picojson - Abort on parsing possible DoS

[dzonerzy]

During a security review of picojson i found an interesting testcase which will crash picojson due to an abort call, the issue seems to be related to how picojson handle numbers with exponent, below a screenshot:

i don't investigate further anyway would be nice to have this fixed, let me know if you need more info.

Best Regards,
Daniele

[kazuho]

Thank you for reporting the issue.

At the moment, we indeed throw a std::overflow error when a parsed number is out-of-bounds. https://github.com/kazuho/picojson/blob/master/picojson.h#L230

But I agree that when parsing a JSON string we should better report it as an ordinary parse error instead of an exception.