amorfo77/json
1
0
Fork 0
mirror of https://github.com/nlohmann/json.git synced 2026-09-11 10:48:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make the UBJSON/BJData advance loop's top a copy, not a reference

Browse Source 
Same issue as the CBOR reader: top aliased container_stack.back() and
was read (top.is_object) right after container_stack.pop_back() ended
its lifetime. A copy stays valid regardless of what happens to the
stack; the one place that mutates the live entry (--top.remaining) now
goes through container_stack.back() directly.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
This commit is contained in:
Niels Lohmann
2026-09-10 18:43:41 +02:00
parent 0e99cf2482
commit d46c80b983
2 changed files with 12 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
single_include/nlohmann/json.hpp
+6 -6
View File
@@ -13029,17 +13029,18 @@ class binary_reader
}
// advance to the next element, closing the containers that ended.
// The reference is not held across get_ubjson_value() above, which
// can push onto the stack and reallocate it.
// top is a copy, not a reference: it must stay valid across the
// pop_back() below, which destroys the container_stack element it
// would otherwise alias.
for (;;)
{
container_frame& top = container_stack.back();
container_frame top = container_stack.back();
if (top.remaining != npos)
{
if (top.remaining != 0)
{
--top.remaining;
--container_stack.back().remaining;
if (top.is_object)
{
key.clear();
@@ -13078,9 +13079,8 @@ class binary_reader
break;
}
const bool is_object = top.is_object;
container_stack.pop_back();
if (JSON_HEDLEY_UNLIKELY(is_object ? !sax->end_object() : !sax->end_array()))
if (JSON_HEDLEY_UNLIKELY(top.is_object ? !sax->end_object() : !sax->end_array()))
{
return false;
}