Fix the parser to not accept invalid escapes

Only `"\/bfnrtu` are valid after a backslash.

Author: byroot

ext/json/ext/parser/parser.c

@@ -639,44 +639,41 @@ static inline VALUE json_string_fastpath(JSON_ParserState *state, const char *st
 static VALUE json_string_unescape(JSON_ParserState *state, const char *string, const char *stringEnd, bool is_name, bool intern, bool symbolize)
 {
     size_t bufferSize = stringEnd - string;
-    const char *p = string, *pe = string, *unescape, *bufferStart;
+    const char *p = string, *pe = string, *bufferStart;
     char *buffer;
-    int unescape_len;
-    char buf[4];
 
     VALUE result = rb_str_buf_new(bufferSize);
     rb_enc_associate_index(result, utf8_encindex);
     buffer = RSTRING_PTR(result);
     bufferStart = buffer;
 
+#define APPEND_CHAR(chr) *buffer++ = chr; p = ++pe;
+
     while (pe < stringEnd && (pe = memchr(pe, '\\', stringEnd - pe))) {
-        unescape = (char *) "?";
-        unescape_len = 1;
         if (pe > p) {
           MEMCPY(buffer, p, char, pe - p);
           buffer += pe - p;
         }
         switch (*++pe) {
+            case '"':
+            case '/':
+            case '\\':
+                p = pe; // nothing to unescape just need to skip the backslash
+                break;
             case 'n':
-                unescape = (char *) "\n";
+                APPEND_CHAR('\n');
                 break;
             case 'r':
-                unescape = (char *) "\r";
+                APPEND_CHAR('\r');
                 break;
             case 't':
-                unescape = (char *) "\t";
-                break;
-            case '"':
-                unescape = (char *) "\"";
-                break;
-            case '\\':
-                unescape = (char *) "\\";
+                APPEND_CHAR('\t');
                 break;
             case 'b':
-                unescape = (char *) "\b";
+                APPEND_CHAR('\b');
                 break;
             case 'f':
-                unescape = (char *) "\f";
+                APPEND_CHAR('\f');
                 break;
             case 'u':
                 if (pe > stringEnd - 5) {
@@ -714,18 +711,20 @@ static VALUE json_string_unescape(JSON_ParserState *state, const char *string, c
                             break;
                         }
                     }
-                    unescape_len = convert_UTF32_to_UTF8(buf, ch);
-                    unescape = buf;
+
+                    char buf[4];
+                    int unescape_len = convert_UTF32_to_UTF8(buf, ch);
+                    MEMCPY(buffer, buf, char, unescape_len);
+                    buffer += unescape_len;
+                    p = ++pe;
                 }
                 break;
             default:
-                p = pe;
-                continue;
+                UNREACHABLE_RETURN(Qundef);
+                break;
         }
-        MEMCPY(buffer, unescape, char, unescape_len);
-        buffer += unescape_len;
-        p = ++pe;
     }
+#undef APPEND_CHAR
 
     if (stringEnd > p) {
       MEMCPY(buffer, p, char, stringEnd - p);
@@ -925,6 +924,18 @@ static const bool string_scan_table[256] = {
      0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 };
 
+static const bool valid_escape_chars[256] = {
+    ['\\'] = true,
+    ['"'] = true,
+    ['/'] = true,
+    ['b'] = true,
+    ['f'] = true,
+    ['n'] = true,
+    ['r'] = true,
+    ['t'] = true,
+    ['u'] = true,
+};
+
 #ifdef HAVE_SIMD
 static SIMD_Implementation simd_impl = SIMD_NONE;
 #endif /* HAVE_SIMD */
@@ -976,8 +987,12 @@ static inline VALUE json_parse_string(JSON_ParserState *state, JSON_ParserConfig
             case '\\': {
                 state->cursor++;
                 escaped = true;
-                if ((unsigned char)*state->cursor < 0x20) {
-                    raise_parse_error("invalid ASCII control character in string: %s", state);
+
+                if (RB_UNLIKELY(!valid_escape_chars[(unsigned char)*state->cursor])) {
+                    if ((unsigned char)*state->cursor < 0x20) {
+                        raise_parse_error("invalid ASCII control character in string: %s", state);
+                    }
+                    raise_parse_error("invalid escape character in string: %s", state);
                 }
                 break;
             }

test/json/fixtures/pass15.json test/json/fixtures/fail15.jsontest/json/fixtures/pass15.json renamed to test/json/fixtures/fail15.json

@@ -10,6 +10,8 @@ class JSONFixturesTest < Test::Unit::TestCase
     source = File.read(f)
     define_method("test_#{name}") do
       assert JSON.parse(source), "Did not pass for fixture '#{File.basename(f)}': #{source.inspect}"
+    rescue JSON::ParserError
+      raise "#{File.basename(f)} parsing failure"
     end
   end
 

test/json/fixtures/pass16.json test/json/fixtures/fail16.jsontest/json/fixtures/pass16.json renamed to test/json/fixtures/fail16.json

@@ -510,8 +510,8 @@ def test_backslash
     data = ['"']
     assert_equal data, parse(json)
     #
-    json = '["\\\'"]'
-    data = ["'"]
+    json = '["\\/"]'
+    data = ["/"]
     assert_equal data, parse(json)
 
     json = '["\/"]'