++ code however. Although compiling with a C++ compiler might work, correct behavior is not guaranteed.
+
+#### Floating Point Numbers
+
+cJSON does not officially support any `double` implementations other than IEE754 double precision floating point numbers. It might still work with other implementations but bugs with these will be considered invalid.
+
+The maximum length of a floating point literal that cJSON supports is currently 63 characters.
+
+#### Thread Safety
+
+In general cJSON is **not thread safe**.
+
+However it is thread safe under the following conditions:
+* `cJSON_GetErrorPtr` is never used (the `return_parse_end` parameter of `cJSON_ParseWithOpts` can be used instead)
+* `cJSON_InitHooks` is only ever called before using cJSON in any threads.
+* `setlocale` is never called before all calls to cJSON functions have returned.
+
 # Enjoy cJSON!
 
 - Dave Gamble, Aug 2009

cJSON.c

@@ -31,6 +31,7 @@
 #include <float.h>
 #include <limits.h>
 #include <ctype.h>
+#include <locale.h>
 #pragma GCC visibility pop
 
 #include "cJSON.h"
@@ -47,7 +48,7 @@ CJSON_PUBLIC(const char *) cJSON_GetErrorPtr(void)
 }
 
 /* This is a safeguard to prevent copy-pasters from using incompatible C and header files */
-#if (CJSON_VERSION_MAJOR != 1) || (CJSON_VERSION_MINOR != 4) || (CJSON_VERSION_PATCH != 1)
+#if (CJSON_VERSION_MAJOR != 1) || (CJSON_VERSION_MINOR != 4) || (CJSON_VERSION_PATCH != 6)
     #error cJSON.h and cJSON.c have different versions. Make sure that both have the same.
 #endif
 
@@ -100,7 +101,7 @@ static unsigned char* cJSON_strdup(const unsigned char* str, const internal_hook
         return NULL;
     }
 
-    len = strlen((const char*)str) + 1;
+    len = strlen((const char*)str) + sizeof("");
     if (!(copy = (unsigned char*)hooks->allocate(len)))
     {
         return NULL;
@@ -177,19 +178,63 @@ CJSON_PUBLIC(void) cJSON_Delete(cJSON *c)
     }
 }
 
+/* get the decimal point character of the current locale */
+static unsigned char get_decimal_point(void)
+{
+    struct lconv *lconv = localeconv();
+    return (unsigned char) lconv->decimal_point[0];
+}
+
 /* Parse the input text to generate a number, and populate the result into item. */
 static const unsigned char *parse_number(cJSON * const item, const unsigned char * const input)
 {
     double number = 0;
     unsigned char *after_end = NULL;
+    unsigned char number_c_string[64];
+    unsigned char decimal_point = get_decimal_point();
+    size_t i = 0;
 
     if (input == NULL)
     {
         return NULL;
     }
 
-    number = strtod((const char*)input, (char**)&after_end);
-    if (input == after_end)
+    /* copy the number into a temporary buffer and replace '.' with the decimal point
+     * of the current locale (for strtod) */
+    for (i = 0; (i < (sizeof(number_c_string) - 1)) && (input[i] != '\0'); i++)
+    {
+        switch (input[i])
+        {
+            case '0':
+            case '1':
+            case '2':
+            case '3':
+            case '4':
+            case '5':
+            case '6':
+            case '7':
+            case '8':
+            case '9':
+            case '+':
+            case '-':
+            case 'e':
+            case 'E':
+                number_c_string[i] = input[i];
+                break;
+
+            case '.':
+                number_c_string[i] = decimal_point;
+                break;
+
+            default:
+                goto loop_end;
+        }
+    }
+loop_end:
+    number_c_string[i] = '\0';
+
+    number = strtod((const char*)number_c_string, (char**)&after_end);
+    if (number_c_string == after_end)
     {
         return NULL; /* parse_error */
     }
@@ -212,7 +257,7 @@ static const unsigned char *parse_number(cJSON * const item, const unsigned char
 
     item->type = cJSON_Number;
 
