Stack Overflow fix on malformed JSON

jettison-json · Sep 21, 2022 · 395f862 · 395f862
1 parent a5d2223
commit 395f862
Show file tree

Hide file tree

Showing 2 changed files with 59 additions and 1 deletion.
diff --git a/src/main/java/org/codehaus/jettison/json/JSONTokener.java b/src/main/java/org/codehaus/jettison/json/JSONTokener.java
@@ -197,6 +197,9 @@ public char nextClean() throws JSONException {
                     }
                     break;
                 default:
+                    if (!more()) {
+                        throw syntaxError("The JSON text is malformed");
+                    }
                     back();
                     return '/';
                 }

diff --git a/src/test/java/org/codehaus/jettison/json/JSONObjectTest.java b/src/test/java/org/codehaus/jettison/json/JSONObjectTest.java
@@ -92,5 +92,60 @@ public void testForwardSlashEscapingModifiedfBySetter() throws Exception {
       assertEquals(obj.toString(), "{\"key\":\"http://example.com/foo\"}");
       obj.setEscapeForwardSlashAlways(true);
       assertEquals(obj.toString(), "{\"key\":\"http:\\/\\/example.com\\/foo\"}");
-   }
+    }
+
+    public void testMalformedObject() throws Exception {
+       try {
+           new JSONObject("{/");
+           fail("Failure expected on malformed JSON");
+       } catch (JSONException ex) {
+           // expected
+       }
+    }
+
+    public void testMalformedObject2() throws Exception {
+        try {
+            new JSONObject("{x");
+            fail("Failure expected on malformed JSON");
+        } catch (JSONException ex) {
+            // expected
+        }
+    }
+
+    public void testMalformedObject3() throws Exception {
+        try {
+            new JSONObject("{/x");
+            fail("Failure expected on malformed JSON");
+        } catch (JSONException ex) {
+            // expected
+        }
+    }
+
+    public void testMalformedObject4() throws Exception {
+        try {
+            new JSONObject("{/*");
+            fail("Failure expected on malformed JSON");
+        } catch (JSONException ex) {
+            // expected
+        }
+    }
+
+    public void testMalformedObject5() throws Exception {
+        try {
+            new JSONObject("{//");
+            fail("Failure expected on malformed JSON");
+        } catch (JSONException ex) {
+            // expected
+        }
+    }
+
+    public void testMalformedArray() throws Exception {
+        try {
+            new JSONObject("{[/");
+            fail("Failure expected on malformed JSON");
+        } catch (JSONException ex) {
+            // expected
+        }
+    }
+
 }