From ef0877151eb14f2d75fea139b5de34a048733e8b Mon Sep 17 00:00:00 2001 From: Jordan Bayles Date: Sun, 15 Mar 2026 17:54:08 -0700 Subject: [PATCH 1/8] Fix CMake deprecation warning for compatibility with CMake < 3.10 (#1659) * Fix uninitialized CMake variable in version.in CMake's project() command sets jsoncpp_VERSION (lowercase prefix), not JSONCPP_VERSION. The wrong variable caused the generated version file to be empty. Fixes #1656 Co-Authored-By: Claude Sonnet 4.6 * Fix CMake deprecation warning for compatibility with CMake < 3.10 Bump JSONCPP_OLDEST_VALIDATED_POLICIES_VERSION from 3.8.0 to 3.10.0 to silence the CMake 3.31 deprecation warning. Fixes #1598 --------- Co-authored-by: Claude Sonnet 4.6 --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 4eb4499a2..cfd1a4e1c 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -12,7 +12,7 @@ # CMake versions greater than the JSONCPP_NEWEST_VALIDATED_POLICIES_VERSION policies will # continue to generate policy warnings "CMake Warning (dev)...Policy CMP0XXX is not set:" # -set(JSONCPP_OLDEST_VALIDATED_POLICIES_VERSION "3.8.0") +set(JSONCPP_OLDEST_VALIDATED_POLICIES_VERSION "3.10.0") set(JSONCPP_NEWEST_VALIDATED_POLICIES_VERSION "3.13.2") cmake_minimum_required(VERSION ${JSONCPP_OLDEST_VALIDATED_POLICIES_VERSION}) if("${CMAKE_VERSION}" VERSION_LESS "${JSONCPP_NEWEST_VALIDATED_POLICIES_VERSION}") From 215b0258171aef90a708a7e4a2c40ba19a74a13a Mon Sep 17 00:00:00 2001 From: Jordan Bayles Date: Sun, 15 Mar 2026 17:57:42 -0700 Subject: [PATCH 2/8] Scope JSON_DLL_BUILD to shared lib target only (#1660) Replaced directory-wide add_compile_definitions/add_definitions with target_compile_definitions PRIVATE on the shared lib target, so JSON_DLL_BUILD is not incorrectly applied to static and object libs. Fixes #1634 --- src/lib_json/CMakeLists.txt | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/src/lib_json/CMakeLists.txt b/src/lib_json/CMakeLists.txt index 86722ac8d..965894158 100644 --- a/src/lib_json/CMakeLists.txt +++ b/src/lib_json/CMakeLists.txt @@ -107,12 +107,6 @@ list(APPEND REQUIRED_FEATURES if(BUILD_SHARED_LIBS) - if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.12.0) - add_compile_definitions(JSON_DLL_BUILD) - else() - add_definitions(-DJSON_DLL_BUILD) - endif() - set(SHARED_LIB ${PROJECT_NAME}_lib) add_library(${SHARED_LIB} SHARED ${PUBLIC_HEADERS} ${JSONCPP_SOURCES}) set_target_properties(${SHARED_LIB} PROPERTIES @@ -122,6 +116,8 @@ if(BUILD_SHARED_LIBS) POSITION_INDEPENDENT_CODE ${BUILD_SHARED_LIBS} ) + target_compile_definitions(${SHARED_LIB} PRIVATE JSON_DLL_BUILD) + # Set library's runtime search path on OSX if(APPLE) set_target_properties(${SHARED_LIB} PROPERTIES INSTALL_RPATH "@loader_path/.") From 8661f9e5fb51ae6bd839c635ba325f0fe7ba4974 Mon Sep 17 00:00:00 2001 From: Jordan Bayles Date: Sun, 15 Mar 2026 22:33:54 -0700 Subject: [PATCH 3/8] Fix number parsing failing under non-C locales (#1662) IStringStream inherits the global locale, so parsing doubles with operator>> fails when the locale uses ',' as the decimal separator (e.g. de_DE). Imbue the stream with std::locale::classic() in both Reader::decodeDouble and OurReader::decodeDouble. The writer already handles this correctly via fixNumericLocale(). Fixes #1565 --- RELEASE_1.9.7.md | 52 ++++++++++++++++++++++++++++++++++++ src/lib_json/json_reader.cpp | 2 ++ 2 files changed, 54 insertions(+) create mode 100644 RELEASE_1.9.7.md diff --git a/RELEASE_1.9.7.md b/RELEASE_1.9.7.md new file mode 100644 index 000000000..3607998d7 --- /dev/null +++ b/RELEASE_1.9.7.md @@ -0,0 +1,52 @@ +# jsoncpp 1.9.7 Release Work + +Issues to fix before tagging 1.9.7, each in a separate CL. + +--- + +## Done + +- [x] **#1656** — Fix uninitialized CMake variable `JSONCPP_VERSION` in `version.in` + → Change `@JSONCPP_VERSION@` to `@jsoncpp_VERSION@` + +--- + +## To Do + +### Security / Memory Safety + +- [ ] **#1626** — MemorySanitizer: use-of-uninitialized-value in `Json::Value::resolveReference` + → Uninitialized value detected by MSan in `json_value.cpp`. Need to identify and zero-initialize the offending member. + +- [ ] **#1623** — Use-after-free: `Json::Reader::parse` stores raw pointers into input string + → `Reader` stores `begin_`/`end_` pointers that dangle after the input `std::string` goes out of scope. `getFormattedErrorMessages()` then reads freed memory. + → Fix: copy the input document internally, or clearly document the lifetime requirement (the simpler option given the old Reader API is deprecated). + +### Correctness + +- [x] **#1565** — Number parsing breaks when user sets a non-C locale (e.g. `de_DE`) + → `istringstream`/`ostringstream` used for number parsing/writing inherit the global locale, which may use `,` as decimal separator instead of `.`. + → Fix: imbue streams with `std::locale::classic()` in `json_reader.cpp` and `json_writer.cpp`. + +- [ ] **#1546** — Control characters below 0x20 not rejected during parsing + → JSON spec requires rejecting unescaped control characters. jsoncpp currently accepts them. + +### Build / CMake + +- [ ] **#1634** — `JSON_DLL_BUILD` compile definition applied globally instead of per-target + → `add_compile_definitions` scopes it to all targets; should use `target_compile_definitions` scoped to the shared lib only. + +- [x] **#1598** — CMake 3.31 deprecation warning about compatibility with CMake < 3.10 + → Update `cmake_minimum_required` to use `...` version range syntax, e.g. `cmake_minimum_required(VERSION 3.10...3.31)`. + +- [x] **#1595** — Linker errors with `string_view` API when jsoncpp built as C++11 but consumer uses C++17 + → Root cause: `JSONCPP_HAS_STRING_VIEW` is not defined when building the library (forced C++11), but consumer with C++17 sees the `string_view` overloads in headers and tries to link them. + → Fix options: (a) export `JSONCPP_HAS_STRING_VIEW` in the CMake config so consumers see the same value, or (b) drop `CMAKE_CXX_STANDARD` force and use `target_compile_features(cxx_std_11)` instead. + +--- + +## Skipped (not bugs) + +- **#1548** — "Memory leak" after parsing large files: confirmed to be normal allocator behavior (OS doesn't immediately reclaim heap). Not a library bug. +- **#1533** — `clear()` then adding values fails: `clear()` preserves the value type by design. Confirmed user error. +- **#1547** — Trailing commas/garbage not rejected: existing behavior, controllable via `strictMode()`. Not a regression. diff --git a/src/lib_json/json_reader.cpp b/src/lib_json/json_reader.cpp index 0697132b0..b0b6eb02f 100644 --- a/src/lib_json/json_reader.cpp +++ b/src/lib_json/json_reader.cpp @@ -583,6 +583,7 @@ bool Reader::decodeDouble(Token& token) { bool Reader::decodeDouble(Token& token, Value& decoded) { double value = 0; IStringStream is(String(token.start_, token.end_)); + is.imbue(std::locale::classic()); if (!(is >> value)) { if (value == std::numeric_limits::max()) value = std::numeric_limits::infinity(); @@ -1617,6 +1618,7 @@ bool OurReader::decodeDouble(Token& token) { bool OurReader::decodeDouble(Token& token, Value& decoded) { double value = 0; IStringStream is(String(token.start_, token.end_)); + is.imbue(std::locale::classic()); if (!