Description

This PR addresses a Type Confusion vulnerability found in cJSON_Utils.c.

Root Cause

When processing certain JSON patches (e.g., [{"op":"move","from":0,"path":"/obj/b"}]), the code checks if the from node exists (from == NULL), but fails to validate if it is actually a string before operating on it. This causes the program to treat non-string objects (like integers or objects) as strings, leading to Type Confusion and potential Segmentation Faults (SIGSEGV) or Out-Of-Bounds (OOB) reads when searching/applying patches.

The Fix

Added a stricter validation check using cJSON_IsString(from) instead of just checking for NULL to ensure the structure is safe before moving forward.

Impact

Prevents denial of service (DoS) and memory access violations when untrusted, malformed JSON patches are supplied to the utility API.