QJsonDocument: Reject objects containing themselves in binary JSON

The added test case is a binary JSON file describing an array which contains
itself. This file passes validation even though attempting to convert it to
plain JSON leads to an infinite loop. Fixed by rejecting it in validation.

Task-number: QTBUG-61969
Change-Id: Ib4472e9777d09840c30c384b24294e4744b02045
Reviewed-by: Lars Knoll <lars.knoll@qt.io>

src/corelib/serialization/qjson.cpp

@@ -328,7 +328,7 @@ int Value::usedStorage(const Base *b) const
 
 bool Value::isValid(const Base *b) const
 {
-    int offset = 0;
+    int offset = -1;
     switch (type) {
     case QJsonValue::Double:
         if (latinOrIntValue)
@@ -345,9 +345,9 @@ bool Value::isValid(const Base *b) const
         break;
     }
 
-    if (!offset)
+    if (offset == -1)
         return true;
-    if (offset + sizeof(uint) > b->tableOffset)
+    if (offset + sizeof(uint) > b->tableOffset || offset < (int)sizeof(Base))
         return false;
 
     int s = usedStorage(b);