Make the huge-claimed-length DoS regression tests portable across size_t widths

On a platform where size_t is narrower than 64 bits (e.g. 32-bit mingw/msvc
x86), the previously-hardcoded huge test lengths either collide with that
platform's unknown_size() sentinel (CBOR/MessagePack, both using exactly
SIZE_MAX) or exceed the platform's smaller vector<json>::max_size()
(UBJSON/BJData's 0x7FFFFFFF), so the header is now rejected outright
(out_of_range.408) instead of being accepted and only found short of data
(parse_error.110). Both are safe, bounded rejections of the hostile input;
the property under test -- no attempt to allocate space for billions of
elements -- holds either way. Accept both outcomes instead of pinning the
64-bit-only exact result.

Also fixed an unrelated clang-tidy finding (google-readability-casting) on
the functional-style std::size_t(...) casts in the neighboring "arrays of
various sizes" section.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

tests/src/unit-bjdata.cpp

@@ -3563,9 +3563,34 @@ TEST_CASE("issue #5405 - array reserve for definite-length BJData arrays")
         // billions of elements before the missing data is detected.
         json _;
         const std::vector<uint8_t> input = {'[', '$', 'i', '#', 'l', 0xFF, 0xFF, 0xFF, 0x7F};
-        CHECK_THROWS_WITH_AS(_ = json::from_bjdata(input),
+        // On a platform where std::vector<json>::max_size() is smaller than
-                             "[json.exception.parse_error.110] parse error at byte 10: syntax error while parsing BJData number: unexpected end of input",
+        // the claimed count (e.g. 32-bit, where max_size() is bounded by a
-                             json::parse_error&);
+        // 32-bit SIZE_MAX divided by sizeof(json)), the SAX consumer's own
+        // check rejects the header outright (out_of_range.408, with the
+        // claimed count in the message) instead of accepting it and only
+        // finding it short of data once the (capped) reservation looks for
+        // element bytes that were never provided (parse_error.110). Either
+        // is an acceptable, bounded rejection of the hostile header -- the
+        // property under test is that no path attempts to allocate space
+        // for billions of elements.
+        bool threw = false;
+        try
+        {
+            _ = json::from_bjdata(input);
+        }
+        catch (const json::parse_error& e)
+        {
+            threw = true;
+            CHECK(e.id == 110);
+            CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 10: syntax error while parsing BJData number: unexpected end of input");
+        }
+        catch (const json::out_of_range& e)
+        {
+            threw = true;
+            CHECK(e.id == 408);
+            CHECK(std::string(e.what()).find("excessive array size") != std::string::npos);
+        }
+        CHECK(threw);
         CHECK(json::from_bjdata(input, true, false).is_discarded());
     }
 

tests/src/unit-cbor.cpp

@@ -2185,9 +2185,35 @@ TEST_CASE("issue #5405 - array reserve for definite-length CBOR arrays")
         // billions of elements before the missing data is detected.
         json _;
         const std::vector<uint8_t> input = {0x9A, 0xFF, 0xFF, 0xFF, 0xFF};
-        CHECK_THROWS_WITH_AS(_ = json::from_cbor(input),
+        // On a platform where std::size_t is narrower than 64 bits (e.g.
-                             "[json.exception.parse_error.110] parse error at byte 6: syntax error while parsing CBOR value: unexpected end of input",
+        // 32-bit), the claimed count 0xFFFFFFFF coincides with that
-                             json::parse_error&);
+        // platform's detail::unknown_size() sentinel (SIZE_MAX), so the
+        // format-level size check rejects it outright (out_of_range.408,
+        // "excessive ... size") before the SAX consumer's own max_size()
+        // check would even run; on a 64-bit platform it passes both of
+        // those checks and is only found short of data once the (capped)
+        // reservation looks for element bytes that were never provided
+        // (parse_error.110). Either is an acceptable, bounded rejection of
+        // the hostile header -- the property under test is that no path
+        // attempts to allocate space for billions of elements.
+        bool threw = false;
+        try
+        {
+            _ = json::from_cbor(input);
+        }
+        catch (const json::parse_error& e)
+        {
+            threw = true;
+            CHECK(e.id == 110);
+            CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 6: syntax error while parsing CBOR value: unexpected end of input");
+        }
+        catch (const json::out_of_range& e)
+        {
+            threw = true;
+            CHECK(e.id == 408);
+            CHECK(std::string(e.what()).find("excessive") != std::string::npos);
+        }
+        CHECK(threw);
         CHECK(json::from_cbor(input, true, false).is_discarded());
     }
 
