[Bug Report]: semantic bug in parsing json file

[Dongmuliang]

Contact Details

[email protected]

What happened?

A bug happened! 运行环境: ubuntu 22.04 固件版本: no

Version

master (Default)

What soultions are you seeing the problem on?

No response

Relevant log output

To demonstrate the semantic bug, I use the following code to parse a json text:

const char *s = "{\"a\": true, \"b\": [ null,9999999999999999999999999999999999999999999999912345678901234567]}";
cJSON *root = NULL;

root = cJSON_Parse(s);
if (root == NULL) {
       const char *error_ptr = cJSON_GetErrorPtr();
       printf("error in json data:%s\n", error_ptr);
}

It outputs the error message. However, according to the specification https://www.rfc-editor.org/rfc/rfc7159, JSON parser MUST accept all texts that conform to the JSON grammar. I have checked it against other parsers, e.g., https://jsonlint.com/, https://github.com/nlohmann/json, etc. All of them accepts the text. This kind of bug has potential security threats especially when different json parser involved (e.g., client side and server side), it may lead to some unexpected errors (e.g., cause data to get out of sync).