-    return after_end;
+    return input + (after_end - number_c_string);
 }
 
 /* don't ask me, but the original cJSON_SetNumberValue returns an integer or double */
@@ -228,7 +273,7 @@ CJSON_PUBLIC(double) cJSON_SetNumberHelper(cJSON *object, double number)
     }
     else
     {
-        object->valueint = cJSON_Number;
+        object->valueint = (int)number;
     }
 
     return object->valuedouble = number;
@@ -253,13 +298,19 @@ static unsigned char* ensure(printbuffer * const p, size_t needed, const interna
         return NULL;
     }
 
+    if ((p->length > 0) && (p->offset >= p->length))
+    {
+        /* make sure that offset is valid */
+        return NULL;
+    }
+
     if (needed > INT_MAX)
     {
         /* sizes bigger than INT_MAX are currently not supported */
         return NULL;
     }
 
-    needed += p->offset;
+    needed += p->offset + 1;
     if (needed <= p->length)
     {
         return p->buffer + p->offset;
@@ -270,8 +321,7 @@ static unsigned char* ensure(printbuffer * const p, size_t needed, const interna
     }
 
     /* calculate new buffer size */
-    newsize = needed * 2;
-    if (newsize > INT_MAX)
+    if (needed > (INT_MAX / 2))
     {
         /* overflow of int, use INT_MAX if possible */
         if (needed <= INT_MAX)
@@ -283,6 +333,10 @@ static unsigned char* ensure(printbuffer * const p, size_t needed, const interna
             return NULL;
         }
     }
+    else
+    {
+        newsize = needed * 2;
+    }
 
     if (hooks->reallocate != NULL)
     {
@@ -327,34 +381,24 @@ static void update_offset(printbuffer * const buffer)
 }
 
 /* Removes trailing zeroes from the end of a printed number */
-static cJSON_bool trim_trailing_zeroes(printbuffer * const buffer)
+static int trim_trailing_zeroes(const unsigned char * const number, int length, const unsigned char decimal_point)
 {
-    size_t offset = 0;
-    unsigned char *content = NULL;
-
-    if ((buffer == NULL) || (buffer->buffer == NULL) || (buffer->offset < 1))
+    if ((number == NULL) || (length <= 0))
     {
-        return false;
+        return -1;
     }
 
-    offset = buffer->offset - 1;
-    content = buffer->buffer;
-
-    while ((offset > 0) && (content[offset] == '0'))
+    while ((length > 0) && (number[length - 1] == '0'))
     {
-        offset--;
+        length--;
     }
-    if ((offset > 0) && (content[offset] == '.'))
+    if ((length > 0) && (number[length - 1] == decimal_point))
     {
-        offset--;
+        /* remove trailing decimal_point */
+        length--;
     }
 
-    offset++;
-    content[offset] = '\0';
-
-    buffer->offset = offset;
-
-    return true;
+    return length;
 }
 
 /* Render the number nicely from the given item into a string. */
@@ -363,54 +407,75 @@ static cJSON_bool print_number(const cJSON * const item, printbuffer * const out
     unsigned char *output_pointer = NULL;
     double d = item->valuedouble;
     int length = 0;
-    cJSON_bool trim_zeroes = true; /* should at the end be removed? */
+    size_t i = 0;
+    cJSON_bool trim_zeroes = true; /* should zeroes at the end be removed? */
+    unsigned char number_buffer[64]; /* temporary buffer to print the number into */
+    unsigned char decimal_point = get_decimal_point();
 
     if (output_buffer == NULL)
     {
         return false;
     }
 
-    /* This is a nice tradeoff. */
-    output_pointer = ensure(output_buffer, 64, hooks);
-    if (output_pointer == NULL)
-    {
-        return false;
-    }
-
     /* This checks for NaN and Infinity */
     if ((d * 0) != 0)
     {
-        length = sprintf((char*)output_pointer, "null");
+        length = sprintf((char*)number_buffer, "null");
     }
     else if ((fabs(floor(d) - d) <= DBL_EPSILON) && (fabs(d) < 1.0e60))
     {
         /* integer */
-        length = sprintf((char*)output_pointer, "%.0f", d);
+        length = sprintf((char*)number_buffer, "%.0f", d);
         trim_zeroes = false; /* don't remove zeroes for "big integers" */
     }
     else if ((fabs(d) < 1.0e-6) || (fabs(d) > 1.0e9))
     {
-        length = sprintf((char*)output_pointer, "%e", d);
+        length = sprintf((char*)number_buffer, "%e", d);
         trim_zeroes = false; /* don't remove zeroes in engineering notation */
     }
     else
     {
-        length = sprintf((char*)output_pointer, "%f", d);
+        length = sprintf((char*)number_buffer, "%f", d);
     }
 
