Code: static const char *parse_number( cJSON *item, const char *num )
{
	int64_t i = 0;
	double f = 0;
	int isint = 1;
	int sign = 1, scale = 0, subscale = 0, signsubscale = 1;
 
	/* Could use sscanf for this? */
	if ( *num == '-' ) {
		/* Has sign. */
		sign = -1;
		++num;
	}
	if ( *num == '0' )
		/* Is zero. */
		++num;
	if ( *num >= '1' && *num<='9' ) {
		/* Number. */
		do {
			i = ( i * 10 ) + ( *num - '0' );
			f = ( f * 10.0 ) + ( *num - '0' );
			++num;
		} while ( *num >= '0' && *num <= '9' );
	}
	if ( *num == '.' && num[1] >= '0' && num[1] <= '9' ) {
		/* Fractional part. */
		isint = 0;
		++num;
		do {
			f = ( f * 10.0 ) + ( *num++ - '0' );
			scale--;
		} while ( *num >= '0' && *num <= '9' );
	}
	if ( *num == 'e' || *num == 'E' ) {
		/* Exponent. */
		isint = 0;
		++num;
		if ( *num == '+' )
			++num;
		else if ( *num == '-' ) {
			/* With sign. */
			signsubscale = -1;
			++num;
		}
		while ( *num >= '0' && *num <= '9' )
			subscale = ( subscale * 10 ) + ( *num++ - '0' );
	}
 
	/* Put it together. */
	if ( isint ) {
		/* Int: number = +/- number */
		i = sign * i;
		item->valueint = i;
		item->valuefloat = i;
	} else {
		/* Float: number = +/- number.fraction * 10^+/- exponent */
		f = sign * f * ipow( 10.0, scale + subscale * signsubscale );
		item->valueint = f;
		item->valuefloat = f;
	}
 
	item->type = cJSON_Number;
	return num;
 }

Vulnerability Type: DoS Exec Code Overflow 
CWE ID: CWE-119
Summary: The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.
Commit Message: Fix a buffer overflow / heap corruption issue that could occur if a
malformed JSON string was passed on the control channel.  This issue,
present in the cJSON library, was already fixed upstream, so was
addressed here in iperf3 by importing a newer version of cJSON (plus
local ESnet modifications).

Discovered and reported by Dave McDaniel, Cisco Talos.

Based on a patch by @dopheide-esnet, with input from @DaveGamble.

Cross-references:  TALOS-CAN-0164, ESNET-SECADV-2016-0001,
CVE-2016-4303

(cherry picked from commit ed94082be27d971a5e1b08b666e2c217cf470a40)
Signed-off-by: Bruce A. Mah <bmah@es.net>