(is >> value)) { if (value == std::numeric_limits::max()) value = std::numeric_limits::infinity(); From 94aee4f71552afcb8968ca8c7c1631471afa7ad8 Mon Sep 17 00:00:00 2001 From: Jordan Bayles Date: Sun, 15 Mar 2026 22:36:14 -0700 Subject: [PATCH 4/8] Reject unescaped control characters in JSON strings (#1663) RFC 8259 requires that control characters (U+0000-U+001F) be escaped when they appear inside strings. jsoncpp previously accepted them silently. Add a check in Reader::decodeString and OurReader::decodeString to return an error when an unescaped control character is encountered. Fixes #1546 --- src/lib_json/json_reader.cpp | 4 ++++ test/data/fail_test_control_char_01.json | 1 + 2 files changed, 5 insertions(+) create mode 100644 test/data/fail_test_control_char_01.json diff --git a/src/lib_json/json_reader.cpp b/src/lib_json/json_reader.cpp index b0b6eb02f..3faa2028f 100644 --- a/src/lib_json/json_reader.cpp +++ b/src/lib_json/json_reader.cpp @@ -655,6 +655,8 @@ bool Reader::decodeString(Token& token, String& decoded) { return addError("Bad escape sequence in string", token, current); } } else { + if (static_cast(c) < 0x20) + return addError("Control character in string", token, current - 1); decoded += c; } } @@ -1690,6 +1692,8 @@ bool OurReader::decodeString(Token& token, String& decoded) { return addError("Bad escape sequence in string", token, current); } } else { + if (static_cast(c) < 0x20) + return addError("Control character in string", token, current - 1); decoded += c; } } diff --git a/test/data/fail_test_control_char_01.json b/test/data/fail_test_control_char_01.json new file mode 100644 index 000000000..1f6835573 --- /dev/null +++ b/test/data/fail_test_control_char_01.json @@ -0,0 +1 @@ +"" \ No newline at end of file From d4742c2b4550d4ee516f065c87315c756ac2430f Mon Sep 17 00:00:00 2001 From: Jordan Bayles Date: Sun, 15 Mar 2026 22:36:29 -0700 Subject: [PATCH 5/8] Fix MSAN issue in #1626 (#1654) * Fix MSAN issue in #1626 This patch fixes an MSAN issue by changing CZString initialization. * add test * expand tests * fix build * Export CZString with JSON_API to fix Windows DLL linker errors --- include/json/value.h | 6 +++- src/lib_json/json_value.cpp | 47 ++++++++++++++++++++---------- src/test_lib_json/main.cpp | 58 +++++++++++++++++++++++++++++++++++++ 3 files changed, 95 insertions(+), 16 deletions(-) diff --git a/include/json/value.h b/include/json/value.h index 5f6544329..a7a39a1a7 100644 --- a/include/json/value.h +++ b/include/json/value.h @@ -50,6 +50,9 @@ #include #include +// Forward declaration for testing. +struct ValueTest; + #ifdef JSONCPP_HAS_STRING_VIEW #include #endif @@ -201,6 +204,7 @@ class JSON_API StaticString { */ class JSON_API Value { friend class ValueIteratorBase; + friend struct ::ValueTest; public: using Members = std::vector; @@ -266,7 +270,7 @@ class JSON_API Value { private: #endif #ifndef JSONCPP_DOC_EXCLUDE_IMPLEMENTATION - class CZString { + class JSON_API CZString { public: enum DuplicationPolicy { noDuplication = 0, duplicate, duplicateOnCopy }; CZString(ArrayIndex index); diff --git a/src/lib_json/json_value.cpp b/src/lib_json/json_value.cpp index a875d28b2..74f77896f 100644 --- a/src/lib_json/json_value.cpp +++ b/src/lib_json/json_value.cpp @@ -253,20 +253,29 @@ Value::CZString::CZString(const CZString& other) { cstr_ = (other.storage_.policy_ != noDuplication && other.cstr_ != nullptr ? duplicateStringValue(other.cstr_, other.storage_.length_) : other.cstr_); - storage_.policy_ = - static_cast( - other.cstr_ - ? (static_cast(other.storage_.policy_) == - noDuplication - ? noDuplication - : duplicate) - : static_cast(other.storage_.policy_)) & - 3U; - storage_.length_ = other.storage_.length_; -} - -Value::CZString::CZString(CZString&& other) noexcept - : cstr_(other.cstr_), index_(other.index_) { + if (other.cstr_) { + storage_.policy_ = + static_cast( + other.cstr_ + ? (static_cast(other.storage_.policy_) == + noDuplication + ? noDuplication + : duplicate) + : static_cast(other.storage_.policy_)) & + 3U; + storage_.length_ = other.storage_.length_; + } else { + index_ = other.index_; + } +} + +Value::CZString::CZString(CZString&& other) noexcept : cstr_(other.cstr_) { + if (other.cstr_) { + storage_.policy_ = other.storage_.policy_; + storage_.length_ = other.storage_.length_; + } else { + index_ = other.index_; + } other.cstr_ = nullptr; } @@ -292,8 +301,16 @@ Value::CZString& Value::CZString::operator=(const CZString& other) { } Value::CZString& Value::CZString::operator=(CZString&& other) noexcept { + if (cstr_ && storage_.policy_ == duplicate) { + releasePrefixedStringValue(const_cast(cstr_)); + } cstr_ = other.cstr_; - index_ = other.index_; + if (other.cstr_) { + storage_.policy_ = other.storage_.policy_; + storage_.length_ = other.storage_.length_; + } else { + index_ = other.index_; + } other.cstr_ = nullptr; return *this; } diff --git a/src/test_lib_json/main.cpp b/src/test_lib_json/main.cpp index f19ca2fb4..d6938c1d0 100644 --- a/src/test_lib_json/main.cpp +++ b/src/test_lib_json/main.cpp @@ -150,6 +150,8 @@ struct ValueTest : JsonTest::TestCase { /// Normalize the representation of floating-point number by stripped leading /// 0 in exponent. static Json::String normalizeFloatingPointStr(const Json::String& s); + + void runCZStringTests(); }; Json::String ValueTest::normalizeFloatingPointStr(const Json::String& s) { @@ -167,6 +169,44 @@ Json::String ValueTest::normalizeFloatingPointStr(const Json::String& s) { return normalized + exponent; } +void ValueTest::runCZStringTests() { + // 1. Copy Constructor (Index) + Json::Value::CZString idx1(123); + Json::Value::CZString idx2(idx1); + JSONTEST_ASSERT_EQUAL(idx2.index(), 123); + + // 2. Move Constructor (Index) + Json::Value::CZString idx3(std::move(idx1)); + JSONTEST_ASSERT_EQUAL(idx3.index(), 123); + + // 3. Move Assignment (Index) + Json::Value::CZString idx4(456); + idx4 = std::move(idx3); + JSONTEST_ASSERT_EQUAL(idx4.index(), 123); + + // 4. Copy Constructor (String) + Json::Value::CZString str1("param", 5, + Json::Value::CZString::duplicateOnCopy); + Json::Value::CZString str2((str1)); // copy makes it duplicate (owning) + JSONTEST_ASSERT_STRING_EQUAL(str2.data(), "param"); + + // 5. Move Constructor (String) + // Move from Owning string (str2) + Json::Value::CZString str3(std::move(str2)); + JSONTEST_ASSERT_STRING_EQUAL(str3.data(), "param"); + + // 6. Move Assignment (String) + Json::Value::CZString str4("other", 5, + Json::Value::CZString::duplicateOnCopy); + Json::Value::CZString str5((str4)); // owning "other" + // Move-assign owning "param" (str3) into owning "other" (str5) + // This verifies we don't leak "other" (if fixed) and correctly take "param" + str5 = std::move(str3); + JSONTEST_ASSERT_STRING_EQUAL(str5.data(), "param"); +} + +JSONTEST_FIXTURE_LOCAL(ValueTest, CZStringCoverage) { runCZStringTests(); } + JSONTEST_FIXTURE_LOCAL(ValueTest, checkNormalizeFloatingPointStr) { struct