Code: static char *print_string_ptr( const char *str )
 {
	const char *ptr;
	char *ptr2, *out;
	int len = 0;
	unsigned char token;
 	
	if ( ! str )
		return cJSON_strdup( "" );
	ptr = str;
	while ( ( token = *ptr ) && ++len ) {
		if ( strchr( "\"\\\b\f\n\r\t", token ) )
			++len;
		else if ( token < 32 )
			len += 5;
		++ptr;
 	}
 	
	if ( ! ( out = (char*) cJSON_malloc( len + 3 ) ) )
		return 0;
	ptr2 = out;
	ptr = str;
	*ptr2++ = '\"';
	while ( *ptr ) {
		if ( (unsigned char) *ptr > 31 && *ptr != '\"' && *ptr != '\\' )
			*ptr2++ = *ptr++;
		else {
			*ptr2++ = '\\';
			switch ( token = *ptr++ ) {
				case '\\': *ptr2++ = '\\'; break;
				case '\"': *ptr2++ = '\"'; break;
				case '\b': *ptr2++ = 'b'; break;
				case '\f': *ptr2++ = 'f'; break;
				case '\n': *ptr2++ = 'n'; break;
				case '\r': *ptr2++ = 'r'; break;
				case '\t': *ptr2++ = 't'; break;
				default:
				/* Escape and print. */
				sprintf( ptr2, "u%04x", token );
				ptr2 += 5;
				break;
 			}
 		}
 	}
	*ptr2++ = '\"';
	*ptr2++ = 0;
 	return out;
 }

Vulnerability Type: DoS Exec Code Overflow 
CWE ID: CWE-119
Summary: The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a non-hex character in a JSON string, which triggers a heap-based buffer overflow.
Commit Message: Fix a buffer overflow / heap corruption issue that could occur if a
malformed JSON string was passed on the control channel.  This issue,
present in the cJSON library, was already fixed upstream, so was
addressed here in iperf3 by importing a newer version of cJSON (plus
local ESnet modifications).

Discovered and reported by Dave McDaniel, Cisco Talos.

Based on a patch by @dopheide-esnet, with input from @DaveGamble.

Cross-references:  TALOS-CAN-0164, ESNET-SECADV-2016-0001,
CVE-2016-4303

(cherry picked from commit ed94082be27d971a5e1b08b666e2c217cf470a40)
Signed-off-by: Bruce A. Mah <bmah@es.net>