miloyip/rapidjson — pull request #7 by rsolomakhin (2014-06-17 03:59:38+00:00)
Title: Fix out-of-bounds read in document.h

FindMember() compares length of "name" and "member->name.data_.s" via "name[member->name.data_.s.length] == '\0'", which can lead to reading past the length of "name". This patch stores the length of "name" (as determined by position of '\0') into "name_length" and changes the length comparison to be "name_length == "member->name.data_.s.length".