eval/decode: Reject even more numbers

Rejects leading zeroes and numbers like 1.e+5 (decimal dot with missing number 
with signed exponent).

2 files changed, 45 insertions, 1 deletions

diff --git a/src/nvim/eval/decode.c b/src/nvim/eval/decode.c
index ec3be2cfb6..f74f2b3150 100644
--- a/src/nvim/eval/decode.c
+++ b/src/nvim/eval/decode.c
@@ -492,6 +492,7 @@ static inline int parse_json_number(const char *const buf, const size_t buf_len,
   const char *ints = NULL;
   const char *fracs = NULL;
   const char *exps = NULL;
+  const char *exps_s = NULL;
   if (*p == '-') {
     p++;
   }
@@ -499,6 +500,10 @@ static inline int parse_json_number(const char *const buf, const size_t buf_len,
   while (p < e && ascii_isdigit(*p)) {
     p++;
   }
+  if (p != ints + 1 && *ints == '0') {
+    emsgf(_("E474: Leading zeroes are not allowed: %.*s"), LENP(s, e));
+    goto parse_json_number_fail;
+  }
   if (p < e && p != ints && (*p == '.' || *p == 'e' || *p == 'E')) {
     if (*p == '.') {
       p++;
@@ -509,6 +514,7 @@ static inline int parse_json_number(const char *const buf, const size_t buf_len,
     }
     if (p < e && (*p == 'e' || *p == 'E')) {
       p++;
+      exps_s = p;
       if (p < e && (*p == '-' || *p == '+')) {
         p++;
       }
@@ -521,7 +527,7 @@ static inline int parse_json_number(const char *const buf, const size_t buf_len,
   if (p == ints) {
     emsgf(_("E474: Missing number after minus sign: %.*s"), LENP(s, e));
     goto parse_json_number_fail;
-  } else if (p == fracs || exps == fracs + 1) {
+  } else if (p == fracs || exps_s == fracs + 1) {
     emsgf(_("E474: Missing number after decimal dot: %.*s"), LENP(s, e));
     goto parse_json_number_fail;
   } else if (p == exps) {
diff --git a/test/functional/eval/json_functions_spec.lua b/test/functional/eval/json_functions_spec.lua
index 0140ad79aa..8438620109 100644
--- a/test/functional/eval/json_functions_spec.lua
+++ b/test/functional/eval/json_functions_spec.lua
@@ -119,6 +119,8 @@ describe('json_decode() function', function()
     eq(-100000, funcs.json_decode('-100000'))
     eq(100000, funcs.json_decode('  100000  '))
     eq(-100000, funcs.json_decode('  -100000  '))
+    eq(0, funcs.json_decode('0'))
+    eq(0, funcs.json_decode('-0'))
   end)
 
   it('fails to parse +numbers and .number', function()
@@ -128,6 +130,17 @@ describe('json_decode() function', function()
        exc_exec('call json_decode(".1000")'))
   end)
 
+  it('fails to parse numbers with leading zeroes', function()
+    eq('Vim(call):E474: Leading zeroes are not allowed: 00.1',
+       exc_exec('call json_decode("00.1")'))
+    eq('Vim(call):E474: Leading zeroes are not allowed: 01',
+       exc_exec('call json_decode("01")'))
+    eq('Vim(call):E474: Leading zeroes are not allowed: -01',
+       exc_exec('call json_decode("-01")'))
+    eq('Vim(call):E474: Leading zeroes are not allowed: -001.0',
+       exc_exec('call json_decode("-001.0")'))
+  end)
+
   it('fails to parse incomplete numbers', function()
     eq('Vim(call):E474: Missing number after minus sign: -.1',
        exc_exec('call json_decode("-.1")'))
@@ -147,6 +160,10 @@ describe('json_decode() function', function()
        exc_exec('call json_decode("0.0e-")'))
     eq('Vim(call):E474: Missing number after decimal dot: 1.e5',
        exc_exec('call json_decode("1.e5")'))
+    eq('Vim(call):E474: Missing number after decimal dot: 1.e+5',
+       exc_exec('call json_decode("1.e+5")'))
+    eq('Vim(call):E474: Missing number after decimal dot: 1.e+',
+       exc_exec('call json_decode("1.e+")'))
   end)
 
   it('parses floating-point numbers', function()
@@ -159,6 +176,27 @@ describe('json_decode() function', function()
     eq(-100000.5e-50, funcs.json_decode('-100000.5e-50'))
     eq(100000.5e-50, funcs.json_decode('100000.5e-50'))
     eq(100000e-50, funcs.json_decode('100000e-50'))
+    eq(0.5, funcs.json_decode('0.5'))
+    eq(0.005, funcs.json_decode('0.005'))
+    eq(0.005, funcs.json_decode('0.00500'))
+    eq(0.5, funcs.json_decode('0.00500e+002'))
+    eq(0.00005, funcs.json_decode('0.00500e-002'))
+
+    eq(-0.0, funcs.json_decode('-0.0'))
+    eq(-0.0, funcs.json_decode('-0.0e0'))
+    eq(-0.0, funcs.json_decode('-0.0e+0'))
+    eq(-0.0, funcs.json_decode('-0.0e-0'))
+    eq(-0.0, funcs.json_decode('-0e-0'))
+    eq(-0.0, funcs.json_decode('-0e-2'))
+    eq(-0.0, funcs.json_decode('-0e+2'))
+
+    eq(0.0, funcs.json_decode('0.0'))
+    eq(0.0, funcs.json_decode('0.0e0'))
+    eq(0.0, funcs.json_decode('0.0e+0'))
+    eq(0.0, funcs.json_decode('0.0e-0'))
+    eq(0.0, funcs.json_decode('0e-0'))
+    eq(0.0, funcs.json_decode('0e-2'))
+    eq(0.0, funcs.json_decode('0e+2'))
   end)
 
   it('fails to parse numbers with spaces inside', function()