[tanjiroK-coder]

cupsJSONExportString sizes its output in one pass over the tree and writes it in a second pass, but neither pass stops at the node it was given. When that node has a parent, both walks emit a leading ':' or ',', follow its siblings and climb into the ancestors, and only the write pass adds a closing ']' or '}' for each ancestor it climbs through, so the malloc'd string is overrun by one byte per enclosing level. cups-oauth hits this with server-supplied data: get-metadata URI NAME and get-user-id URI NAME export the value of NAME directly when it is an object or array, and the metadata and ID token claims both come from the remote server, so its nesting depth decides how far the write goes. Exporting "a" from {"a":{"b":{"c":{"d":{"e":[1]}}}},"z":2} gives an ASan heap-buffer-overflow WRITE at json.c:476, and even without the overflow the result carries a stray ':' and the following "z" member. Both passes now treat the exported node as the root of the walk, so nothing outside it is visited; output for a root node is unchanged. The new testjson case exports a child object and checks the string; it fails under ASan on master and passes with the fix, and make test is green.

[michaelrsweet]

Looks good. In the future, just put the changelog in the description and I'll manually add it. Thanks!