Fixed deserializeJson() not being picky enough (fixes #969)

CHANGELOG.md

@@ -5,6 +5,7 @@ HEAD
 ----
 
 * Fixed error "attributes are not allowed on a function-definition"
+* Fixed `deserializeJson()` not being picky enough (issue #969)
 
 v6.10.0 (2019-03-22)
 -------

src/ArduinoJson/Numbers/parseNumber.hpp

@@ -140,6 +140,9 @@ inline ParsedNumber<TFloat, TUInt> parseNumber(const char *s) {
   }
   exponent += exponent_offset;
 
+  // we should be at the end of the string, otherwise it's an error
+  if (*s != '\0') return return_type();
+
   TFloat result = traits::make_float(static_cast<TFloat>(mantissa), exponent);
 
   return is_negative ? -result : result;

test/JsonDeserializer/invalid_input.cpp

@@ -7,8 +7,8 @@
 #include <catch.hpp>
 
 TEST_CASE("Invalid JSON input") {
-  const char* testCases[] = {"'\\u'",     "'\\u000g'", "'\\u000'",
-                             "'\\u000G'", "'\\u000/'", "\\x1234"};
+  const char* testCases[] = {"'\\u'",     "'\\u000g'", "'\\u000'", "'\\u000G'",
+                             "'\\u000/'", "\\x1234",   "6a9"};
   const size_t testCount = sizeof(testCases) / sizeof(testCases[0]);
 
   DynamicJsonDocument doc(4096);

test/Numbers/parseNumber.cpp

@@ -16,3 +16,9 @@ TEST_CASE("Test uint32_t overflow") {
   REQUIRE(first.type() == uint8_t(VALUE_IS_POSITIVE_INTEGER));
   REQUIRE(second.type() == uint8_t(VALUE_IS_FLOAT));
 }
+
+TEST_CASE("Invalid value") {
+  ParsedNumber<float, uint32_t> result = parseNumber<float, uint32_t>("6a3");
+
+  REQUIRE(result.type() == uint8_t(VALUE_IS_NULL));
+}