json: avoid buffer overread in Json::parse_primitive

[pallas]

It looks like this code as copy-and-pasted from similar code above it that checks s+1==end. That code actually uses s[1] and knows s[0], so it's correct. This code is not correct and the effect is that it will overread when parsing a number with a single-digit exponent at the end of a buffer. It also allows malformed numbers with a valid second digit but invalid second digit to parse.

Found by @bannable.

[kohler]

bangs head on desk

[kohler]

This code has evolved out of the Click context. Here's a later version:

https://github.com/kohler/masstree-beta/blob/master/json.cc

That code has several advantages, including that it stores integers as integers rather than as strings. It is better tested and it didn't have this particular bug (I'm not saying it has zero). But it is so different that probably you don't want it merged, unless you use Jsons a lot.

[kohler]

Thanks!!

[pallas]

Maybe it's worth forking and subgitting the Collection of Kohler Tools. I know String has diverged between projects as well.