cJSON prior to 1.7.11 allows out-of-bounds access, related to \x00 in a string literal.
cjson project cjson
oracle timesten in-memory database