Protect against deeply nested maps

Update BasicJsonParser to fix the deeply nested map protection logic.

Fixes gh-32029

spring-boot-project/spring-boot/src/main/java/org/springframework/boot/json/BasicJsonParser.java

@@ -67,7 +67,7 @@ public class BasicJsonParser extends AbstractJsonParser {
 			return parseListInternal(nesting + 1, json);
 		}
 		if (json.startsWith("{")) {
-			return parseMapInternal(nesting, json);
+			return parseMapInternal(nesting + 1, json);
 		}
 		if (json.startsWith("\"")) {
 			return trimTrailingCharacter(trimLeadingCharacter(json, '"'), '"');

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/AbstractJsonParserTests.java

@@ -205,4 +205,12 @@ abstract class AbstractJsonParserTests {
 		assertThatExceptionOfType(JsonParseException.class).isThrownBy(() -> this.parser.parseList(input));
 	}
 
+	@Test // gh-32029
+	void deeplyNestedMap() throws IOException {
+		String input = StreamUtils.copyToString(
+				AbstractJsonParserTests.class.getResourceAsStream("deeply-nested-map-json.txt"),
+				StandardCharsets.UTF_8);
+		assertThatExceptionOfType(JsonParseException.class).isThrownBy(() -> this.parser.parseList(input));
+	}
+
 }

spring-boot-project/spring-boot/src/test/java/org/springframework/boot/json/YamlJsonParserTests.java

@@ -66,4 +66,9 @@ class YamlJsonParserTests extends AbstractJsonParserTests {
 	void largeMalformed() throws IOException {
 	}
 
+	@Override
+	@Disabled("SnakeYaml does not protect against deeply nested JSON")
+	void deeplyNestedMap() throws IOException {
+	}
+
 }

spring-boot-project/spring-boot/src/test/resources/org/springframework/boot/json/deeply-nested-map-json.txt

@@ -0,0 +1 @@
+[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��{":{":{":{":{":{":[{":{"":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{":{"��