Skip to content

Fix use-after-free in Reader::parse(std::istream&)#1665

Merged
baylesj merged 2 commits intomasterfrom
fix/reader-dangling-ptr
Mar 16, 2026
Merged

Fix use-after-free in Reader::parse(std::istream&)#1665
baylesj merged 2 commits intomasterfrom
fix/reader-dangling-ptr

Conversation

@baylesj
Copy link
Contributor

@baylesj baylesj commented Mar 16, 2026

The istream overload stored the document in a local String then
passed raw pointers into it to parse(const char*, const char*),
which kept those pointers in begin_/end_. After parse() returned
the local String was destroyed, leaving begin_/end_ dangling.
Any subsequent call to getFormattedErrorMessages() would then
read freed memory.

Fix by reading the stream into the member document_ instead, matching
the behavior of parse(const std::string&).

Also document the lifetime requirement on parse(const char*, const
char*): the caller's buffer must outlive the Reader if error-reporting
methods are used after parsing.

Fixes #1623

baylesj added 2 commits March 15, 2026 22:41
The istream overload stored the document in a local String then
passed raw pointers into it to parse(const char*, const char*),
which kept those pointers in begin_/end_. After parse() returned
the local String was destroyed, leaving begin_/end_ dangling.
Any subsequent call to getFormattedErrorMessages() would then
read freed memory.

Fix by reading the stream into the member document_ instead, matching
the behavior of parse(const std::string&).

Also document the lifetime requirement on parse(const char*, const
char*): the caller's buffer must outlive the Reader if error-reporting
methods are used after parsing.

Fixes #1623
@coveralls
Copy link

Pull Request Test Coverage Report for Build 23129789951

Details

  • 3 of 3 (100.0%) changed or added relevant lines in 1 file are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 90.093%

Totals Coverage Status
Change from base Build 23129754687: 0.0%
Covered Lines: 2574
Relevant Lines: 2691

💛 - Coveralls

@baylesj baylesj merged commit ce757be into master Mar 16, 2026
22 checks passed
@baylesj baylesj deleted the fix/reader-dangling-ptr branch March 16, 2026 05:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[bug] UAF via parse -> getFormattedErrorMessages

2 participants