Code: static const char *parse_array( cJSON *item, const char *value )
 {
 	cJSON *child;
 
	if ( *value != '[' ) {
		/* Not an array! */
		ep = value;
		return 0;
	}
	item->type = cJSON_Array;
	value = skip( value + 1 );
	if ( *value == ']' )
		return value + 1;	/* empty array. */
 
	if ( ! ( item->child = child = cJSON_New_Item() ) )
		return 0;		 /* memory fail */
	if ( ! ( value = skip( parse_value( child, skip( value ) ) ) ) )
		return 0;
 
	while ( *value == ',' ) {
 		cJSON *new_item;
		if ( ! ( new_item = cJSON_New_Item() ) )
			return 0;	/* memory fail */
		child->next = new_item;
		new_item->prev = child;
		child = new_item;
		if ( ! ( value = skip( parse_value( child, skip( value+1 ) ) ) ) )
			return 0;	/* memory fail */
 	}
 
	if ( *value == ']' )
		return value + 1;	/* end of array */
	/* Malformed. */
	ep = value;
	return 0;
 }

Commit Message: Fix a buffer overflow / heap corruption issue that could occur if a
malformed JSON string was passed on the control channel.  This issue,
present in the cJSON library, was already fixed upstream, so was
addressed here in iperf3 by importing a newer version of cJSON (plus
local ESnet modifications).

Discovered and reported by Dave McDaniel, Cisco Talos.

Based on a patch by @dopheide-esnet, with input from @DaveGamble.

Cross-references:  TALOS-CAN-0164, ESNET-SECADV-2016-0001,
CVE-2016-4303

(cherry picked from commit ed94082be27d971a5e1b08b666e2c217cf470a40)
Signed-off-by: Bruce A. Mah <bmah@es.net>
CWE ID: CWE-119
static const char *parse_array( cJSON *item, const char *value )
static const char *parse_array(cJSON *item,const char *value,const char **ep)
 {
 	cJSON *child;
	if (*value!='[')	{*ep=value;return 0;}	/* not an array! */
 
	item->type=cJSON_Array;
	value=skip(value+1);
	if (*value==']') return value+1;	/* empty array. */
 
	item->child=child=cJSON_New_Item();
	if (!item->child) return 0;		 /* memory fail */
	value=skip(parse_value(child,skip(value),ep));	/* skip any spacing, get the value. */
	if (!value) return 0;
 
	while (*value==',')
	{
 		cJSON *new_item;
		if (!(new_item=cJSON_New_Item())) return 0; 	/* memory fail */
		child->next=new_item;new_item->prev=child;child=new_item;
		value=skip(parse_value(child,skip(value+1),ep));
		if (!value) return 0;	/* memory fail */
 	}
 
	if (*value==']') return value+1;	/* end of array */
	*ep=value;return 0;	/* malformed. */
 }