TestData { std::string in; @@ -449,6 +489,24 @@ JSONTEST_FIXTURE_LOCAL(ValueTest, resizeArray) { } } +JSONTEST_FIXTURE_LOCAL(ValueTest, copyMoveArray) { + Json::Value array; + array.append("item1"); + array.append("item2"); + + // Test Copy Constructor (covers CZString(const CZString&) with index) + Json::Value copy(array); + JSONTEST_ASSERT_EQUAL(copy.size(), 2); + JSONTEST_ASSERT_EQUAL(Json::Value("item1"), copy[0]); + JSONTEST_ASSERT_EQUAL(Json::Value("item2"), copy[1]); + + // Test Move Constructor (covers CZString(CZString&&) with index) + Json::Value moved(std::move(copy)); + JSONTEST_ASSERT_EQUAL(moved.size(), 2); + JSONTEST_ASSERT_EQUAL(Json::Value("item1"), moved[0]); + JSONTEST_ASSERT_EQUAL(Json::Value("item2"), moved[1]); +} + JSONTEST_FIXTURE_LOCAL(ValueTest, resizePopulatesAllMissingElements) { Json::ArrayIndex n = 10; Json::Value v; From 9a5bbec0d63804de9cf028a9fbc69f8fa0dc901e Mon Sep 17 00:00:00 2001 From: Jordan Bayles Date: Sun, 15 Mar 2026 22:38:17 -0700 Subject: [PATCH 6/8] Fix string_view ABI mismatch between library and consumers (#1661) The library was forced to build with CMAKE_CXX_STANDARD 11, so JSONCPP_HAS_STRING_VIEW was never defined at compile time. Consumers building with C++17 would see the string_view APIs in the header but fail to link them. Fix: - Remove the global CMAKE_CXX_STANDARD 11 override; the existing target_compile_features(cxx_std_11) already enforces the minimum. - Detect string_view support at configure time with check_cxx_source_compiles and export JSONCPP_HAS_STRING_VIEW as a PUBLIC compile definition on all library targets, so consumers always see the same value the library was built with. - Guard the __cplusplus fallback in value.h so it does not override the CMake-set define. Fixes #1595 --- CMakeLists.txt | 6 ------ include/json/value.h | 2 ++ src/lib_json/CMakeLists.txt | 18 ++++++++++++++++++ 3 files changed, 20 insertions(+), 6 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index cfd1a4e1c..bc8575fd1 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -40,12 +40,6 @@ foreach(pold "") # Currently Empty endif() endforeach() -# Build the library with C++11 standard support, independent from other including -# software which may use a different CXX_STANDARD or CMAKE_CXX_STANDARD. -set(CMAKE_CXX_STANDARD 11) -set(CMAKE_CXX_EXTENSIONS OFF) -set(CMAKE_CXX_STANDARD_REQUIRED ON) - # Ensure that CMAKE_BUILD_TYPE has a value specified for single configuration generators. if(NOT DEFINED CMAKE_BUILD_TYPE AND NOT DEFINED CMAKE_CONFIGURATION_TYPES) set(CMAKE_BUILD_TYPE Release CACHE STRING diff --git a/include/json/value.h b/include/json/value.h index a7a39a1a7..f32f45609 100644 --- a/include/json/value.h +++ b/include/json/value.h @@ -39,9 +39,11 @@ #endif #endif +#ifndef JSONCPP_HAS_STRING_VIEW #if __cplusplus >= 201703L #define JSONCPP_HAS_STRING_VIEW 1 #endif +#endif #include #include diff --git a/src/lib_json/CMakeLists.txt b/src/lib_json/CMakeLists.txt index 965894158..03e933552 100644 --- a/src/lib_json/CMakeLists.txt +++ b/src/lib_json/CMakeLists.txt @@ -7,6 +7,7 @@ include(CheckIncludeFileCXX) include(CheckTypeSize) include(CheckStructHasMember) include(CheckCXXSymbolExists) +include(CheckCXXSourceCompiles) check_include_file_cxx(clocale HAVE_CLOCALE) check_cxx_symbol_exists(localeconv clocale HAVE_LOCALECONV) @@ -25,6 +26,11 @@ if(NOT (HAVE_CLOCALE AND HAVE_LCONV_SIZE AND HAVE_DECIMAL_POINT AND HAVE_LOCALEC endif() endif() +check_cxx_source_compiles( + "#include + int main() { std::string_view sv; return 