From ce9520f888c2339b48565fcc5ffecc85091e589e Mon Sep 17 00:00:00 2001
From: Jeroen Ooms <jeroenooms@gmail.com>
Date: Thu, 26 Oct 2023 20:11:58 +0200
Subject: [PATCH] Port patch for CVE-2017-16516 From
 https://github.com/brianmario/yajl-ruby/pull/178

---
 src/yajl/yajl_encode.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/yajl/yajl_encode.c b/src/yajl/yajl_encode.c
index 1a62aaf..e9e2aae 100644
--- a/src/yajl/yajl_encode.c
+++ b/src/yajl/yajl_encode.c
@@ -139,8 +139,8 @@ void yajl_string_decode(yajl_buf buf, const unsigned char * str,
                     end+=3;
                     /* check if this is a surrogate */
                     if ((codepoint & 0xFC00) == 0xD800) {
-                        end++;
-                        if (str[end] == '\\' && str[end + 1] == 'u') {
+                        if (end + 2 < len && str[end + 1] == '\\' && str[end + 2] == 'u') {
+                            end++;
                             unsigned int surrogate = 0;
                             hexToDigit(&surrogate, str + end + 2);
                             codepoint =