From af2e1c73c19348cd053e1de88ff5fe44f2e92be4 Mon Sep 17 00:00:00 2001 From: Niels Lohmann Date: Wed, 11 Nov 2026 19:05:09 +0100 Subject: [PATCH] Clarify the reservation note for announced array counts Signed-off-by: Niels Lohmann --- docs/mkdocs/docs/features/parsing/untrusted_input.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/mkdocs/docs/features/parsing/untrusted_input.md b/docs/mkdocs/docs/features/parsing/untrusted_input.md index 894bbc0a4..bea4503e0 100644 --- a/docs/mkdocs/docs/features/parsing/untrusted_input.md +++ b/docs/mkdocs/docs/features/parsing/untrusted_input.md @@ -72,15 +72,15 @@ For the binary formats, an announced size is never trusted outright: (reported as a parse error) instead of triggering an oversized allocation. - When an array announces its number of elements and the array container supports `reserve()` (as `#!cpp std::vector`, the default, does), the library reserves storage for at most 16384 of them upfront, regardless of how large the - announced count is; further elements still grow the container normally as they are read. A count that no - input backs, as in a truncated input, reserves at most that much until the parse error is reported. A parse that - completes keeps storage for such a count only where the elements take no input at all, which the two - [UBJSON](../binary_formats/ubjson.md) cases below cover. + announced count is; further elements still grow the container normally as they are read. A truncated input whose + count is larger than its remaining bytes therefore reserves at most that much before the parse error is reported. + Every array element takes at least one byte of input, except in the [UBJSON](../binary_formats/ubjson.md) arrays of + type `Z`, `T` or `F` described below. - An announced array or object size that exceeds what the target container could ever hold (its `max_size()`) is rejected immediately as [`out_of_range.408`](../../home/exceptions.md#jsonexceptionout_of_range408), without attempting to allocate anything. -- A [UBJSON](../binary_formats/ubjson.md) array of the no-op type (`[$N#`) is empty whatever count it declares: a - SAX handler is told `start_array(0)` and the DOM parser reserves nothing. +- A UBJSON array of the no-op type (`[$N#`) is empty whatever count it declares: a SAX handler is told + `start_array(0)` and the DOM parser reserves nothing. - A UBJSON array of type `Z`, `T` or `F` has no payload, so its announced count is not bounded by the input. One array may announce at most 1,048,576 elements, and all such arrays of one input together may contain at most 1,048,576 elements plus 4 for every byte read so far (checked when each array's header has been read); beyond that the input is