Control: tags -1 + patch Hi,
Upstream has an open, mergeable pull request that names this CVE: https://www.google.com/url?q=https://github.com/DaveGamble/cJSON/pull/1120&source=gmail&ust=1793769830333000&sa=E "utils: fix decode_pointer_inplace dropping bytes after escapes (CVE-2026-29036)" cJSON_Utils.c +15 -4, plus new cases in tests/json-patch-tests/cjson-utils-tests.json Several older PRs (#1001, #1019, #1098) also target the ~1 decoding in decode_pointer_inplace(); #1120 is the one that references the CVE. Verified on the Debian 1.7.19-2 source with its patch applied. The PR applies cleanly. I built with cmake, -DENABLE_CJSON_UTILS=On and -DENABLE_SANITIZERS=On (ASan+UBSan, leak checking on): - Full test suite with the PR: 22/22 passed, no sanitizer reports. - The PR's new json_patch_tests cases run against unpatched 1.7.19-2: json_patch_test_cjson_utils_tests fails ("Expected 0 Was 13. Failed to apply patches"). With the PR, it passes. The PR is still unmerged upstream, so it may be worth waiting for review there, or carrying it as a patch if upstream stays quiet. Thanks!
