Bound the total number of valueless UBJSON elements per input

An optimized UBJSON array of type Z, T or F has no payload, so its
declared count is not bounded by the input. The limit of 1048576 applied
to each array on its own, so 9 bytes (`[$Z#l` and a count) produced
1048576 values and every further 9 bytes another 1048576: 362 bytes
allocated 661 MB in a DOM, and a SAX handler received 1M events per 9
bytes.

The reader now adds the counts of all such arrays of one input and
rejects the input with out_of_range.408 when the sum exceeds 1048576
plus 4 for every byte read so far. The base is the per-array limit, so
an array that was accepted on its own before is still accepted at the
start of an input. These arrays add about 80 bytes of memory per input
byte (measured 77; one `Z` per byte needs 32), plus the base; the memory
of a document as a whole is not bounded by this. The check runs once per
valueless array, before its start event, with plain size_t arithmetic
that cannot overflow for a 32-bit size_t. Containers with a payload type
and objects (every member needs a key) are bounded by the input already
and are unchanged. BJData rejects these types.

to_ubjson counts the elements of the typed arrays it writes in one call
and writes an array in the unoptimized form (`[#n Z Z ...`) once it would
bring the total above 1048576, which a reader accepts at any input size.
The check is made only for a typed array of a valueless type, so BJData
and other arrays do not pay for it. Everything to_ubjson writes in
version 3.13.0 can therefore be read back.

Two consequences:
- to_ubjson output changes for values with more than 1048576 elements in
  arrays of type Z, T or F: such an array is written at one byte per
  element, e.g. 270000 rows of 100 nulls take 26.8 MB instead of 1.35 MB.
- Output of version 3.12.0 and earlier (typed arrays without such a
  total) is rejected by from_ubjson when the arrays hold more than
  1048576 elements plus 4 per byte of input. 3.12.0 writes a row of up to 255 nulls in 5 bytes (6 above
  255), so a table is rejected from 1075 rows of 1000 nulls or 209723
  rows of 25 (accepted: 1000 rows of 1000, 209000 rows of 25); rows of
  20 or fewer are never rejected.

Measured on the test data: no file of json_test_data (converted with
to_ubjson in all three modes, 846 round trips) holds an array of this
kind with more than 0.17 values per byte. All of them are read back.

Reproducer (K arrays of 1048576 nulls), Apple clang -O2:
  K=40 (362 bytes): before 41943040 values, 664 MB; after rejected, 33 MB
  K=2 (20 bytes):   before 2097152 values, 53 MB;   after rejected, 33 MB

The new tests count events with a SAX handler where they can: building
and comparing million-element values made the first version take 176 s
under Valgrind, the current one about 22 s.

Behaviour change: an input that holds more than 1048576 elements in
arrays of type Z, T or F at more than 4 per byte is now rejected.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

tests/src/unit-ubjson.cpp

@@ -19,8 +19,12 @@
 #include <nlohmann/json.hpp>
 using nlohmann::json;
 
+#include <cstdio>
 #include <iostream>
+#include <sstream>
+#include <utility>
 #include <fstream>
+#include <limits>
 #include <list>
 #include <set>
 #include "make_test_data_available.hpp"
@@ -2436,6 +2440,257 @@ TEST_CASE("UBJSON optimized arrays of a valueless type are bounded")
     }
 }
 
