Bound the total number of valueless UBJSON elements per input

An optimized UBJSON array of type Z, T or F has no payload, so its
declared count is not bounded by the input. The limit of 1048576 applied
to each array on its own, so 9 bytes (`[$Z#l` and a count) produced
1048576 values and every further 9 bytes another 1048576: 362 bytes
allocated 661 MB in a DOM, and a SAX handler received 1M events per 9
bytes.

The reader now adds the counts of all such arrays of one input and
rejects the input with out_of_range.408 when the sum exceeds 1048576
plus 4 for every byte read so far. The base is the per-array limit, so
an array that was accepted on its own before is still accepted at the
start of an input. These arrays add about 80 bytes of memory per input
byte (measured 77; one `Z` per byte needs 32), plus the base; the memory
of a document as a whole is not bounded by this. The check runs once per
valueless array, before its start event, with plain size_t arithmetic
that cannot overflow for a 32-bit size_t. Containers with a payload type
and objects (every member needs a key) are bounded by the input already
and are unchanged. BJData rejects these types.

to_ubjson counts the elements of the typed arrays it writes in one call
and writes an array in the unoptimized form (`[#n Z Z ...`) once it would
bring the total above 1048576, which a reader accepts at any input size.
The check is made only for a typed array of a valueless type, so BJData
and other arrays do not pay for it. Everything to_ubjson writes in
version 3.13.0 can therefore be read back.

Two consequences:
- to_ubjson output changes for values with more than 1048576 elements in
  arrays of type Z, T or F: such an array is written at one byte per
  element, e.g. 270000 rows of 100 nulls take 26.8 MB instead of 1.35 MB.
- Output of version 3.12.0 and earlier (typed arrays without such a
  total) is rejected by from_ubjson when the arrays hold more than
  1048576 elements plus 4 per byte of input. 3.12.0 writes a row of up to 255 nulls in 5 bytes (6 above
  255), so a table is rejected from 1075 rows of 1000 nulls or 209723
  rows of 25 (accepted: 1000 rows of 1000, 209000 rows of 25); rows of
  20 or fewer are never rejected.

Measured on the test data: no file of json_test_data (converted with
to_ubjson in all three modes, 846 round trips) holds an array of this
kind with more than 0.17 values per byte. All of them are read back.

Reproducer (K arrays of 1048576 nulls), Apple clang -O2:
  K=40 (362 bytes): before 41943040 values, 664 MB; after rejected, 33 MB
  K=2 (20 bytes):   before 2097152 values, 53 MB;   after rejected, 33 MB

The new tests count events with a SAX handler where they can: building
and comparing million-element values made the first version take 176 s
under Valgrind, the current one about 22 s.

Behaviour change: an input that holds more than 1048576 elements in
arrays of type Z, T or F at more than 4 per byte is now rejected.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

single_include/nlohmann/json.hpp

@@ -18352,13 +18352,46 @@ the input.
 
 This is a sanity bound rather than a security boundary, and it is far above
 any container met in practice. @ref binary_writer falls back to the
-unoptimized encoding for longer containers, so that a value serialized by
-this library can always be read back.
+unoptimized encoding for longer containers, and for containers that together
+with the ones before them would exceed @ref valueless_elements_base, so that a
+value serialized by this library can always be read back.
 
 @sa https://github.com/nlohmann/json/issues/2793
 */
 JSON_INLINE_VARIABLE constexpr std::size_t max_valueless_container_size = 1 << 20;
 
+/*!
+@brief number of elements of valueless UBJSON containers accepted on top of
+       @ref valueless_elements_per_byte
+
+The limit @ref max_valueless_container_size applies to each container on its
+own, so on its own it lets 9 bytes announce 1048576 values, and every further
+9 bytes another 1048576. The elements of all containers of a valueless type
+in one input are therefore added up, and the sum must stay below this base
+plus @ref valueless_elements_per_byte for every byte read so far. The base is
+the per-container limit, so a container that was accepted on its own before
+the sum was introduced is still accepted at the start of an input.
+*/
+JSON_INLINE_VARIABLE constexpr std::size_t valueless_elements_base = max_valueless_container_size;
+
+/*!
+@brief number of elements of valueless UBJSON containers accepted per byte of
+       input, in addition to @ref valueless_elements_base
+
+An element of a value that has a payload costs at least one byte of input.
+Valueless elements are accepted at a rate of 4 per byte. A value takes 16
+bytes of memory in a DOM, so these arrays add about 80 bytes of memory per
+byte of input (measured: 77; one `Z` per byte needs about 32), beyond what the
+same bytes cost anyway, plus the base. This bounds the arrays of valueless
+type, not the memory of a whole document. Containers written by
+@ref binary_writer never need more than the base, because it writes an array
+in the unoptimized form once the typed arrays written so far and this one add
+up to more than that. The rate matters for input written by other encoders and
+by versions before 3.13.0 only; in the data this was measured on, no input has
+more than 0.17 elements per byte.
+*/
+JSON_INLINE_VARIABLE constexpr std::size_t valueless_elements_per_byte = 4;
+
 ///////////////////
 // binary reader //
 ///////////////////
@@ -21979,6 +22012,37 @@ class binary_reader
         return emit_unsigned(number);
     }
 
