commit 59b049f

Backport from xs.

 1@@ -238,20 +238,39 @@ static xs_val *_xs_json_loads_lexer(const char **json, js_type *t)
 2                 case 't': c = '\t'; break;
 3                 case 'u': /* Unicode codepoint as an hex char */
 4                     s++;
 5-                    memcpy(tmp, s, 4);
 6-                    s += 3;
 7+                    strncpy(tmp, s, 4);
 8                     tmp[4] = '\0';
 9 
10+                    if (strlen(tmp) != 4) {
11+                        *t = JS_ERROR;
12+                        break;
13+                    }
14+
15+                    s += 3; /* skip as it was one byte */
16+
17                     sscanf(tmp, "%04x", &i);
18 
19                     if (i >= 0xd800 && i <= 0xdfff) {
20                         /* it's a surrogate pair */
21                         cp = (i & 0x3ff) << 10;
22 
23-                        /* skip to the next value */
24-                        s += 3;
25-                        memcpy(tmp, s, 4);
26-                        s += 3;
27+                        /* skip to the next value (last char + \ + u)  */
28+                        s++;
29+                        if (memcmp(s, "\\u", 2) != 0) {
30+                            *t = JS_ERROR;
31+                            break;
32+                        }
33+                        s += 2;
34+
35+                        strncpy(tmp, s, 4);
36+                        tmp[4] = '\0';
37+
38+                        if (strlen(tmp) != 4) {
39+                            *t = JS_ERROR;
40+                            break;
41+                        }
42+
43+                        s += 3; /* skip as it was one byte */
44 
45                         sscanf(tmp, "%04x", &i);
46                         cp |= (i & 0x3ff);

1@@ -1 +1 @@
2-/* 333e84c76cd0e51f9f98a36df2eb3bf81e0d2608 */
3+/* 494e346f92431041350f72431417eee03a23eafd */