Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ohler55/oj

              develop @ a1ef274
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Buffer Over-read: 1 prior fix. Scrutinize any change in this area.

ext/oj/intern.c: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Type Confusion: A class path segment resolving to a non-class/module caused a SEGV, enabling remote crash. This indicates insufficient type validation before using constants as classes/modules.

Memory Corruption: Use-after-free of the class cache value due to premature GC collection. This is a classic lifetime bug in caching, requiring GC registration.

Race Condition: GC marking of the value stack raced with thread mutations, leading to memory corruption. This indicates missing synchronization on shared parser state.