0; }" + JSONCPP_HAS_STRING_VIEW) + set(JSONCPP_INCLUDE_DIR ../../include) set(PUBLIC_HEADERS @@ -125,6 +131,10 @@ if(BUILD_SHARED_LIBS) target_compile_features(${SHARED_LIB} PUBLIC ${REQUIRED_FEATURES}) + if(JSONCPP_HAS_STRING_VIEW) + target_compile_definitions(${SHARED_LIB} PUBLIC JSONCPP_HAS_STRING_VIEW=1) + endif() + target_include_directories(${SHARED_LIB} PUBLIC $ $ @@ -158,6 +168,10 @@ if(BUILD_STATIC_LIBS) target_compile_features(${STATIC_LIB} PUBLIC ${REQUIRED_FEATURES}) + if(JSONCPP_HAS_STRING_VIEW) + target_compile_definitions(${STATIC_LIB} PUBLIC JSONCPP_HAS_STRING_VIEW=1) + endif() + target_include_directories(${STATIC_LIB} PUBLIC $ $ @@ -184,6 +198,10 @@ if(BUILD_OBJECT_LIBS) target_compile_features(${OBJECT_LIB} PUBLIC ${REQUIRED_FEATURES}) + if(JSONCPP_HAS_STRING_VIEW) + target_compile_definitions(${OBJECT_LIB} PUBLIC JSONCPP_HAS_STRING_VIEW=1) + endif() + target_include_directories(${OBJECT_LIB} PUBLIC $ $ From 02e903a847fb30366491007b45cf8e90ac871114 Mon Sep 17 00:00:00 2001 From: Jordan Bayles Date: Sun, 15 Mar 2026 22:45:14 -0700 Subject: [PATCH 7/8] Revert "Fix number parsing failing under non-C locales" (#1664) * Revert "Fix number parsing failing under non-C locales (#1662)" This reverts commit 8661f9e5fb51ae6bd839c635ba325f0fe7ba4974. * readd json reader changes --- RELEASE_1.9.7.md | 52 ------------------------------------------------ 1 file changed, 52 deletions(-) delete mode 100644 RELEASE_1.9.7.md diff --git a/RELEASE_1.9.7.md b/RELEASE_1.9.7.md deleted file mode 100644 index 3607998d7..000000000 --- a/RELEASE_1.9.7.md +++ /dev/null @@ -1,52 +0,0 @@ -# jsoncpp 1.9.7 Release Work - -Issues to fix before tagging 1.9.7, each in a separate CL. - ---- - -## Done - -- [x] **#1656** — Fix uninitialized CMake variable `JSONCPP_VERSION` in `version.in` - → Change `@JSONCPP_VERSION@` to `@jsoncpp_VERSION@` - ---- - -## To Do - -### Security / Memory Safety - -- [ ] **#1626** — MemorySanitizer: use-of-uninitialized-value in `Json::Value::resolveReference` - → Uninitialized value detected by MSan in `json_value.cpp`. Need to identify and zero-initialize the offending member. - -- [ ] **#1623** — Use-after-free: `Json::Reader::parse` stores raw pointers into input string - → `Reader` stores `begin_`/`end_` pointers that dangle after the input `std::string` goes out of scope. `getFormattedErrorMessages()` then reads freed memory. - → Fix: copy the input document internally, or clearly document the lifetime requirement (the simpler option given the old Reader API is deprecated). - -### Correctness - -- [x] **#1565** — Number parsing breaks when user sets a non-C locale (e.g. `de_DE`) - → `istringstream`/`ostringstream` used for number parsing/writing inherit the global locale, which may use `,` as decimal separator instead of `.`. - → Fix: imbue streams with `std::locale::classic()` in `json_reader.cpp` and `json_writer.cpp`. - -- [ ] **#1546** — Control characters below 0x20 not rejected during parsing - → JSON spec requires rejecting unescaped control characters. jsoncpp currently accepts them. - -### Build / CMake - -- [ ] **#1634** — `JSON_DLL_BUILD` compile definition applied globally instead of per-target - → `add_compile_definitions` scopes it to all targets; should use `target_compile_definitions` scoped to the shared lib only. - -- [x] **#1598** — CMake 3.31 deprecation warning about compatibility with CMake < 3.10 - → Update `cmake_minimum_required` to use `...