-    /* sprintf failed */
-    if (length < 0)
+    /* sprintf failed or buffer overrun occured */
+    if ((length < 0) || (length > (int)(sizeof(number_buffer) - 1)))
     {
         return false;
     }
 
-    output_buffer->offset += (size_t)length;
-
     if (trim_zeroes)
     {
-        return trim_trailing_zeroes(output_buffer);
+        length = trim_trailing_zeroes(number_buffer, length, decimal_point);
+        if (length <= 0)
+        {
+            return false;
+        }
     }
 
+    /* reserve appropriate space in the output */
+    output_pointer = ensure(output_buffer, (size_t)length, hooks);
+    if (output_pointer == NULL)
+    {
+        return false;
+    }
+
+    /* copy the printed number to the output and replace locale
+     * dependent decimal point with '.' */
+    for (i = 0; i < ((size_t)length); i++)
+    {
+        if (number_buffer[i] == decimal_point)
+        {
+            output_pointer[i] = '.';
+            continue;
+        }
+
+        output_pointer[i] = number_buffer[i];
+    }
+    output_pointer[i] = '\0';
+
+    output_buffer->offset += (size_t)length;
+
     return true;
 }
 
@@ -619,7 +684,7 @@ static const unsigned char *parse_string(cJSON * const item, const unsigned char
 
         /* This is at most how much we need for the output */
         allocation_length = (size_t) (input_end - input) - skipped_bytes;
-        output = (unsigned char*)hooks->allocate(allocation_length + sizeof('\0'));
+        output = (unsigned char*)hooks->allocate(allocation_length + sizeof(""));
         if (output == NULL)
         {
             goto fail; /* allocation failure */
@@ -1092,7 +1157,7 @@ static cJSON_bool print_value(const cJSON * const item, const size_t depth, cons
                 return false;
             }
 
-            raw_length = strlen(item->valuestring) + sizeof('\0');
+            raw_length = strlen(item->valuestring) + sizeof("");
             output = ensure(output_buffer, raw_length, hooks);
             if (output == NULL)
             {
@@ -1226,7 +1291,7 @@ static cJSON_bool print_array(const cJSON * const item, const size_t depth, cons
         update_offset(output_buffer);
         if (current_element->next)
         {
-            length = format ? 2 : 1;
+            length = (size_t) (format ? 2 : 1);
             output_pointer = ensure(output_buffer, length + 1, hooks);
             if (output_pointer == NULL)
             {
@@ -1362,7 +1427,7 @@ static cJSON_bool print_object(const cJSON * const item, const size_t depth, con
     }
 
     /* Compose the output: */
-    length = format ? 2 : 1; /* fmt: {\n */
+    length = (size_t) (format ? 2 : 1); /* fmt: {\n */
     output_pointer = ensure(output_buffer, length + 1, hooks);
     if (output_pointer == NULL)
     {
@@ -1400,7 +1465,7 @@ static cJSON_bool print_object(const cJSON * const item, const size_t depth, con
         }
         update_offset(output_buffer);
 
-        length = format ? 2 : 1;
+        length = (size_t) (format ? 2 : 1);
         output_pointer = ensure(output_buffer, length, hooks);
         if (output_pointer == NULL)
         {
@@ -1421,7 +1486,7 @@ static cJSON_bool print_object(const cJSON * const item, const size_t depth, con
         update_offset(output_buffer);
 
