Fix decode_pointer_inplace ~1 escape and minify_string escape handling

[srijan-at-qwertystars]

Summary

Two correctness bugs fixed in escape sequence handling:

Bug 1: decode_pointer_inplace() incorrect ~1 decoding (cJSON_Utils.c)

Per RFC 6901 §3, the ~1 escape in JSON Pointers must decode to /. The current code writes to decoded_string[1] instead of decoded_string[0] (line 377), causing the decoded character to be placed at the wrong offset.

Additionally, when decoded_string falls behind string after processing an escape, subsequent non-escape characters are not copied to the output position.

Impact: JSON Patch operations (cJSONUtils_ApplyPatches) with ~1 in path components silently fail or operate on wrong object keys.

Reproduction:

cJSON *json = cJSON_Parse("{\"a/b\": \"original\"}");
cJSON *patch = cJSON_Parse("[{\"op\":\"replace\", \"path\":\"/a~1b\", \"value\":\"patched\"}]");
int result = cJSONUtils_ApplyPatchesCaseSensitive(json, patch);
// result is 13 (error) instead of 0 (success)

Bug 2: minify_string() doesn't handle \\\\ escape (cJSON.c)

The escape check in minify_string() only handles \\\" (escaped quote) but not other JSON escapes like \\\\ (escaped backslash). When a JSON string ends with \\\\, the closing " is misidentified as an escaped quote, causing the function to read past the string boundary and absorb subsequent JSON tokens into the string.

Impact: cJSON_Minify produces incorrect output for JSON containing strings that end with escaped backslashes.

Reproduction:

char json[] = "{ \"key\" : \"value\\\\\" , \"other\" : \"data\" }";
cJSON_Minify(json);
// Expected: {"key":"value\\\\","other":"data"}
// Actual:   {"key":"value\\\\" , "other" : "data" }

Changes

• cJSON_Utils.c: Fix decoded_string[1] → decoded_string[0] for ~1 case; add else clause to copy non-escape characters
• cJSON.c: Change escape check from (*input)[1] == '"' to (*input)[1] != '\0' to handle all escape sequences

Testing

All 19 existing tests pass. Both fixes are minimal (6 lines added, 2 lines changed).