From dd47d8ae00641fdaadad3169e70867ba08096eb0 Mon Sep 17 00:00:00 2001
From: JIgar-maheshwari-dev <maheshwarijigar656@gmail.com>
Date: Wed, 22 Jul 2026 23:34:39 +0530
Subject: [PATCH] fix: add size_t overflow guard in ensure()

Add a boundary check in ensure() before adding p->offset + 1 to needed.
This prevents potential size_t wrap-around on 32-bit systems when handling large buffer offsets.

Signed-off-by: JIgar-maheshwari-dev <maheshwarijigar656@gmail.com>
---
 cJSON.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/cJSON.c b/cJSON.c
index 727e1827..822c1090 100644
--- a/cJSON.c
+++ b/cJSON.c
@@ -42,6 +42,7 @@
 #include <stdlib.h>
 #include <limits.h>
 #include <ctype.h>
+#include <stdint.h>
 
 #ifdef ENABLE_LOCALES
 #include <locale.h>
@@ -394,6 +395,11 @@ static unsigned char* ensure(printbuffer * const p, size_t needed)
         return NULL;
     }
 
+    /* Ensure adding (p->offset + 1) won't overflow SIZE_MAX */
+    if (p->offset > SIZE_MAX - 1 - needed) {
+        return NULL;
+    }
+
     needed += p->offset + 1;
     if (needed <= p->length)
     {