static const char *parse_array( cJSON *item, const char *value )
{
	cJSON *child;

	if ( *value != '[' ) {
		/* Not an array! */
		ep = value;
		return 0;
	}

	item->type = cJSON_Array;
	value = skip( value + 1 );
	if ( *value == ']' )
		return value + 1;	/* empty array. */

	if ( ! ( item->child = child = cJSON_New_Item() ) )
		return 0;		 /* memory fail */
	if ( ! ( value = skip( parse_value( child, skip( value ) ) ) ) )
		return 0;

	while ( *value == ',' ) {
		cJSON *new_item;
		if ( ! ( new_item = cJSON_New_Item() ) )
			return 0;	/* memory fail */
		child->next = new_item;
		new_item->prev = child;
		child = new_item;
		if ( ! ( value = skip( parse_value( child, skip( value+1 ) ) ) ) )
			return 0;	/* memory fail */
	}

	if ( *value == ']' )
		return value + 1;	/* end of array */
	/* Malformed. */
	ep = value;
	return 0;
}
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.