` version range syntax, e.g. `cmake_minimum_required(VERSION 3.10...3.31)`. - -- [x] **#1595** — Linker errors with `string_view` API when jsoncpp built as C++11 but consumer uses C++17 - → Root cause: `JSONCPP_HAS_STRING_VIEW` is not defined when building the library (forced C++11), but consumer with C++17 sees the `string_view` overloads in headers and tries to link them. - → Fix options: (a) export `JSONCPP_HAS_STRING_VIEW` in the CMake config so consumers see the same value, or (b) drop `CMAKE_CXX_STANDARD` force and use `target_compile_features(cxx_std_11)` instead. - ---- - -## Skipped (not bugs) - -- **#1548** — "Memory leak" after parsing large files: confirmed to be normal allocator behavior (OS doesn't immediately reclaim heap). Not a library bug. -- **#1533** — `clear()` then adding values fails: `clear()` preserves the value type by design. Confirmed user error. -- **#1547** — Trailing commas/garbage not rejected: existing behavior, controllable via `strictMode()`. Not a regression. From ce757bee45b84a42885af06897e378247ccecb94 Mon Sep 17 00:00:00 2001 From: Jordan Bayles Date: Sun, 15 Mar 2026 22:51:09 -0700 Subject: [PATCH 8/8] Fix use-after-free in Reader::parse(std::istream&) (#1665) The istream overload stored the document in a local String then passed raw pointers into it to parse(const char*, const char*), which kept those pointers in begin_/end_. After parse() returned the local String was destroyed, leaving begin_/end_ dangling. Any subsequent call to getFormattedErrorMessages() would then read freed memory. Fix by reading the stream into the member document_ instead, matching the behavior of parse(const std::string&). Also document the lifetime requirement on parse(const char*, const char*): the caller's buffer must outlive the Reader if error-reporting methods are used after parsing. Fixes #1623 --- include/json/reader.h | 5 ++++- src/lib_json/json_reader.cpp | 13 ++++--------- 2 files changed, 8 insertions(+), 10 deletions(-) diff --git a/include/json/reader.h b/include/json/reader.h index d745378fc..7aa227188 100644 --- a/include/json/reader.h +++ b/include/json/reader.h @@ -81,7 +81,10 @@ class JSON_API Reader { * document. * * \param beginDoc Pointer on the beginning of the UTF-8 encoded - * string of the document to read. + * string of the document to read. The pointed-to + * buffer must outlive this Reader if error + * methods (e.g. getFormattedErrorMessages()) are + * called after parse() returns. * \param endDoc Pointer on the end of the UTF-8 encoded string * of the document to read. Must be >= beginDoc. * \param[out] root Contains the root value of the document if it diff --git a/src/lib_json/json_reader.cpp b/src/lib_json/json_reader.cpp index 3faa2028f..83743f73b 100644 --- a/src/lib_json/json_reader.cpp +++ b/src/lib_json/json_reader.cpp @@ -88,15 +88,10 @@ bool Reader::parse(const std::string& document, Value& root, } bool Reader::parse(std::istream& is, Value& root, bool collectComments) { - // std::istream_iterator begin(is); - // std::istream_iterator end; - // Those would allow streamed input from a file, if parse() were a - // template function. - - // Since String is reference-counted, this at least does not - // create an extra copy. - String doc(std::istreambuf_iterator(is), {}); - return parse(doc.data(), doc.data() + doc.size(), root, collectComments); + document_.assign(std::istreambuf_iterator(is), + std::istreambuf_iterator()); + return parse(document_.data(), document_.data() + document_.size(), root, + collectComments); } bool Reader::parse(const char* beginDoc, const char* endDoc, Value& root,