@@ -2195,9 +2221,9 @@ TEST_CASE("issue #5405 - array reserve for definite-length CBOR arrays")
     {
         for (const auto size :
                 {
-                    std::size_t(0), std::size_t(1), std::size_t(5), // small
+                    std::size_t{0}, std::size_t{1}, std::size_t{5}, // small
-                    std::size_t(16384),                             // exactly at the reserve cap
+                    std::size_t{16384},                             // exactly at the reserve cap
-                    std::size_t(20000)                              // above the reserve cap
+                    std::size_t{20000}                              // above the reserve cap
                 })
         {
             CAPTURE(size)

tests/src/unit-msgpack.cpp

@@ -1608,9 +1608,34 @@ TEST_CASE("issue #5405 - array reserve for definite-length MessagePack arrays")
         // billions of elements before the missing data is detected.
         json _;
         const std::vector<uint8_t> input = {0xdd, 0xFF, 0xFF, 0xFF, 0xFF};
-        CHECK_THROWS_WITH_AS(_ = json::from_msgpack(input),
+        // On a platform where std::size_t is narrower than 64 bits (e.g.
-                             "[json.exception.parse_error.110] parse error at byte 6: syntax error while parsing MessagePack value: unexpected end of input",
+        // 32-bit), the claimed count 0xFFFFFFFF coincides with that
-                             json::parse_error&);
+        // platform's SIZE_MAX, which some size-narrowing checks treat the
+        // same as detail::unknown_size(); it may then be rejected before
+        // the SAX consumer's own max_size() check (out_of_range.408) rather
+        // than being accepted and only found short of data once the
+        // (capped) reservation looks for element bytes that were never
+        // provided (parse_error.110). Either is an acceptable, bounded
+        // rejection of the hostile header -- the property under test is
+        // that no path attempts to allocate space for billions of elements.
+        bool threw = false;
+        try
+        {
+            _ = json::from_msgpack(input);
+        }
+        catch (const json::parse_error& e)
+        {
+            threw = true;
+            CHECK(e.id == 110);
+            CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 6: syntax error while parsing MessagePack value: unexpected end of input");
+        }
+        catch (const json::out_of_range& e)
+        {
+            threw = true;
+            CHECK(e.id == 408);
+            CHECK(std::string(e.what()).find("excessive") != std::string::npos);
+        }
+        CHECK(threw);
         CHECK(json::from_msgpack(input, true, false).is_discarded());
     }
 

tests/src/unit-ubjson.cpp

@@ -2327,9 +2327,34 @@ TEST_CASE("issue #5405 - array reserve for definite-length UBJSON arrays")
         // missing data is detected.
         json _;
         const std::vector<uint8_t> input = {'[', '$', 'i', '#', 'l', 0x7F, 0xFF, 0xFF, 0xFF};
-        CHECK_THROWS_WITH_AS(_ = json::from_ubjson(input),
+        // On a platform where std::vector<json>::max_size() is smaller than
-                             "[json.exception.parse_error.110] parse error at byte 10: syntax error while parsing UBJSON number: unexpected end of input",
+        // the claimed count (e.g. 32-bit, where max_size() is bounded by a
-                             json::parse_error&);
+        // 32-bit SIZE_MAX divided by sizeof(json)), the SAX consumer's own
+        // check rejects the header outright (out_of_range.408, with the
+        // claimed count in the message) instead of accepting it and only
+        // finding it short of data once the (capped) reservation looks for
+        // element bytes that were never provided (parse_error.110). Either
+        // is an acceptable, bounded rejection of the hostile header -- the
+        // property under test is that no path attempts to allocate space
+        // for billions of elements.
+        bool threw = false;
+        try
+        {
+            _ = json::from_ubjson(input);
+        }
+        catch (const json::parse_error& e)
+        {
+            threw = true;
+            CHECK(e.id == 110);
+            CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 10: syntax error while parsing UBJSON number: unexpected end of input");
+        }
+        catch (const json::out_of_range& e)
+        {
+            threw = true;
+            CHECK(e.id == 408);
+            CHECK(std::string(e.what()).find("excessive array size") != std::string::npos);
+        }
+        CHECK(threw);
         CHECK(json::from_ubjson(input, true, false).is_discarded());
     }