json.c: Fail on bad escape string.

1 files changed, 3 insertions, 2 deletions

diff --git a/json.c b/json.c
index 6f444c18..5c4dd3de 100644
--- a/json.c
+++ b/json.c
@@ -396,8 +396,9 @@ static int json_internal_read_object(const char *cp,
 		    uescape[n] = *cp++;
 		uescape[n] = '\0';      /* terminate */
 		--cp;
-		(void)sscanf(uescape, "%04x", &u);
-		*pval++ = (char)u;	/* will truncate values above 0xff */
+		if (1 != sscanf(uescape, "%4x", &u))
+		    return JSON_ERR_BADSTRING;
+		*pval++ = (char)u;  /* will truncate values above 0xff */
 		break;
 	    default:		/* handles double quote and solidus */
 		*pval++ = *cp;