         /* print comma if not last */
-        length = (size_t) (format ? 1 : 0) + (current_item->next ? 1 : 0);
+        length = (size_t) ((format ? 1 : 0) + (current_item->next ? 1 : 0));
         output_pointer = ensure(output_buffer, length + 1, hooks);
         if (output_pointer == NULL)
         {
@@ -1580,6 +1645,10 @@ CJSON_PUBLIC(void) cJSON_AddItemToObject(cJSON *object, const char *string, cJSO
     item->type &= ~cJSON_StringIsConst;
 }
 
+#if defined (__clang__) || ((__GNUC__)  && ((__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ > 5))))
+    #pragma GCC diagnostic push
+#endif
+#pragma GCC diagnostic ignored "-Wcast-qual"
 /* Add an item to an object with constant string as key */
 CJSON_PUBLIC(void) cJSON_AddItemToObjectCS(cJSON *object, const char *string, cJSON *item)
 {
@@ -1591,13 +1660,13 @@ CJSON_PUBLIC(void) cJSON_AddItemToObjectCS(cJSON *object, const char *string, cJ
     {
         global_hooks.deallocate(item->string);
     }
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wcast-qual"
     item->string = (char*)string;
-#pragma GCC diagnostic pop
     item->type |= cJSON_StringIsConst;
     cJSON_AddItemToArray(object, item);
 }
+#if defined (__clang__) || ((__GNUC__)  && ((__GNUC__ > 4) || ((__GNUC__ == 4) && (__GNUC_MINOR__ > 5))))
+    #pragma GCC diagnostic pop
+#endif
 
 CJSON_PUBLIC(void) cJSON_AddItemReferenceToArray(cJSON *array, cJSON *item)
 {

cJSON.h

@@ -31,7 +31,7 @@ extern "C"
 /* project version */
 #define CJSON_VERSION_MAJOR 1
 #define CJSON_VERSION_MINOR 4
-#define CJSON_VERSION_PATCH 1
+#define CJSON_VERSION_PATCH 6
 
 #include <stddef.h>
 
@@ -63,7 +63,7 @@ typedef struct cJSON
 
     /* The item's string, if type==cJSON_String  and type == cJSON_Raw */
     char *valuestring;
-    /* The item's number, if type==cJSON_Number */
+    /* writing to valueint is DEPRECATED, use cJSON_SetNumberValue instead */
     int valueint;
     /* The item's number, if type==cJSON_Number */
     double valuedouble;
@@ -88,9 +88,10 @@ typedef int cJSON_bool;
 /* When compiling for windows, we specify a specific calling convention to avoid issues where we are being called from a project with a different default calling convention.  For windows you have 2 define options:
 
 CJSON_HIDE_SYMBOLS - Define this in the case where you don't want to ever dllexport symbols
-CJSON_EXPORT_SYMBOLS - Define this on library build when you want to dllexport symbols
+CJSON_EXPORT_SYMBOLS - Define this on library build when you want to dllexport symbols (default)
+CJSON_IMPORT_SYMBOLS - Define this if you want to dllimport symbol
 
-For *nix builds that support visibility attribute, you can define similar behavior by 
+For *nix builds that support visibility attribute, you can define similar behavior by
 
 setting default visibility to hidden by adding
 -fvisibility=hidden (for gcc)
@@ -102,11 +103,16 @@ then using the CJSON_API_VISIBILITY flag to "export" the same symbols the way CJ
 
