NULL pointer dereference in jsonsl

[yunho-kim]

Dear Mark Nunberg,
We have found a NULL pointer dereference issue in jsonsl.
The crash input is automatically generated by our test generation tool FOCAL.
You can find crash.json in crash.zip

Here are details to reproduce the NULL pointer dereference.

• OS & Compiler
  Ubuntu Linux 16.04 x64 and GCC 5.4.0
• Build command
  $ CFLAGS="-fsanitize=address" make clean check
• Run command
  $ tests/json_test crash.json
• Outputs

==== crash.json                               ====
ASAN:SIGSEGV
=================================================================
==27936==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000040172d bp 0x000000000000 sp 0x7ffcd3a85100 T0)
    #0 0x40172c  (/home/yhkim/jsonsl/tests/json_test+0x40172c)
    #1 0x7fe104b1a804  (/home/yhkim/jsonsl/libjsonsl.so+0x2804)
    #2 0x401c30  (/home/yhkim/jsonsl/tests/json_test+0x401c30)
    #3 0x4012f1  (/home/yhkim/jsonsl/tests/json_test+0x4012f1)
    #4 0x7fe10476e82f  (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #5 0x4015c8  (/home/yhkim/jsonsl/tests/json_test+0x4015c8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
==27936==ABORTING
Aborted