CVE-2026-9516

@@ -2,7 +2,7 @@
 #
 # https://tools.ietf.org/html/rfc7159#section-8.1
 # JSON text SHALL be encoded in UTF-8, UTF-16, or UTF-32.
-use Test::More ($] >= 5.008) ? (tests => 9) : (skip_all => "needs 5.8");;
+use Test::More ($] >= 5.008) ? (tests => 9 + 6) : (skip_all => "needs 5.8");;
 use Cpanel::JSON::XS;
 use Encode; # Currently required for <5.20
 use charnames qw(:short);
@@ -41,3 +41,50 @@ ok(my $as_json = eval {
 ok(eval { $j->decode($as_json) }, 'can decode again');
 ok(eval { $j->decode("\x{feff}" . $as_json) }, 'can decode with BOM');
 ok(eval { $j->decode($as_json) }, 'can decode original');
+
+# Tests by Paul Johnson:
+
+# Assert the caller's input SV is preserved bit-for-bit across a decode
+# call whose filter callback throws, for each of the three croak-reachable
+# callback sites (filter_json_object, filter_json_single_key_object, and
+# allow_tags + THAW), with a leading UTF-8 BOM on the input.
+
+my $bom = "\xef\xbb\xbf";
+
+sub assert_preserved {
+  my ($name, $payload, $setup) = @_;
+  my $original = $bom . $payload;
+  my $s        = $bom . $payload;
+  my $j        = Cpanel::JSON::XS->new;
+  $setup->($j);
+  eval { $j->decode ($s) };
+  ok ($@, "$name: callback threw");
+  # The BOM-decode path legitimately sets SvUTF8 on the caller's SV.
+  # We care about the underlying byte sequence (no SvPVX shift), not
+  # the flag, so clear SvUTF8 on a copy and compare raw bytes.
+  my $copy = $s;
+  Encode::_utf8_off ($copy);
+  is ($copy, $original, "$name: SV bytes preserved across throw");
+}
+
+assert_preserved (
+  "filter_json_object",
+  '{}',
+  sub { $_[0]->filter_json_object (sub { die "boom\n" }) },
+);
+
+assert_preserved (
+  "filter_json_single_key_object",
+  '{"k":1}',
+  sub { $_[0]->filter_json_single_key_object (k => sub { die "boom\n" }) },
+);
+
+{
+  package BomFilterCorruption::Thaw;
+  sub THAW { die "boom\n" }
+}
+assert_preserved (
+  "allow_tags THAW",
+  '("BomFilterCorruption::Thaw")[]',
+  sub { $_[0]->allow_tags (1) },
+);

@@ -4502,8 +4502,6 @@ decode_json (pTHX_ SV *string, JSON *json, STRLEN *offset_return, SV *typesv)
         converted = 1 + (json->flags & F_UTF8);
         json->flags |= F_UTF8;
         offset = 3;
-        SvPV_set(string, SvPVX_mutable (string) + 3);
-        SvCUR_set(string, len - 3);
         SvUTF8_on(string);
         /* omitting the endian name will skip the BOM in the result */
       } else if (len >= 4 && memEQc(s, UTF32BOM)) {
@@ -4538,7 +4536,7 @@ decode_json (pTHX_ SV *string, JSON *json, STRLEN *offset_return, SV *typesv)
     SvGROW (string, SvCUR (string) + 1);
 
   dec.json  = *json;
-  dec.cur   = SvPVX (string);
+  dec.cur   = SvPVX (string) + offset;
   dec.end   = SvEND (string);
   dec.err   = 0;
   dec.depth = 0;
@@ -4552,10 +4550,11 @@ decode_json (pTHX_ SV *string, JSON *json, STRLEN *offset_return, SV *typesv)
   sv = decode_sv (aTHX_ &dec, typesv);
 
   if (offset_return) {
-    if (dec.cur < SvPVX (string) || dec.cur > SvEND (string))
+    char *base = SvPVX (string) + offset;
+    if (dec.cur < base || dec.cur > SvEND (string))
       *offset_return = 0;
     else
-      *offset_return = dec.cur - SvPVX (string);
+      *offset_return = dec.cur - base;
   }
 
   if (!(offset_return || !sv))
@@ -4570,12 +4569,6 @@ decode_json (pTHX_ SV *string, JSON *json, STRLEN *offset_return, SV *typesv)
           sv = NULL;
         }
     }
-  /* restore old utf8 string with BOM */
-  if (UNLIKELY(offset)) {
-    SvPV_set(string, SvPVX_mutable (string) - offset);
-    SvCUR_set(string, len);
-  }
-
   if (!sv)
     {
       SV *uni = sv_newmortal ();