A bug in 1.7.14, may cause crash #536
Description
CJSON_PUBLIC(cJSON *) cJSON_CreateIntArray(const int *numbers, int count)
{
size_t i = 0;
cJSON *n = NULL;
cJSON *p = NULL;
cJSON *a = NULL;
if ((count < 0) || (numbers == NULL))
{
return NULL;
}
a = cJSON_CreateArray();
if (!a)
{
return NULL;
}
for(i = 0; i < (size_t)count; i++)
{
n = cJSON_CreateNumber(numbers[i]);
if (!n)
{
cJSON_Delete(a);
return NULL;
}
if(!i)
{
a->child = n;
}
else
{
suffix_object(p, n);
}
p = n;
}
a->child->prev = n;
return a;
}
if I pass count = 0, e.g: cJSON_CreateIntArray(testArray[], 0)
a->child will be null,
then a->child->prev = n will cause crash