From 395f8625bcf688743872c8e7f59360d372e77811 Mon Sep 17 00:00:00 2001
From: Colm O hEigeartaigh <coheigea@apache.org>
Date: Wed, 21 Sep 2022 15:45:41 +0100
Subject: [PATCH] Stack Overflow fix on malformed JSON

---
 .../codehaus/jettison/json/JSONTokener.java   |  3 +
 .../jettison/json/JSONObjectTest.java         | 57 ++++++++++++++++++-
 2 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/codehaus/jettison/json/JSONTokener.java b/src/main/java/org/codehaus/jettison/json/JSONTokener.java
index 4ce90a8..a35be88 100644
--- a/src/main/java/org/codehaus/jettison/json/JSONTokener.java
+++ b/src/main/java/org/codehaus/jettison/json/JSONTokener.java
@@ -197,6 +197,9 @@ public char nextClean() throws JSONException {
                     }
                     break;
                 default:
+                    if (!more()) {
+                        throw syntaxError("The JSON text is malformed");
+                    }
                     back();
                     return '/';
                 }
diff --git a/src/test/java/org/codehaus/jettison/json/JSONObjectTest.java b/src/test/java/org/codehaus/jettison/json/JSONObjectTest.java
index 6fbd919..acd8246 100644
--- a/src/test/java/org/codehaus/jettison/json/JSONObjectTest.java
+++ b/src/test/java/org/codehaus/jettison/json/JSONObjectTest.java
@@ -92,5 +92,60 @@ public void testForwardSlashEscapingModifiedfBySetter() throws Exception {
       assertEquals(obj.toString(), "{\"key\":\"http://example.com/foo\"}");
       obj.setEscapeForwardSlashAlways(true);
       assertEquals(obj.toString(), "{\"key\":\"http:\\/\\/example.com\\/foo\"}");
-   }
+    }
+
+    public void testMalformedObject() throws Exception {
+       try {
+           new JSONObject("{/");
+           fail("Failure expected on malformed JSON");
+       } catch (JSONException ex) {
+           // expected
+       }
+    }
+
+    public void testMalformedObject2() throws Exception {
+        try {
+            new JSONObject("{x");
+            fail("Failure expected on malformed JSON");
+        } catch (JSONException ex) {
+            // expected
+        }
+    }
+
+    public void testMalformedObject3() throws Exception {
+        try {
+            new JSONObject("{/x");
+            fail("Failure expected on malformed JSON");
+        } catch (JSONException ex) {
+            // expected
+        }
+    }
+
+    public void testMalformedObject4() throws Exception {
+        try {
+            new JSONObject("{/*");
+            fail("Failure expected on malformed JSON");
+        } catch (JSONException ex) {
+            // expected
+        }
+    }
+
+    public void testMalformedObject5() throws Exception {
+        try {
+            new JSONObject("{//");
+            fail("Failure expected on malformed JSON");
+        } catch (JSONException ex) {
+            // expected
+        }
+    }
+
+    public void testMalformedArray() throws Exception {
+        try {
+            new JSONObject("{[/");
+            fail("Failure expected on malformed JSON");
+        } catch (JSONException ex) {
+            // expected
+        }
+    }
+
 }