[ck0i]

Fixes #1122

Root cause

cJSON_PrintBuffered accepts a prebuffer of 0. It then calls allocate(0), which may return a non-null pointer to a zero-byte object, and stores that size in the print buffer's length.

Custom hooks installed with cJSON_InitHooks set malloc_fn/free_fn and leave reallocate unset, unless those functions are the raw libc malloc/free pair. ensure() grows such a buffer by allocating a new one and copying with memcpy(newbuffer, p->buffer, p->offset + 1). When length and offset are both 0, that copy reads one byte from a zero-sized allocation. The default hooks use realloc and never reach this path.

Fix

In the manual growth path of ensure(), copy from the old buffer only when p->length > 0. A zero-length buffer owns no bytes.

Testing

Windows 11 x64, MSVC 19.51.36256, CMake + Ninja, Debug.

New tests in tests/misc_tests.c:

• ensure_should_not_copy_from_zero_length_buffer points a zero-length print buffer at a static 'X' byte, uses a zero-filling malloc and no reallocate hook, grows it with ensure(), and checks the first byte of the new buffer is still 0
• print_buffered_should_print_with_zero_prebuffer_and_custom_hooks prints 42 through cJSON_PrintBuffered with prebuffer 0 and custom hooks

Before: ensure_should_not_copy_from_zero_length_buffer fails (Expected 0 Was 88), misc_tests 31/32.
After: passes, misc_tests 32/32 and the full ctest suite 22/22.