Function bounded_datum_len

common/json_parse_simple.c:215–242

Iteratively count the tokens in the first datum of toks[], rejecting * anything nested deeper than JSON_MAX_NESTING. On success sets *len to the * token count (as json_next(toks) - toks would) and returns true; returns * false without recursing on over-nested, attacker-controlled input. */

 * token count (as json_next(toks) - toks would) and returns true; returns
 * false without recursing on over-nested, attacker-controlled input. */
static bool bounded_datum_len(const jsmntok_t *toks, size_t *len)
{
	/* remaining[d] = child datums still to visit at nesting level d;
	 * level 0 holds the single root datum. */
	size_t remaining[JSON_MAX_NESTING + 1];
	size_t depth = 0, i = 0;

	remaining[0] = 1;
	for (;;) {
		/* Ascend out of every level we have finished. */
		while (remaining[depth] == 0) {
			if (depth == 0) {
				*len = i;
				return true;
			}
			depth--;
		}
		remaining[depth]--;

		/* Descend into this token's children, if it has any. */
		if (toks[i].size != 0) {
			if (depth == JSON_MAX_NESTING)
				return false;
			remaining[++depth] = toks[i].size;
		}
		i++;
	}
}

const jsmntok_t *json_get_membern(const char *buffer,
				  const jsmntok_t tok[],