Code execution via unchecked parser buffer writes

Heap buffer overflow in sheredom json.h before commit 0825301 allows remote authenticated users to execute arbitrary code. The json_parse_string routine copies bytes from src into the allocated data region without honoring state.data_size, so crafted input under a specific flag combination writes beyond the heap buffer. A caller must pass attacker-controlled JSON to json_parse_ex with that flag combination; the demonstrated result is a one-byte heap overwrite, while the CVE record reports code execution and privilege escalation.