{"items":[{"id":"NVI-00018435","kind":"vulnerability","title":"Oj: Integer Overflow in Oj.load 2GB String Handling","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-475m-ph3x-64gp","CVE-2026-54903"],"plain_summary":"GitHub lists this reviewed advisory for oj. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-230794a723323df6bc6a95e5ad202a26"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-230794a723323df6bc6a95e5ad202a26","url":"https://github.com/advisories/GHSA-475m-ph3x-64gp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-475m-ph3x-64gp","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T07:18:46.322Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-230794a723323df6bc6a95e5ad202a26"],"technology":"oj","known_exclusions":[],"conditions_summary":"### Summary\n\n`Oj.load` is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in `buf_append_string` (`buf.h:61`) converts the string length to a large negative `size_t`, causing `memcpy` to copy an astronomically large amount of data out of bounds. This crashes the process and can corrupt adjacent heap memory.\n\n### Version\n\n- **Software**: oj gem\n- **Affected**: all versions with `ext/oj/buf.h` and `ext/oj/parse.c`\n- **Latest tested**: 3.17.1 (confirmed present)\n\n### Details\n\n`ext/oj/buf.h`, line 61:\n\n```c\ninline static void buf_append_string(Buf buf, const char *s, size_t slen) {\n    // ...\n    memcpy(buf->tail, s, slen);   // slen derived from 32-bit int that wrapped negative\n```\n\nIn `parse.c`, escape sequence handling computes the remaining string length as an `int`:\n\n```c\n// parse.c:402 (read_escaped_str)\nint  slen = (int)(s - str);   // ← wraps to negative when string > 2 GB\nbuf_append_string(buf, str, (size_t)slen);  // ← (size_t)(-2147483648) = 0x80000000...\n```\n\nASAN report:\n```\n==399019==ERROR: AddressSanitizer: negative-size-param: (size=-2147483648)\n    #0 __asan_memcpy\n    #1 buf_append_string  /ext/oj/buf.h:61\n    #2 read_esc","public_affected_ranges":["< 3.17.2"]}],"null_published_at":"2026-11-07T07:07:39.836Z","source_updated_at":"2026-06-19T20:47:33.000Z","source_disclosed_at":"2026-06-19T20:47:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T07:18:46.322Z"}],"next_cursor":null,"snapshot_revision":"42594"}