Fix incremental JSON parser numeric token reassembly across chunks.

Andrew Dunstan <andrew@dunslane.net>

Commit: 2e373785ec07102badee139236ac78c4da4f7c16
Author: Andrew Dunstan <andrew@dunslane.net>
Date: 2026-04-10T14:21:39Z
Releases: 17.10
Fix incremental JSON parser numeric token reassembly across chunks.

When the incremental JSON parser splits a numeric token across chunk
boundaries, it accumulates continuation characters into the partial
token buffer.  The accumulator's switch statement unconditionally
accepted '+', '-', '.', 'e', and 'E' as valid numeric continuations
regardless of position, which violated JSON number grammar
(-? int [frac] [exp]).  For example, input "4-" fed in single-byte
chunks would accumulate the '-' into the numeric token, producing an
invalid token that later triggered an assertion failure during
re-lexing.

Fix by tracking parser state (seen_dot, seen_exp, prev character)
across the existing partial token and incoming bytes, so that each
character class is accepted only in its grammatically valid position.

Backpatch-through: 17

Files

PathChange+/−
src/common/jsonapi.c modified +53 −2