+namespace
+{
+/// SAX consumer that counts the values and keeps the id of a parse error
+struct ValuelessEventCounter : public nlohmann::json_sax<json>
+{
+    bool null() override
+    {
+        return ++values < stop_after;
+    }
+    bool boolean(bool /*val*/) override
+    {
+        return ++values < stop_after;
+    }
+    bool number_integer(json::number_integer_t /*val*/) override
+    {
+        ++values;
+        return true;
+    }
+    bool number_unsigned(json::number_unsigned_t /*val*/) override
+    {
+        ++values;
+        return true;
+    }
+    bool number_float(json::number_float_t /*val*/, const std::string& /*s*/) override
+    {
+        ++values;
+        return true;
+    }
+    bool string(std::string& /*val*/) override
+    {
+        ++values;
+        return true;
+    }
+    bool binary(json::binary_t& /*val*/) override
+    {
+        ++values;
+        return true;
+    }
+    bool start_object(std::size_t /*elements*/) override
+    {
+        return true;
+    }
+    bool key(std::string& /*val*/) override
+    {
+        return true;
+    }
+    bool end_object() override
+    {
+        return true;
+    }
+    bool start_array(std::size_t /*elements*/) override
+    {
+        return true;
+    }
+    bool end_array() override
+    {
+        return true;
+    }
+    bool parse_error(std::size_t /*position*/, const std::string& /*last_token*/, const json::exception& ex) override
+    {
+        error_id = ex.id;
+        return false;
+    }
+
+    /// the handler refuses the value that makes this many
+    std::size_t stop_after = (std::numeric_limits<std::size_t>::max)();
+    std::size_t values = 0;
+    int error_id = 0;
+};
+
+/// appends `[$<marker>#l<count>` (nine bytes) to @a v
+void append_valueless_array(std::vector<std::uint8_t>& v, const char marker, const std::uint32_t count)
+{
+    v.push_back('[');
+    v.push_back('$');
+    v.push_back(static_cast<std::uint8_t>(marker));
+    v.push_back('#');
+    v.push_back('l');
+    v.push_back(static_cast<std::uint8_t>(count >> 24));
+    v.push_back(static_cast<std::uint8_t>(count >> 16));
+    v.push_back(static_cast<std::uint8_t>(count >> 8));
+    v.push_back(static_cast<std::uint8_t>(count));
+}
+
+/// `[` followed by one `[$<marker>#l<count>` per entry of @a counts and `]`
+std::vector<std::uint8_t> valueless_arrays(const char marker, const std::vector<std::uint32_t>& counts)
+{
+    std::vector<std::uint8_t> v = {'['};
+    for (const auto count : counts)
+    {
+        append_valueless_array(v, marker, count);
+    }
+    v.push_back(']');
+    return v;
+}
+} // namespace
+
+TEST_CASE("UBJSON the valueless elements of a whole input are bounded")
+{
+    // The per-container limit alone let nine bytes (`[$Z#l` and a count of
+    // 1048576) announce a million values, and every further nine bytes another
+    // million. The elements of all containers of type 'Z', 'T' or 'F' in one
+    // input are now added up: they may not exceed 1048576 plus 4 for every
+    // byte read when the container's header has been read.
+    //
+    // The tests count events with a SAX handler where they can: building and
+    // comparing values of a million elements is what makes them slow under
+    // Valgrind, so there is one rejection and one round trip with a DOM.
+    json _;
+    const char* const budget_message = "[json.exception.out_of_range.408] syntax error while parsing UBJSON size: excessive number of elements without payload";
+
+    // two arrays that exceed the limit: the second one, with its header read
+    // at byte 19, may hold 4 * 19 = 76 values on top of the base of 1048576
+    const std::uint32_t over_first = 524288;
+    const std::uint32_t over_second = 1048576 + 76 - over_first + 1;
+
+    SECTION("the input of the original report is rejected")
+    {
+        // 362 bytes (40 arrays of 1048576 values) used to allocate 661 MB; the
+        // second array is the one that is refused
+        const auto input = valueless_arrays('Z', {over_first, over_second});
+        CHECK_THROWS_WITH_AS(_ = json::from_ubjson(input), budget_message, json::out_of_range&);
+    }
+
+    SECTION("every input adapter applies the budget")
+    {
+        const auto input = valueless_arrays('Z', {over_first, over_second});
+
+        // stream; not strict, which does not matter
+        std::stringstream stream;
+        stream.write(reinterpret_cast<const char*>(input.data()), static_cast<std::streamsize>(input.size()));
+        ValuelessEventCounter from_stream;
+        CHECK(!json::sax_parse(stream, &from_stream, json::input_format_t::ubjson, false));
+        CHECK(from_stream.error_id == 408);
+
+        // a container that is not contiguous; the counts of arrays of
+        // different types are added up
+        std::vector<std::uint8_t> mixed = {'['};
+        append_valueless_array(mixed, 'T', over_first);
+        append_valueless_array(mixed, 'F', over_second);
+        mixed.push_back(']');
+        const std::list<std::uint8_t> as_list(mixed.begin(), mixed.end());