 */
 
+/* export symbols by default, this is necessary for copy pasting the C and header file */
+#if !defined(CJSON_HIDE_SYMBOLS) && !defined(CJSON_IMPORT_SYMBOLS) && !defined(CJSON_EXPORT_SYMBOLS)
+#define CJSON_EXPORT_SYMBOLS
+#endif
+
 #if defined(CJSON_HIDE_SYMBOLS)
 #define CJSON_PUBLIC(type)   type __stdcall
 #elif defined(CJSON_EXPORT_SYMBOLS)
 #define CJSON_PUBLIC(type)   __declspec(dllexport) type __stdcall
-#else
+#elif defined(CJSON_IMPORT_SYMBOLS)
 #define CJSON_PUBLIC(type)   __declspec(dllimport) type __stdcall
 #endif
 #else /* !WIN32 */
@@ -132,8 +138,9 @@ CJSON_PUBLIC(char *) cJSON_Print(const cJSON *item);
 CJSON_PUBLIC(char *) cJSON_PrintUnformatted(const cJSON *item);
 /* Render a cJSON entity to text using a buffered strategy. prebuffer is a guess at the final size. guessing well reduces reallocation. fmt=0 gives unformatted, =1 gives formatted */
 CJSON_PUBLIC(char *) cJSON_PrintBuffered(const cJSON *item, int prebuffer, cJSON_bool fmt);
-/* Render a cJSON entity to text using a buffer already allocated in memory with length buf_len. Returns 1 on success and 0 on failure. */
-CJSON_PUBLIC(cJSON_bool) cJSON_PrintPreallocated(cJSON *item, char *buf, const int len, const cJSON_bool fmt);
+/* Render a cJSON entity to text using a buffer already allocated in memory with given length. Returns 1 on success and 0 on failure. */
+/* NOTE: cJSON is not always 100% accurate in estimating how much memory it will use, so to be safe allocate 5 bytes more than you actually need */
+CJSON_PUBLIC(cJSON_bool) cJSON_PrintPreallocated(cJSON *item, char *buffer, const int length, const cJSON_bool format);
 /* Delete a cJSON entity and all subentities. */
 CJSON_PUBLIC(void) cJSON_Delete(cJSON *c);
 

cJSON_Utils.c

@@ -230,11 +230,11 @@ static void cJSONUtils_InplaceDecodePointerString(unsigned char *string)
 
     for (; *string; (void)s2++, string++)
     {
-        *s2 = (*string != '~')
+        *s2 = (unsigned char) ((*string != '~')
             ? (*string)
             : ((*(++string) == '0')
                     ? '~'
-                    : '/');
+                    : '/'));
     }
 
     *s2 = '\0';
@@ -468,7 +468,7 @@ static int cJSONUtils_ApplyPatch(cJSON *object, cJSON *patch)
     cJSONUtils_InplaceDecodePointerString(childptr);
 
     /* add, remove, replace, move, copy, test. */
-    if (!parent)
+    if ((parent == NULL) || (childptr == NULL))
     {
         /* Couldn't find object to add to. */
         free(parentptr);

fuzzing/afl.c

@@ -56,7 +56,7 @@ static char *read_file(const char *filename)
     }
 
     /* allocate content buffer */
-    content = (char*)malloc((size_t)length + sizeof('\0'));
+    content = (char*)malloc((size_t)length + sizeof(""));
     if (content == NULL)
     {
         goto cleanup;

test.c

@@ -53,8 +53,8 @@ static int print_preallocated(cJSON *root)
     out = cJSON_Print(root);
 
     /* create buffer to succeed */
-    /* the extra 64 bytes are in case a floating point value is printed */
-    len = strlen(out) + 64;
+    /* the extra 5 bytes are because of inaccuracies when reserving memory */
+    len = strlen(out) + 5;
     buf = (char*)malloc(len);
     if (buf == NULL)
     {

tests/CMakeLists.txt

@@ -2,14 +2,28 @@ if(ENABLE_CJSON_TEST)
     add_library(unity unity/src/unity.c)
 
     # Disable -Werror for Unity
-    list(FIND custom_compiler_flags "-Werror" werror_found)
-    if (werror_found)
-        target_compile_options(unity PRIVATE "-Wno-error")
+    if (FLAG_SUPPORTED_Werror)
+        if ("${CMAKE_VERSION}" VERSION_LESS "2.8.12")
+            set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-error")
+        else()
+            target_compile_options(unity PRIVATE "-Wno-error")
+        endif()
     endif()
     # Disable -fvisibility=hidden for Unity
-    list(FIND custom_compiler_flags "-fvisibility=hidden" visibility_found)
-    if (visibility_found)
-        target_compile_options(unity PRIVATE "-fvisibility=default")
+    if (FLAG_SUPPORTED_fvisibilityhidden)
+        if ("${CMAKE_VERSION}" VERSION_LESS "2.8.12")
+            set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fvisibility=default")
+        else()
+            target_compile_options(unity PRIVATE "-fvisibility=default")
+        endif()
+    endif()
+    # Disable -fsanitize=float-divide-by-zero for Unity (GCC bug on x86 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80097)
+    if (FLAG_SUPPORTED_fsanitizefloatdividebyzero AND (CMAKE_C_COMPILER_ID STREQUAL "GNU"))
+        if ("${CMAKE_VERSION}" VERSION_LESS "2.8.12")
+            set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fno-sanitize=float-divide-by-zero")
+        else()
+            target_compile_options(unity PRIVATE "-fno-sanitize=float-divide-by-zero")
+        endif()
     endif()
 
