Fix parsing of number with out of range negative exponents

Author: byroot

ext/json/ext/parser/parser.c

@@ -1169,11 +1169,11 @@ static inline VALUE json_decode_float(JSON_ParserConfig *config, uint64_t mantis
         return rb_funcallv(config->decimal_class, config->decimal_method_id, 1, &text);
     }
 
-    if (RB_UNLIKELY(exponent > INT32_MAX)) {
+    if (RB_UNLIKELY(exponent >= (int64_t)INT32_MAX)) {
         return negative ? CMinusInfinity : CInfinity;
     }
 
-    if (RB_UNLIKELY(exponent < INT32_MIN)) {
+    if (RB_UNLIKELY(exponent <= INT32_MIN)) {
         return rb_float_new(negative ? -0.0 : 0.0);
     }
 
@@ -1514,7 +1514,7 @@ static inline VALUE json_parse_number(JSON_ParserState *state, JSON_ParserConfig
         }
 
         if (RB_UNLIKELY(exponent_digits >= 20 || abs_exponent > (uint64_t)INT64_MAX)) {
-            exponent = negative_exponent ? INT64_MIN : INT64_MAX;
+            exponent = negative_exponent ? INT32_MIN : INT32_MAX;
         } else {
             exponent = negative_exponent ? -(int64_t)abs_exponent : (int64_t)abs_exponent;
         }

java/src/json/ext/Parser.java

@@ -147,6 +147,12 @@ def test_parse_numbers
     assert_raise(ParserError) { parse('-Infinity') }
     assert_equal(-1.0/0, parse('-Infinity', allow_nan: true))
     capture_output { assert_equal(Float::INFINITY, parse("23456789012E666")) }
+
+    assert_parse_float "1.5e-99999999999999999999"
+    assert_parse_float "1.5e-9223372036854775808"
+    assert_parse_float "0.0e-99999999999999999999"
+    assert_parse_float "-1.5e-99999999999999999999"
+    assert_parse_float "123.456e-18446744073709551615"
   end
 
   INTEGER_FAST_PATH_BOUNDARIES = [
@@ -1084,6 +1090,10 @@ def encode(*)
 
   private
 
+  def assert_parse_float(float_str)
+    assert_equal Float(float_str), JSON.parse(float_str)
+  end
+
   def assert_equal_float(expected, actual, delta = 1e-2)
     Array === expected and expected = expected.first
     Array === actual and actual = actual.first