From 8638833cae22f4886ed64282281d5ebbc492f31b Mon Sep 17 00:00:00 2001 From: hanjinpeng Date: Mon, 14 Sep 2026 09:13:14 -0400 Subject: [PATCH] tokener: fix -Infinity parsing The transition from the number state to the Infinity state used case_len (bytes appended during the current call) and never reset st_pos: - L1: after another token set st_pos (e.g. "[true,-Infinity]"), the stale st_pos made the Infinity comparison length wrong, so a leading-minus Infinity after any other token failed to parse. - L2: when "-" and "Infinity" arrived in separate incremental calls, case_len was 0 on the second call and the -Infinity branch was never taken, yielding "number expected". Use tok->pb->bpos == 1 (the buffer holds exactly "-") to detect the leading minus regardless of call boundaries, and reset tok->st_pos. --- json_tokener.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/json_tokener.c b/json_tokener.c index 48d4109..94d43b4 100644 --- a/json_tokener.c +++ b/json_tokener.c @@ -762,7 +762,14 @@ struct fjson_object *fjson_tokener_parse_ex(struct fjson_tokener *tok, const cha printbuf_memappend_fast(tok->pb, case_start, case_len); // Check for -Infinity - if (tok->pb->buf[0] == '-' && case_len == 1 && (c == 'i' || c == 'I')) { + // Use bpos (the total number of bytes buffered so far) + // rather than case_len (only what this call appended), so + // that "-" and "Infinity" split across incremental calls + // are still recognized. Reset st_pos, which may carry a + // stale value from a previously parsed token. + if (tok->pb->bpos == 1 && tok->pb->buf[0] == '-' && + (c == 'i' || c == 'I')) { + tok->st_pos = 0; state = fjson_tokener_state_inf; goto redo_char; }