limit numeric token length during parsing

Reject overly long numeric tokens before allocating temporary number
strings to avoid unbounded allocations for malformed or malicious JSON
input.

Author: roko-op

cJSON.c

@@ -323,7 +323,7 @@ static cJSON_bool parse_number(cJSON * const item, parse_buffer * const input_bu
      * of the current locale (for strtod)
      * This also takes care of '\0' not necessarily being available for marking the end of the input */
     for (i = 0; can_access_at_index(input_buffer, i); i++)
-    {
+    {        
         switch (buffer_at_offset(input_buffer)[i])
         {
             case '0':
@@ -351,6 +351,10 @@ static cJSON_bool parse_number(cJSON * const item, parse_buffer * const input_bu
             default:
                 goto loop_end;
         }
+        if (number_string_length > CJSON_NUMBER_LENGTH_LIMIT)
+        {
+            return false;
+        }
     }
 loop_end:
     /* malloc for temporary buffer, add 1 for '\0' */

cJSON.h

@@ -99,6 +99,10 @@ then using the CJSON_API_VISIBILITY flag to "export" the same symbols the way CJ
 #define cJSON_IsReference 256
 #define cJSON_StringIsConst 512
 
+#ifndef CJSON_NUMBER_LENGTH_LIMIT
+#define CJSON_NUMBER_LENGTH_LIMIT 512
+#endif
+
 /* The cJSON structure: */
 typedef struct cJSON
 {