Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
Tencent/rapidjson
master @ 24b5e7a
7
Fixes
0
CVEs
HIGH
Peak severity
28.6%
Coverage
Highlights
Memory Corruption: 2 prior fixes. Scrutinize any change in this area.
include/rapidjson/document.h: most-fixed (1 issue). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Out-of-Bounds Read: UTF-8 validation reads past stream end on malformed input; fix added null check and c initialization but sibling decode paths may still lack end-of-stream guards.
Use-After-Free: Stack pointer invalidation when Push reallocates; fix copies Frag before push, but other stack-using regex operations may still hold stale references.
Use-After-Free: Implicit temporary GenericSchemaDocument caused dangling references; explicit constructor prevents it, but other implicit temporary creation sites in schema validation remain unguarded.