Release Version 1.4.7

Thanks @PawelWMS

CHANGELOG.md

@@ -0,0 +1,177 @@
+1.4.7
+=====
+Fixes:
+------
+* Fix `cJSONUtils_ApplyPatches`, it was completely broken and apparently nobody noticed (or at least reported it) (075a06f40bdc4f836c7dd7cad690d253a57cfc50)
+* Fix inconsistent prototype for `cJSON_GetObjectItemCaseSensitive` (51d3df6c9f7b56b860c8fb24abe7bab255cd4fa9) thanks @PawelWMS
+
+1.4.6
+=====
+Fixes:
+------
+* Several corrections in the README
+* Making clear that `valueint` should not be written to
+* Fix overflow detection in `ensure` (2683d4d9873df87c4bdccc523903ddd78d1ad250)
+* Fix a potential null pointer dereference in cJSON_Utils (795c3acabed25c9672006b2c0f40be8845064827)
+* Replace incorrect `sizeof('\0')` with `sizeof("")` (84237ff48e69825c94261c624eb0376d0c328139)
+* Add caveats section to the README (50b3c30dfa89830f8f477ce33713500740ac3b79)
+* Make cJSON locale independent (#146) Thanks @peterh for reporting
+* Fix compiling without CMake with MSVC (#147) Thanks @dertuxmalwieder for reporting
+
+1.4.5
+=====
+Fixes:
+------
+* Fix bug in `cJSON_SetNumberHelper`, thanks @mmkeeper (#138 ef34500693e8c4a2849d41a4bd66fd19c9ec46c2)
+* Workaround for internal compiler error in GCC 5.4.0 and 6.3.1 on x86 (2f65e80a3471d053fdc3f8aed23d01dd1782a5cb [GCC bugreport](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80097))
+
+1.4.4
+=====
+Fixes:
+--------
+* Fix a theoretical integer overflow, (not sure if it is possible on actual hardware) e58f7ec027d00b7cdcbf63e518c1b5268b29b3da
+* Fix an off by one error (cc84a446be20cc283bafdc4d94c050ba1111ac02), thanks @gatzka
+* Double check the offset of the print buffer in `ensure` (1934059554b9a0971e00f79e96900f422cfdd114)
+
+Improvements:
+-------------
+* Add a note in the header about required buffer size when using `cJSON_PrintPreallocated` (4bfb88009342fb568295a7f6dc4b7fee74fbf022)
+
+1.4.3
+=====
+Fixes:
+------
+* Fix compilation of the tests on 32 bit PowerPC and potentially other systems (4ec6e76ea2eec16f54b58e8c95b4c734e59481e4)
+* Fix compilation with old GCC compilers (4.3+ were tested) (227d3398d6b967879761ebe02c1b63dbd6ea6e0d, 466eb8e3f8a65080f2b3ca4a79ab7b72bd539dba), see also #126
+
+1.4.2
+=====
+Fixes:
+------
+* Fix minimum required cmake version (30e1e7af7c63db9b55f5a3cda977a6c032f0b132)
+* Fix detection of supported compiler flags (76e5296d0d05ceb3018a9901639e0e171b44a557)
+* Run `cJSON_test` and `cJSON_test_utils` along with unity tests (c597601cf151a757dcf800548f18034d4ddfe2cb)
+
+1.4.1
+=====
+Fix: Make `print_number` abort with a failure in out of memory situations (cf1842dc6f64c49451a022308b4415e4d468be0a)
+
+1.4.0
+=====
+Features
+--------
+* Functions to check the type of an item (#120)
+* Use dllexport on windows and fvisibility on Unix systems for public functions (#116), thanks @mjerris
+* Remove trailing zeroes from printed numbers (#123)
+* Expose the internal boolean type `cJSON_bool` in the header (2d3520e0b9d0eb870e8886e8a21c571eeddbb310)
+
+Fixes
+-----
+* Fix handling of NULL pointers in `cJSON_ArrayForEach` (b47d0e34caaef298edfb7bd09a72cfff21d231ff)
+* Make it compile with GCC 7 (fix -Wimplicit-fallthrough warning) (9d07917feb1b613544a7513d19233d4c851ad7ad)
+
+Other Improvements
+------------------
+* internally use realloc if available (#110)
+* builtin support for fuzzing with [afl](http://lcamtuf.coredump.cx/afl/) (#111)
+* unit tests for the print functions (#112)
+* Always use buffered printing (#113)
+* simplify the print functions (#114)
+* Add the compiler flags `-Wdouble-conversion`, `-Wparentheses` and `-Wcomma` (#122)
+
+1.3.2
+=====
+Fix:
+----
+- Don't build the unity library if testing is disabled ( #121 ). Thanks @ffontaine
+
+1.3.1
+=====
+Bugfix release that fixes an out of bounds read #118. This shouldn't have any security implications.
+
+1.3.0
+=====
+This release includes a lot of rework in the parser and includes the Cunity unit testing framework, as well as some fixes. I increased the minor version number because there were quite a lot of internal changes.
