The JSON parser was not "exceptionally dumb": it just used sscanf(s, "%d", ...) for parsing numbers. But most implementations of C's standard library (yes, including BSD and Linux's) implement sscanf() by converting the source string into a dummy FILE* object (which involves calling strlen() to set the stream's size) and calling fscanf() on it. Apparently most people who use sscanf() are unaware of this "lovely" implementation quirk and I can't really blame them.