@@ -2,7 +2,7 @@
 
 ## Security
 
-- CVE-2023-50246: ....
+- CVE-2023-50246: Fix heap buffer overflow in jvp\_literal\_number\_literal
 - CVE-2023-50268: fix stack-buffer-overflow if comparing nan with payload
 
 ## CLI changes
 
@@ -635,7 +635,7 @@ static const char* jvp_literal_number_literal(jv n) {
   }
 
   if (plit->literal_data == NULL) {
-    int len = jvp_dec_number_ptr(n)->digits + 14;
+    int len = jvp_dec_number_ptr(n)->digits + 15 /* 14 + NUL */;
     plit->literal_data = jv_mem_alloc(len);
 
     // Preserve the actual precision as we have parsed it
 
@@ -609,4 +609,9 @@ if ! r=$($JQ --args -rn 1 -- '$ARGS.positional[0]' bar) || [ "$r" != 1 ]; then
     exit 1
 fi
 
+# CVE-2023-50246: No heap overflow for '-10E-1000000001'
+$VALGRIND $Q $JQ . <<\NUM
+-10E-1000000001
+NUM
+
 exit 0
Original file line number	Diff line number	Diff line change
`@@ -635,7 +635,7 @@ static const char* jvp_literal_number_literal(jv n) {`
`635`	`635`	`}`
`636`	`636`
`637`	`637`	`if (plit->literal_data == NULL) {`
`638`		`- int len = jvp_dec_number_ptr(n)->digits + 14;`
	`638`	`+ int len = jvp_dec_number_ptr(n)->digits + 15 /* 14 + NUL */;`
`639`	`639`	`plit->literal_data = jv_mem_alloc(len);`
`640`	`640`
`641`	`641`	`// Preserve the actual precision as we have parsed it`