+        ValuelessEventCounter from_list;
+        CHECK(!json::sax_parse(as_list.begin(), as_list.end(), &from_list, json::input_format_t::ubjson));
+        CHECK(from_list.error_id == 408);
+        CHECK(from_list.values == over_first);
+
+        // FILE*
+        FILE* const file = std::tmpfile(); // NOLINT(cppcoreguidelines-owning-memory)
+        REQUIRE(file != nullptr);
+        CHECK(std::fwrite(input.data(), 1, input.size(), file) == input.size());
+        std::rewind(file);
+        ValuelessEventCounter from_file;
+        CHECK(!json::sax_parse(file, &from_file, json::input_format_t::ubjson));
+        CHECK(from_file.error_id == 408);
+        std::fclose(file); // NOLINT(cert-err33-c,cppcoreguidelines-owning-memory)
+    }
+
+    SECTION("the limit is exact and the bytes read raise it")
+    {
+        // [ [$Z#l 524288] [$U#l 4096 + 4096 bytes] [$Z#l count] ]: chars_read
+        // is 1 + 9 + (9 + 4096) + 9 = 4124 when the last header has been read,
+        // so the last array may hold 4 * 4124 = 16496 values on top of the
+        // base of 1048576 less the 524288 of the first array
+        const std::uint32_t last_allowed = 1048576 + 16496 - 524288;
+        for (const std::uint32_t count :
+                {
+                    last_allowed, last_allowed + 1
+                })
+        {
+            CAPTURE(count)
+            std::vector<std::uint8_t> input = {'['};
+            append_valueless_array(input, 'Z', 524288);
+            input.insert(input.end(), {'[', '$', 'U', '#', 'l', 0x00, 0x00, 0x10, 0x00});
+            input.insert(input.end(), 4096, 0x01);
+            append_valueless_array(input, 'Z', count);
+            input.push_back(']');
+            ValuelessEventCounter sax;
+            const bool accepted = count == last_allowed;
+            CHECK(json::sax_parse(input, &sax, json::input_format_t::ubjson) == accepted);
+            CHECK(sax.error_id == (accepted ? 0 : 408));
+            CHECK(sax.values == 524288u + 4096u + (accepted ? count : 0u));
+        }
+
+        // an array of 1048576 values on its own is accepted as before
+        const std::vector<std::uint8_t> single = {'[', '$', 'Z', '#', 'l', 0x00, 0x10, 0x00, 0x00};
+        // (the handler ends the parse at the first value, so that the million
+        // values are not read)
+        ValuelessEventCounter sax;
+        sax.stop_after = 1;
+        CHECK(!json::sax_parse(single, &sax, json::input_format_t::ubjson));
+        CHECK(sax.error_id == 0);
+        CHECK(sax.values == 1);
+    }
+
+    SECTION("to_ubjson writes the typed form up to the base only")
+    {
+        // 1048 rows of 1000 values fit under the base of 1048576, the 1049th
+        // would not: its elements are written one by one. Written all typed,
+        // 1100 rows of 6 bytes would be refused by a reader (1075 rows are the
+        // most it accepts). The rows hold null, true or false, and the
+        // fallback does not depend on which
+        std::vector<std::uint8_t> encoded;
+        {
+            json table = json::array();
+            for (int row = 0; row < 1100; ++row)
+            {
+                const json cell = row % 3 == 0 ? json(nullptr) : json(row % 3 == 1);
+                table.push_back(json(1000, cell));
+            }
+            encoded = json::to_ubjson(table, true, true);
+        }
+        // outer array: `[$[#I` and the count (7 bytes), then 1048 typed rows of 6
+        // bytes (`$Z#I` and two bytes) and 52 rows of `#I`, two bytes, and 1000 `Z`
+        CHECK(encoded.size() == 7 + (1048 * 6) + (52 * (4 + 1000)));
+
+        // the output is read back
+        ValuelessEventCounter sax;
+        CHECK(json::sax_parse(encoded, &sax, json::input_format_t::ubjson));
+        CHECK(sax.error_id == 0);
+        CHECK(sax.values == 1100u * 1000u);
+    }
+
+    SECTION("BJData is not affected")
+    {
+        // BJData has no optimized arrays of these types, and the writer does
+        // not charge them
+        json table = json::array();
+        for (int row = 0; row < 3; ++row)
+        {
+            table.push_back(json(10, nullptr));
+        }
+        const auto encoded = json::to_bjdata(table, true, true);
+        CHECK(json::from_bjdata(encoded) == table);
+
+        const std::vector<std::uint8_t> input = {'[', '$', 'Z', '#', 'l', 0x00, 0x10, 0x00, 0x00};
+        CHECK_THROWS_AS(_ = json::from_bjdata(input), json::parse_error&);
+    }
+
+    SECTION("an object of a valueless type needs a key for every value")
+    {
+        // an object member costs a key, so the count is bounded by the input
+        // and is not charged to the budget
+        const std::vector<std::uint8_t> input = {'{', '$', 'Z', '#', 'l', 0x00, 0x10, 0x00, 0x00};
+        ValuelessEventCounter sax;
+        CHECK(!json::sax_parse(input, &sax, json::input_format_t::ubjson));
+        CHECK(sax.error_id == 110);
+        CHECK(sax.values == 0);
+    }
+}
+
 TEST_CASE("issue #5405 - array reserve for definite-length UBJSON arrays")
 {
 #if !defined(JSON_NOEXCEPTION)