OSS-Fuzz stack overflow issues (21589, 21663, 21709, 21710, 21805)

[danielaparker]

Thanks to David Korczynski, jsoncons is now continuously fuzz tested with Google's OSS-Fuzz.

A number of stack overflow issues were reported that could be triggered by unreasonable or malicious input.

Issue 1:

During basic_json destruction, an internal compiler stack error occurred in the underlying container std::vector destructor after reaching a certain nesting depth, reproducible with approximately 270 levels of nesting with Visual Studio (various versions) on Windows.

Fixed by introducing destructors for json arrays and json objects that first flatten flatten the (possibly deeply nested) std::vector elements.

Issue 2.

While jsoncons parsers largely avoid recursive function calls, the cbor and msgpack implementations allowed for recursion when translating "even" array or object items into string keys.

Fixed by introducing a non-recursive way of translating "even" array or object items into string keys.

Issue 3.

While the parsers that produce parse events avoid recursion, receivers of parse events may have limits. Until v0.150.0, only the json parser had a max_nesting_level option, and the default was an an arbitrarily large number. Now, all parsers and encoders (json, csv, bson, cbor, msgpack, ubjson) have a max_nesting_level option applied to both parsing and serialization, and the default is 1024.

These issues have been verified as fixed in v0.151.0 by OSS-Fuzz.