JSON: Fix an out-of-bounds access uncovered by oss-fuzz

src/ua_types_encoding_json.c

@@ -2253,13 +2253,9 @@ searchObjectForKeyRec(const char *searchKey, CtxJson *ctx,
     
     if(parseCtx->tokenArray[parseCtx->index].type == JSMN_OBJECT) {
         size_t objectCount = (size_t)(parseCtx->tokenArray[parseCtx->index].size);
-        
         parseCtx->index++; /*Object to first Key*/
-        CHECK_TOKEN_BOUNDS;
         
-        size_t i;
-        for(i = 0; i < objectCount; i++) {
-            
+        for(size_t i = 0; i < objectCount; i++) {
             CHECK_TOKEN_BOUNDS;
             if(depth == 0) { /* we search only on first layer */
                 if(jsoneq((char*)ctx->pos, &parseCtx->tokenArray[parseCtx->index], searchKey) == 0) {
@@ -2287,12 +2283,10 @@ searchObjectForKeyRec(const char *searchKey, CtxJson *ctx,
         }
     } else if(parseCtx->tokenArray[parseCtx->index].type == JSMN_ARRAY) {
         size_t arraySize = (size_t)(parseCtx->tokenArray[parseCtx->index].size);
-        
         parseCtx->index++; /*Object to first element*/
-        CHECK_TOKEN_BOUNDS;
         
-        size_t i;
-        for(i = 0; i < arraySize; i++) {
+        for(size_t i = 0; i < arraySize; i++) {
+            CHECK_TOKEN_BOUNDS;
             if(parseCtx->tokenArray[parseCtx->index].type == JSMN_OBJECT) {
                ret = searchObjectForKeyRec(searchKey, ctx, parseCtx, resultIndex,
                                            (UA_UInt16)(depth + 1));