+
+Features:
+---------
+- New type for cJSON structs: `cJSON_Invalid` (#108)
+
+Fixes:
+------
+- runtime checks for a lot of potential integer overflows
+- fix incorrect return in cJSON_PrintBuffered (cf9d57d56cac21fc59465b8d26cf29bf6d2a87b3)
+- fix several potential issues found by [Coverity](https://scan.coverity.com/projects/cjson)
+- fix potentially undefined behavior when assigning big numbers to `valueint` (41e2837df1b1091643aff073f2313f6ff3cc10f4)
+  - Numbers exceeding `INT_MAX` or lower than `INT_MIN` will be explicitly assigned to `valueint` as `INT_MAX` and `INT_MIN` respectively (saturation on overflow).
+  - fix the `cJSON_SetNumberValue` macro (87f77274de6b3af00fb9b9a7f3b900ef382296c2), this slightly changes the behavior, see commit message
+
+Introduce unit tests
+--------------------
+
+Started writing unit tests with the [Cunity](https://github.com/ThrowTheSwitch/Unity) testing framework. Currently this covers the parser functions.
+
+Also:
+- Support for running the tests with [Valgrind](http://valgrind.org)
+- Support for compiling the tests with [AddressSanitizer](https://github.com/google/sanitizers) and [UndefinedBehaviorSanitizer](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html).
+- `travis.yml` file for running unit tests on travis. (not enabled for the repository yet though #102)
+
+Simplifications
+---------------
+
+After having unit tests for the parser function in place, I started refactoring the parser functions (as well as others) and making them easier to read and maintain.
+- Use `strtod` from the standard library for parsing numbers (074766997246481dfc72bfa78f07898a2716473f)
+- Use goto-fail in several parser functions (#100)
+- Rewrite/restructure all of the parsing functions to be easier to understand and have less code paths doing the same as another. (#109)
+- Simplify the buffer allocation strategy to always doubling the needed amount (9f6fa94c91a87b71e4c6868dbf2ce431a48517b0)
+- Combined `cJSON_AddItemToObject` and `cJSON_AddItemToObjectCS` to one function (cf862d0fed7f9407e4b046d78d3d8050d2080d12)
+
+Other changes
+-------------
+- Prevent the usage of incompatible C and header versions via preprocessor directive (123bb1af7bfae41d805337fef4b41045ef6c7d25)
+- Let CMake automatically detect compiler flags
+- Add new compiler flags (`-Wundef`, `-Wswitch-default`, `-Wconversion`, `-fstack-protector-strong`) (#98)
+- Change internal sizes from `int` to `size_t` (ecd5678527a6bc422da694e5be9e9979878fe6a0)
+- Change internal strings from `char*` to `unsigned char*` (28b9ba4334e0f7309e867e874a31f395c0ac2474)
+- Add `const` in more places
+
+1.2.1
+=====
+Fixes:
+------
+- Fixes a potential null pointer dereference in cJSON_Utils, discovered using clang's static analyzer by @bnason-nf (#96)
+
+1.2.0
+=====
+Features:
+---------
+- Add a new type of cJSON item for raw JSON and support printing it. Thanks @loigu (#65, #90)
+
+Fixes:
+------
+- Compiler warning if const is casted away, Thanks @gatzka (#83)
+- Fix compile error with strict-overflow on PowerPC, (#85)
+- Fix typo in the README, thanks @MicroJoe (#88)
+- Add compile flag for compatibility with C++ compilers
+
+1.1.0
+=====
+- Add a function `cJSON_PrintPreallocated` to print to a preallocated buffer, thanks @ChisholmKyle (#72)
+- More compiler warnings when using Clang or GCC, thanks @gatzka (#75, #78)
+- fixed a memory leak in `cJSON_Duplicate`, thanks @alperakcan (#81)
+- fix the `ENABLE_CUSTOM_COMPILER_FLAGS` cmake option
+
+1.0.2
+=====
+Rename internal boolean type, see #71.
+
+1.0.1
+=====
+Small bugfix release.
+- Fixes a bug with the use of the cJSON structs type in cJSON_Utils, see d47339e2740360e6e0994527d5e4752007480f3a
+- improve code readability
+- initialize all variables
+
+1.0.0
+=====
+This is the first official versioned release of cJSON. It provides an API version for the shared library and improved Makefile and CMake build files.

