Hi,
when fuzzing cJSON, we found a null pointer crash happened in cJSON_ReplaceItemViaPointer.

If the parent passed in cJSON_ReplaceItemViaPointer has not a child, which means parent->child is null, a null pointer dereference crash will be happened at the following statements:

CJSON_PUBLIC(cJSON_bool) cJSON_ReplaceItemViaPointer(cJSON * const parent, cJSON * const item, cJSON * replacement)
        ...
      if (replacement->next == NULL)
      {
          parent->child->prev = replacement;
      }

As detaching an item from an empty object is an undesirable behavior, instead of raising an uneasy core dump, maybe we can check it beforehand and inform the incorrect usage early to user.