Correctness: invalid JSON accepted for leading and trailing special characters

[lvkv]

The following examples are invalid JSON, but are parsed without error by jsmn, even in strict mode:

":{}"
",{}"
":::{},"
"::,:,::{}:::,,,,:"

The pattern here seems to be that any number of leading or trailing commas or colons around what is otherwise valid JSON is still parsed as valid JSON instead of returning an error.

Here's an example test that, when added to the test suite, still passes despite containing invalid JSON:

int test_leading_trailing_colons_commas(void) {
  jsmn_parser p;
  const char *js;

  js = ":,:{},:,";
  jsmn_init(&p);
  check(jsmn_parse(&p, js, strlen(js), NULL, 0) == 1);
  return 0;
}

  test(test_object_key, "test for key type");
+ test(test_leading_trailing_colons_commas, "just showing that the test was actually added to the test suite");

Tests passing despite the invalid JSON, even in strict mode:

> make test
cc   test/tests.c -o test/test_default
./test/test_default

PASSED: 17
FAILED: 0
cc -DJSMN_STRICT=1   test/tests.c -o test/test_strict
./test/test_strict

PASSED: 17
FAILED: 0
cc -DJSMN_PARENT_LINKS=1   test/tests.c -o test/test_links
./test/test_links

PASSED: 17
FAILED: 0
cc -DJSMN_STRICT=1 -DJSMN_PARENT_LINKS=1   test/tests.c -o test/test_strict_links
./test/test_strict_links

PASSED: 17
FAILED: 0

Where this came from

This finding originates from running CBMC on jsmn_parse, which took issue with the following lines when running on an input of ":":

jsmn/jsmn.h

Lines 376 to 378 in 25647e6

	case ':':
	parser->toksuper = parser->toknext - 1;
	break;

• --unsigned-overflow-check found that parser->toknext, an unsigned int, will underflow from 0 on this input
• --conversion-check found that this line then assigns that unsigned int value to a normal int, parser->toksuper

Thanks for considering this report! And apologies if this has been reported before—we did try looking through the issues but didn't find one that was quite like this.

CC @G-M-twostay @ValDLaw who helped out with this