Uncaught Exception in Parser

[GanbaruTobi]

The parser fails to throw the ParseException when the parser expects the input to be of the float number type AND the input not being a valid number. This can lead to uncaught exceptions by unexpected input, which may lead to Denial-of-Service (DoS).

json-smart-v1/json-smart/src/main/java/net/minidev/json/parser/JSONParserBase.java

Lines 134 to 142 in 51e1641

	protected Number extractFloat() throws ParseException {
	if (!acceptLeadinZero)
	checkLeadinZero();
	if (!useHiPrecisionFloat)
	return Float.parseFloat(xs);
	if (xs.length() > 18) // follow JSonIJ parsing method
	return new BigDecimal(xs);
	return Double.parseDouble(xs);
	}

Parser Input of "-." or "2e+" or "[45e-" will crash with a NumberFormatException.

== Java Exception: java.lang.NumberFormatException: For input string: "-."
	at java.base/jdk.internal.math.FloatingDecimal.readJavaFormatString(FloatingDecimal.java:2054)
	at java.base/jdk.internal.math.FloatingDecimal.parseDouble(FloatingDecimal.java:110)
	at java.base/java.lang.Double.parseDouble(Double.java:549)
	at net.minidev.json.parser.JSONParserBase.extractFloat(JSONParserBase.java:141)
	at net.minidev.json.parser.JSONParserMemory.readNumber(JSONParserMemory.java:81)
	at net.minidev.json.parser.JSONParserBase.readMain(JSONParserBase.java:379)
	at net.minidev.json.parser.JSONParserBase.parse(JSONParserBase.java:156)
	at net.minidev.json.parser.JSONParserString.parse(JSONParserString.java:56)
	at net.minidev.json.parser.JSONParserString.parse(JSONParserString.java:37)
	at net.minidev.json.parser.JSONParser.parse(JSONParser.java:140)

[pronovic]

Note that this is tied to CVE-2021-27568, categorized as base score 9.1 (critical).

[UrielCh]

New version released 1.3.2 with CVE-2021-27568 fixed
json-smart-mini had also been patched and released.