+    /*!
+    @brief add the elements of a container of a valueless type to the total of
+           the input and check the total against the input read so far
+
+    A container of type 'Z', 'T' or 'F' has no payload, so its elements are the
+    only ones for which the input does not bound the count. The check is made
+    once per container, not per element.
+
+    @param[in] count  number of elements the container declares; at most
+                      @ref max_valueless_container_size
+    @return false if the total is more than @ref valueless_elements_base plus
+            @ref valueless_elements_per_byte for every byte read so far; the
+            total is not changed then
+    */
+    bool charge_valueless_elements(const std::size_t count) noexcept
+    {
+        // the limit saturates instead of overflowing when size_t is 32 bits
+        // wide and a very large input has been read; valueless_elements
+        // never exceeds the limit, so the difference cannot underflow
+        constexpr std::size_t max_size = (std::numeric_limits<std::size_t>::max)();
+        const std::size_t limit = chars_read <= (max_size - valueless_elements_base) / valueless_elements_per_byte
+                                  ? valueless_elements_base + (valueless_elements_per_byte * chars_read)
+                                  : max_size;
+        if (JSON_HEDLEY_UNLIKELY(count > limit - valueless_elements))
+        {
+            return false;
+        }
+        valueless_elements += count;
+        return true;
+    }
+
     /*!
     @return whether array creation completed
     */
@@ -22064,10 +22128,16 @@ class binary_reader
             // declared count alone decides how much is allocated; the check is
             // made before the start event so that no container is opened that
             // is then abandoned. See @ref max_valueless_container_size.
-            if (JSON_HEDLEY_UNLIKELY((size_and_type.second == 'Z' || size_and_type.second == 'T' || size_and_type.second == 'F')
-                                     && size_and_type.first > max_valueless_container_size))
+            if (JSON_HEDLEY_UNLIKELY(size_and_type.second == 'Z' || size_and_type.second == 'T' || size_and_type.second == 'F'))
             {
-                return out_of_range_error(exception_id::container_too_large, "excessive array size", "size");
+                if (JSON_HEDLEY_UNLIKELY(size_and_type.first > max_valueless_container_size))
+                {
+                    return out_of_range_error(exception_id::container_too_large, "excessive array size", "size");
+                }
+                if (JSON_HEDLEY_UNLIKELY(!charge_valueless_elements(size_and_type.first)))
+                {
+                    return out_of_range_error(exception_id::container_too_large, "excessive number of elements without payload", "size");
+                }
             }
 
             if (JSON_HEDLEY_UNLIKELY(!enter_array(size_and_type.first, size_and_type.second)))
@@ -23393,6 +23463,10 @@ class binary_reader
     /// the number of characters read
     std::size_t chars_read = 0;
 
+    /// UBJSON: the sum of the element counts of the containers of a valueless
+    /// type read so far; see @ref charge_valueless_elements
+    std::size_t valueless_elements = 0;
+
     /// whether we can assume little endianness
     const bool is_little_endian = little_endianness();
 
@@ -30546,20 +30620,27 @@ class binary_writer
 
             // an optimized array of a valueless type carries no payload, so a
             // reader has nothing but the declared count to bound the allocation
-            // by and refuses an excessive one. Write the unoptimized form for
-            // those, at one byte per element, so the result can be read back.
-            // Objects are not affected: every element is preceded by its key.
-            const bool valueless_type = (first_prefix == 'Z' || first_prefix == 'T' || first_prefix == 'F');
-            const bool excessive_valueless = IsArray
-                                             && valueless_type
-                                             && size > detail::max_valueless_container_size;
-
-            if (same_prefix && !excessive_valueless
-                    && !(use_bjdata && is_bjdata_excluded_type_marker(first_prefix)))
+            // by. It refuses one array of more than max_valueless_container_size
+            // elements, and all such arrays of one input together when they add
+            // up to more than valueless_elements_base plus a number per byte
+            // read. Write the unoptimized form, at one byte per element, for
+            // an array that would exceed the base with the arrays written so
+            // far, so that the result can be read back: the limit of a reader
+            // is never below the base. Objects are not affected: every element
+            // is preceded by its key.
+            if (same_prefix && !(use_bjdata && is_bjdata_excluded_type_marker(first_prefix)))
             {
-                prefix_required = false;
-                oa.write_character(to_char_type('$'));
-                oa.write_character(first_prefix);
+                const bool valueless_type = IsArray && (first_prefix == 'Z' || first_prefix == 'T' || first_prefix == 'F');
+                if (!valueless_type || size <= detail::valueless_elements_base - valueless_elements_written)
+                {
+                    prefix_required = false;
+                    oa.write_character(to_char_type('$'));
+                    oa.write_character(first_prefix);
+                    if (valueless_type)
+                    {
+                        valueless_elements_written += size;
+                    }
+                }
             }
         }
 
@@ -34783,6 +34864,10 @@ class binary_writer
     /// how to treat a string value or object key that is not valid UTF-8
     /// (CBOR, MessagePack, UBJSON, BJData, and BSON; not BON8)
     const error_handler_t error_handler = binary_writer_default_error_handler();
+
+    /// UBJSON: the number of elements written so far in optimized arrays of a
+    /// valueless type, which a reader adds up and bounds
+    std::size_t valueless_elements_written = 0;
 };
 
 }  // namespace detail