|  | @@ -262,6 +262,22 @@ static void cJSONUtils_InplaceDecodePointerString(unsigned char *string)
 | 
											
												
													
														|  |      *s2 = '\0';
 |  |      *s2 = '\0';
 | 
											
												
													
														|  |  }
 |  |  }
 | 
											
												
													
														|  |  
 |  |  
 | 
											
												
													
														|  | 
 |  | +static cJSON_bool decode_array_index_from_pointer(const unsigned char * const pointer, size_t * const index)
 | 
											
												
													
														|  | 
 |  | +{
 | 
											
												
													
														|  | 
 |  | +    char *end_pointer = NULL;
 | 
											
												
													
														|  | 
 |  | +    long int parsed_index = strtol((const char*)pointer, &end_pointer, 10);
 | 
											
												
													
														|  | 
 |  | +
 | 
											
												
													
														|  | 
 |  | +    if (((unsigned char*)end_pointer == pointer) || (parsed_index < 0) || (*end_pointer != '\0'))
 | 
											
												
													
														|  | 
 |  | +    {
 | 
											
												
													
														|  | 
 |  | +        /* array index is invalid */
 | 
											
												
													
														|  | 
 |  | +        return 0;
 | 
											
												
													
														|  | 
 |  | +    }
 | 
											
												
													
														|  | 
 |  | +
 | 
											
												
													
														|  | 
 |  | +    *index = (size_t)parsed_index;
 | 
											
												
													
														|  | 
 |  | +
 | 
											
												
													
														|  | 
 |  | +    return 1;
 | 
											
												
													
														|  | 
 |  | +}
 | 
											
												
													
														|  | 
 |  | +
 | 
											
												
													
														|  |  static cJSON *cJSONUtils_PatchDetach(cJSON *object, const unsigned char *path)
 |  |  static cJSON *cJSONUtils_PatchDetach(cJSON *object, const unsigned char *path)
 | 
											
												
													
														|  |  {
 |  |  {
 | 
											
												
													
														|  |      unsigned char *parentptr = NULL;
 |  |      unsigned char *parentptr = NULL;
 | 
											
										
											
												
													
														|  | @@ -548,25 +564,15 @@ static int cJSONUtils_ApplyPatch(cJSON *object, cJSON *patch)
 | 
											
												
													
														|  |          }
 |  |          }
 | 
											
												
													
														|  |          else
 |  |          else
 | 
											
												
													
														|  |          {
 |  |          {
 | 
											
												
													
														|  | -            char *end_pointer = NULL;
 |  | 
 | 
											
												
													
														|  | -            long int index = strtol((char*)childptr, &end_pointer, 10);
 |  | 
 | 
											
												
													
														|  | -            if ((unsigned char*)end_pointer == childptr)
 |  | 
 | 
											
												
													
														|  | 
 |  | +            size_t index = 0;
 | 
											
												
													
														|  | 
 |  | +            if (!decode_array_index_from_pointer(childptr, &index))
 | 
											
												
													
														|  |              {
 |  |              {
 | 
											
												
													
														|  | -                /* failed to parse numeric array index */
 |  | 
 | 
											
												
													
														|  |                  free(parentptr);
 |  |                  free(parentptr);
 | 
											
												
													
														|  |                  cJSON_Delete(value);
 |  |                  cJSON_Delete(value);
 | 
											
												
													
														|  |                  return 11;
 |  |                  return 11;
 | 
											
												
													
														|  |              }
 |  |              }
 | 
											
												
													
														|  |  
 |  |  
 | 
											
												
													
														|  | -            if ((index < 0) || (*end_pointer != '\0'))
 |  | 
 | 
											
												
													
														|  | -            {
 |  | 
 | 
											
												
													
														|  | -                /* array index is invalid */
 |  | 
 | 
											
												
													
														|  | -                free(parentptr);
 |  | 
 | 
											
												
													
														|  | -                cJSON_Delete(value);
 |  | 
 | 
											
												
													
														|  | -                return 12;
 |  | 
 | 
											
												
													
														|  | -            }
 |  | 
 | 
											
												
													
														|  | -
 |  | 
 | 
											
												
													
														|  | -            if (!insert_item_in_array(parent, (size_t)index, value))
 |  | 
 | 
											
												
													
														|  | 
 |  | +            if (!insert_item_in_array(parent, index, value))
 | 
											
												
													
														|  |              {
 |  |              {
 | 
											
												
													
														|  |                  free(parentptr);
 |  |                  free(parentptr);
 | 
											
												
													
														|  |                  cJSON_Delete(value);
 |  |                  cJSON_Delete(value);
 |