CMakeLists.txt

@@ -7,7 +7,7 @@ project(cJSON C)
 
 set(PROJECT_VERSION_MAJOR 1)
 set(PROJECT_VERSION_MINOR 4)
-set(PROJECT_VERSION_PATCH 6)
+set(PROJECT_VERSION_PATCH 7)
 set(CJSON_VERSION_SO 1)
 set(CJSON_UTILS_VERSION_SO 1)
 set(PROJECT_VERSION "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}")

Makefile

@@ -10,7 +10,7 @@ UTILS_TEST_SRC = cJSON.c cJSON_Utils.c test_utils.c
 
 LDLIBS = -lm
 
-LIBVERSION = 1.4.6
+LIBVERSION = 1.4.7
 CJSON_SOVERSION = 1
 UTILS_SOVERSION = 1
 

README.md

@@ -375,6 +375,14 @@ which are more complex than I'd care to try and stash into a `const char array[]
 
 ### Caveats
 
+#### Zero Character
+
+cJSON doesn't support strings that contain the zero character `'\0'` or `\u0000`. This is impossible with the current API because strings are zero terminated.
+
+#### Character Encoding
+
+cJSON only supports UTF-8 encoded input and will always produce UTF-8 as output (If the input contained invalid UTF-8, it will most likely propagate it through to the output, thereby making the output non-valid UTF-8).
+
 #### C Standard
 
 cJSON is written in ANSI C (or C89, C90). If your compiler or C library doesn't follow this standard, correct behavior is not guaranteed.

cJSON.c

@@ -48,7 +48,7 @@ CJSON_PUBLIC(const char *) cJSON_GetErrorPtr(void)
 }
 
 /* This is a safeguard to prevent copy-pasters from using incompatible C and header files */
-#if (CJSON_VERSION_MAJOR != 1) || (CJSON_VERSION_MINOR != 4) || (CJSON_VERSION_PATCH != 6)
+#if (CJSON_VERSION_MAJOR != 1) || (CJSON_VERSION_MINOR != 4) || (CJSON_VERSION_PATCH != 7)
     #error cJSON.h and cJSON.c have different versions. Make sure that both have the same.
 #endif
 

cJSON.h

@@ -31,7 +31,7 @@ extern "C"
 /* project version */
 #define CJSON_VERSION_MAJOR 1
 #define CJSON_VERSION_MINOR 4
-#define CJSON_VERSION_PATCH 6
+#define CJSON_VERSION_PATCH 7
 
 #include <stddef.h>
 
@@ -149,7 +149,7 @@ CJSON_PUBLIC(int) cJSON_GetArraySize(const cJSON *array);
 /* Retrieve item number "item" from array "array". Returns NULL if unsuccessful. */
 CJSON_PUBLIC(cJSON *) cJSON_GetArrayItem(const cJSON *array, int item);
 /* Get item "string" from object. Case insensitive. */
-CJSON_PUBLIC(cJSON *) cJSON_GetObjectItem(const cJSON *object, const char *string);
+CJSON_PUBLIC(cJSON *) cJSON_GetObjectItem(const cJSON * const object, const char * const string);
 CJSON_PUBLIC(cJSON *) cJSON_GetObjectItemCaseSensitive(const cJSON *object, const char *string);
 CJSON_PUBLIC(cJSON_bool) cJSON_HasObjectItem(const cJSON *object, const char *string);
 /* For analysing failed parses. This returns a pointer to the parse error. You'll probably need to look a few chars back to make sense of it. Defined when cJSON_Parse() returns 0. 0 when cJSON_Parse() succeeds. */

cJSON_Utils.c

@@ -504,12 +504,7 @@ CJSON_PUBLIC(int) cJSONUtils_ApplyPatches(cJSON *object, cJSON *patches)
 {
     int err = 0;
 
-    if (patches == NULL)
-    {
-        return 1;
-    }
-
-    if (cJSON_IsArray(patches))
+    if (!cJSON_IsArray(patches))
     {
         /* malformed patches. */
         return 1;