fix: remove unsafe exec() in parson.c#14823
Conversation
Automated security fix generated by Orbis Security AI
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. |
And be specific about which commit we use. Hugo treat this as an upstream dependency, so we would appreciate that any bugs will be reported and fixed upstream. See gohugoio#14823
|
See #14827 -- this moves us to the release version of
|
And be specific about which commit we use. Hugo treat this as an upstream dependency, so we would appreciate that any bugs will be reported and fixed upstream. See #14823
Summary
Fix high severity security issue in
internal/warpc/genwebp/deps/parson/parson.c.Vulnerability
V-001internal/warpc/genwebp/deps/parson/parson.c:816Description: The parson.c JSON serialization library uses unsafe sprintf() calls at lines 816, 818, and 876 to write formatted numeric and string values into fixed-size stack buffers (num_buf) without specifying a maximum output length. A sufficiently large numeric value or long string can overflow the buffer and corrupt adjacent stack memory, potentially enabling arbitrary code execution or crashing the warpc worker process.
Changes
internal/warpc/genwebp/deps/parson/parson.cVerification
Automated security fix by OrbisAI Security