Do not silently truncate values or skip entries if out of memory errors
occur.

Proof of Concept:

- Create poc.c, a program which creates an eight megabyte large json
  object with key "A" and a lot of "B"s as value, one of them is
  UTF-formatted:

```c
 #include <err.h>
 #include <stdio.h>
 #include <string.h>

 #include "json.h"

 #define STR_LEN (8 * 1024 * 1024)
 #define STR_PREFIX "{ \"A\": \""
 #define STR_SUFFIX "\\u0042\" }"

int main(void) {
  char *str;
  struct json_tokener *tok;
  struct json_object *obj;

  if ((tok = json_tokener_new()) == NULL)
    errx(1, "json_tokener_new");

  if ((str = malloc(STR_LEN)) == NULL)
    err(1, "malloc");
  memset(str, 'B', STR_LEN);
  memcpy(str, STR_PREFIX, sizeof(STR_PREFIX) - 1);
  memcpy(str + STR_LEN - sizeof(STR_SUFFIX), STR_SUFFIX, sizeof(STR_SUFFIX));

  obj = json_tokener_parse(str);
  free(str);

  printf("%p\n", obj);
  if (obj != NULL) {
    printf("%.*s\n", 50, json_object_to_json_string(obj));
    json_object_put(obj);
  }

  json_tokener_free(tok);
  return 0;
}
```
- Compile and run poc, assuming you have enough free heap space:
```
gcc $(pkg-config --cflags --libs) -o poc poc.c
./poc
0x559421e15de0
{ "A": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
```
- Reduce available heap and run again, which leads to truncation:
```
ulimit -d 10000
./poc
0x555a5b453de0
{ "A": "B" }
```
- Compile json-c with this change and run with reduced heap again:
```
ulimit -d 10000
./poc
(nil)
```

The output is limited to 70 characters, i.e. json-c parses the 8 MB
string correctly but the poc does not print all of them to the screen.

The truncation occurs because the parser tries to add all chars up
to the UTF-8 formatted 'B' at once. Since memory is limited to 10 MB
there is not enough for this operation. The parser does not fail but
continues normally.

Another possibility is to create a json file close to 2 GB and run a
program on a system with limited amount of RAM, i.e. around 3 GB. But
ulimit restrictions are much easier for proof of concepts.

Treat memory errors correctly and abort operations.

While here, drop the utf8_replacement_char that is unnecesarily added if we run out of input in the middle of a unicode escape.  No other functional changes (yet).

closes #422

* CVE-2013-6371: hash collision denial of service
* CVE-2013-6370: buffer overflow if size_t is larger than int

Add documentation for the json_tokener_parse_ex() function.

git-svn-id: http://svn.metaparadigm.com/svn/json-c/trunk@62 327403b1-1117-474d-bef2-5cb71233fd97

Eric Haszlakiewicz, EHASZLA at transunion dot com



git-svn-id: http://svn.metaparadigm.com/svn/json-c/trunk@42 327403b1-1117-474d-bef2-5cb71233fd97

* Add casts from void* to type of assignment when using malloc 
  * Add #ifdef __cplusplus guards to all of the headers
  * Add typedefs for json_object, json_tokener, array_list, printbuf, lh_table
    Michael Clark, <michael@metaparadigm.com>


git-svn-id: http://svn.metaparadigm.com/svn/json-c/trunk@33 327403b1-1117-474d-bef2-5cb71233fd97

-- Geoffrey Young, geoff at modperlcookbook dot org



git-svn-id: http://svn.metaparadigm.com/svn/json-c/trunk@21 327403b1-1117-474d-bef2-5cb71233fd97

-Wmissing-prototypes -Wstrict-prototypes -Wmissing-declarations
Geoffrey Young, geoff at modperlcookbook dot org



git-svn-id: http://svn.metaparadigm.com/svn/json-c/trunk@20 327403b1-1117-474d-bef2-5cb71233fd97

Mateusz Loskot, mateusz at loskot dot net
  * Add stddef.h include



git-svn-id: http://svn.metaparadigm.com/svn/json-c/trunk@19 327403b1-1117-474d-bef2-5cb71233fd97

* Add escaping of foward slash on tokenizing and output
  * Changes to internal tokenizer from using recursion to
    using a depth state structure to allow incremental parsing


git-svn-id: http://svn.metaparadigm.com/svn/json-c/trunk@14 327403b1-1117-474d-bef2-5cb71233fd97

Johan Bj�rklund, johbjo09 at kth dot se
  * Remove include "config.h" from headers (should only
    be included from .c files)
    Michael Clark <michael@metaparadigm.com>


git-svn-id: http://svn.metaparadigm.com/svn/json-c/trunk@12 327403b1-1117-474d-bef2-5cb71233fd97

* Add ifdef C++ extern "C" to headers
  * Use simpler definition of min and max in bits.h
    Larry Lansing, llansing at fuzzynerd dot com

  * Remove automake 1.6 requirement
  * Move autogen commands into autogen.sh. Update README
  * Remove error pointer special case for Windows
  * Change license from LGPL to MIT
    Michael Clark <michael@metaparadigm.com>


git-svn-id: http://svn.metaparadigm.com/svn/json-c/trunk@10 327403b1-1117-474d-bef2-5cb71233fd97

Added a Win32/Win64 compliant implementation of vasprintf
  * debug.c - C. Watford (christopher dot watford at gmail dot com)
    Removed usage of vsyslog on Win32/Win64 systems, needs to be handled
    by a configure script
  * json_object.c - C. Watford (christopher dot watford at gmail dot com)
    Added scope operator to wrap usage of json_object_object_foreach, this
    needs to be rethought to be more ANSI C friendly
  * json_object.h - C. Watford (christopher dot watford at gmail dot com)
    Added Microsoft C friendly version of json_object_object_foreach
  * json_tokener.c - C. Watford (christopher dot watford at gmail dot com)
    Added a Win32/Win64 compliant implementation of strndup
  * json_util.c - C. Watford (christopher dot watford at gmail dot com)
    Added cast and mask to suffice size_t v. unsigned int conversion
    correctness
  * json_tokener.c - sign reversal issue on error info for nested object parse
    spotted by Johan Bj�rklund (johbjo09 at kth.se)
  * json_object.c - escape " in json_escape_str
  * Change to automake and libtool to build shared and static library
    Michael Clark <michael@metaparadigm.com>


git-svn-id: http://svn.metaparadigm.com/svn/json-c/trunk@4 327403b1-1117-474d-bef2-5cb71233fd97

git-svn-id: http://svn.metaparadigm.com/svn/json-c/trunk@2 327403b1-1117-474d-bef2-5cb71233fd97