     #copy test files
@@ -46,20 +60,17 @@ if(ENABLE_CJSON_TEST)
         endif()
     endif()
 
-    #"check" target that automatically builds everything and runs the tests
-    add_custom_target(check 
-        COMMAND ${CMAKE_CTEST_COMMAND} --output-on-failure
-        DEPENDS ${unity_tests})
-
     foreach(unity_test ${unity_tests})
         add_executable("${unity_test}" "${unity_test}.c")
         target_link_libraries("${unity_test}" "${CJSON_LIB}" unity test-common)
         if(MEMORYCHECK_COMMAND)
             add_test(NAME "${unity_test}"
-                COMMAND "${MEMORYCHECK_COMMAND}" ${MEMORYCHECK_COMMAND_OPTIONS} "./${unity_test}")
+                COMMAND "${MEMORYCHECK_COMMAND}" ${MEMORYCHECK_COMMAND_OPTIONS} "${CMAKE_CURRENT_BINARY_DIR}/${unity_test}")
         else()
             add_test(NAME "${unity_test}"
                 COMMAND "./${unity_test}")
         endif()
     endforeach()
+
+    add_dependencies(check ${unity_tests})
 endif()

tests/common.c

@@ -70,7 +70,7 @@ CJSON_PUBLIC(char*) read_file(const char *filename)
     }
 
     /* allocate content buffer */
-    content = (char*)malloc((size_t)length + sizeof('\0'));
+    content = (char*)malloc((size_t)length + sizeof(""));
     if (content == NULL)
     {
         goto cleanup;

tests/print_number.c

@@ -50,7 +50,7 @@ static void print_number_should_print_negative_integers(void)
 {
     assert_print_number("-1", -1);
     assert_print_number("-32768", -32768);
-    assert_print_number("-2147483648", -2147483648);
+    assert_print_number("-2147483648", -2147483648.0);
 }
 
 static void print_number_should_print_positive_integers(void)
@@ -89,17 +89,11 @@ static void print_number_should_print_non_number(void)
 
 static void trim_trailing_zeroes_should_trim_trailing_zeroes(void)
 {
-    printbuffer buffer;
-    unsigned char number[100];
-    buffer.length = sizeof(number);
-    buffer.buffer = number;
-
-    strcpy((char*)number, "10.00");
-    buffer.offset = sizeof("10.00") - 1;
-    TEST_ASSERT_TRUE(trim_trailing_zeroes(&buffer));
-    TEST_ASSERT_EQUAL_UINT8('\0', buffer.buffer[buffer.offset]);
-    TEST_ASSERT_EQUAL_STRING("10", number);
-    TEST_ASSERT_EQUAL_UINT(sizeof("10") - 1, buffer.offset);
+    TEST_ASSERT_EQUAL_INT(2, trim_trailing_zeroes((const unsigned char*)"10.00", (int)(sizeof("10.00") - 1), '.'));
+    TEST_ASSERT_EQUAL_INT(0, trim_trailing_zeroes((const unsigned char*)".00", (int)(sizeof(".00") - 1), '.'));
+    TEST_ASSERT_EQUAL_INT(0, trim_trailing_zeroes((const unsigned char*)"00", (int)(sizeof("00") - 1), '.'));
+    TEST_ASSERT_EQUAL_INT(-1, trim_trailing_zeroes(NULL, 10, '.'));
+    TEST_ASSERT_EQUAL_INT(-1, trim_trailing_zeroes((const unsigned char*)"", 0, '.'));
 }
 
 int main(void)