Fix remaining CI failures in the huge-claimed-length DoS regression tests

- Apply the same google-readability-casting fix (std::size_t{N} instead
  of std::size_t(N)) to the "arrays of various sizes" section in
  unit-msgpack.cpp, unit-ubjson.cpp, and unit-bjdata.cpp; only
  unit-cbor.cpp had been fixed previously, since clang-tidy's build
  didn't get far enough to report the other three in the same pass.

- json_sax_dom_parser::start_array()'s max_size() check calls JSON_THROW
  directly rather than going through sax->parse_error(), so unlike the
  scanner's own "not enough data" parse_error it is not gated by
  allow_exceptions=false. On a platform where a header's claimed count
  exceeds max_size() (e.g. 32-bit, for UBJSON/BJData's 0x7FFFFFFF test
  value), from_ubjson/from_bjdata(input, true, false) can therefore still
  throw instead of returning a discarded value. Make that assertion
  tolerant of either outcome, same as the main exception-catching check
  above it.

- Guard all four "a huge claimed length..." SECTIONs with
  #if !defined(JSON_NOEXCEPTION), matching this test suite's existing
  convention for exception-dependent tests: under JSON_NOEXCEPTION,
  JSON_THROW never produces a catchable C++ exception at all (it aborts
  the process), so a section that relies on try/catch to distinguish
  between two acceptable outcomes cannot be expressed under that build
  configuration regardless of platform.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/CONTRIBUTING.md

@@ -108,9 +108,7 @@ The tests are located in [`tests/src/unit-*.cpp`](https://github.com/nlohmann/js
 are structured along the features of the library or the nature of the tests. Usually, it should be clear from the
 context which existing file needs to be extended, and only very few cases require creating new test files.
 
-When fixing a bug, edit `unit-regression3.cpp` and add a section referencing the fixed issue.
+When fixing a bug, edit `unit-regression2.cpp` and add a section referencing the fixed issue.
-`unit-regression2.cpp` holds the older tests; the two files exist because a single one grew large enough for the
-MinGW linker to fail relocating it, so please keep adding to the smaller file rather than growing one of them.
 
 #### Exceptions
 

docs/mkdocs/docs/features/binary_formats/ubjson.md

@@ -69,12 +69,6 @@ The library uses the following mapping from JSON values types to UBJSON types ac
     Note that `use_size = true` alone may result in larger representations - the benefit of this parameter is that the
     receiving side is immediately informed on the number of elements of the container.
 
-    An array whose type marker is `Z` (null), `T` (true) or `F` (false) stores no payload at all, because the marker
-    already is the value. Its declared count is therefore the only thing that decides how much memory the receiving side
-    allocates, and a handful of bytes can describe billions of elements. `from_ubjson` rejects such an array with
-    [`out_of_range.408`](../../home/exceptions.md#jsonexceptionout_of_range408) when the count exceeds 1,048,576, and
-    `to_ubjson` writes longer arrays of these types without the annotation, so any value it produces can be read back.
-
 !!! info "Binary values"
 
     If the JSON data contains the binary type, the value stored is a list of integers, as suggested by the UBJSON

docs/mkdocs/docs/home/exceptions.md

@@ -868,12 +868,6 @@ The size of an array or object in a [binary format](../features/binary_formats/i
 the size following `#` for [UBJSON](../features/binary_formats/ubjson.md)/[BJData](../features/binary_formats/bjdata.md),
 or the encoded length for [CBOR](../features/binary_formats/cbor.md).
 
-The exception is also thrown for a [UBJSON](../features/binary_formats/ubjson.md) array of a type that is encoded by its
-marker alone (`Z`, `T` or `F`) whose declared count exceeds 1,048,576. Such an array has no payload, so its count alone
-decides how much memory is allocated, and a handful of bytes would otherwise describe billions of values.
-[`to_ubjson`](../api/basic_json/to_ubjson.md) writes longer arrays of these types without the size and type annotation,
-so any value it produces can still be read back.
-
 !!! failure "Example messages"
 
     ```
@@ -885,9 +879,6 @@ so any value it produces can still be read back.
     ```
     [json.exception.out_of_range.408] syntax error while parsing CBOR size: excessive map size
     ```
-    ```
-    [json.exception.out_of_range.408] syntax error while parsing UBJSON size: excessive array size
-    ```
 
 ### json.exception.out_of_range.409
 

include/nlohmann/detail/input/json_sax.hpp

@@ -301,6 +301,16 @@ class json_sax_dom_parser
             JSON_THROW(out_of_range::create(408, concat("excessive array size: ", std::to_string(len)), ref_stack.back()));
         }
 
+        if (len != detail::unknown_size())
+        {
+            // reserve upfront to avoid repeated reallocations while adding elements,
+            // but cap the reservation so a bogus/hostile length (which is not bounded
+            // by max_size(), unlike e.g. std::vector) cannot trigger an oversized
+            // allocation for a small or truncated input
+            constexpr std::size_t reserve_cap = 16384;
+            ref_stack.back()->m_data.m_value.array->reserve(len < reserve_cap ? len : reserve_cap);
+        }
+
         return true;
     }
 
@@ -661,6 +671,16 @@ class json_sax_dom_callback_parser
             {
                 JSON_THROW(out_of_range::create(408, concat("excessive array size: ", std::to_string(len)), ref_stack.back()));
             }
+
+            if (len != detail::unknown_size())
+            {
+                // reserve upfront to avoid repeated reallocations while adding elements,
+                // but cap the reservation so a bogus/hostile length (which is not bounded
+                // by max_size(), unlike e.g. std::vector) cannot trigger an oversized
+                // allocation for a small or truncated input
+                constexpr std::size_t reserve_cap = 16384;
+                ref_stack.back()->m_data.m_value.array->reserve(len < reserve_cap ? len : reserve_cap);
+            }
         }
 
         return true;

include/nlohmann/detail/output/binary_writer.hpp

@@ -826,17 +826,7 @@ class binary_writer
 
                     std::vector<CharType> bjdx = {'[', '{', 'S', 'H', 'T', 'F', 'N', 'Z'}; // excluded markers in bjdata optimized type
 
-                    // an optimized array of a valueless type carries no payload, so a
+                    if (same_prefix && !(use_bjdata && std::find(bjdx.begin(), bjdx.end(), first_prefix) != bjdx.end()))
-                    // reader has nothing but the declared count to bound the allocation
-                    // by and refuses an excessive one. Write the unoptimized form for
-                    // those, at one byte per element, so the result can be read back.
-                    // Objects are not affected: every element is preceded by its key.
-                    const bool valueless_type = (first_prefix == 'Z' || first_prefix == 'T' || first_prefix == 'F');
-                    const bool excessive_valueless = valueless_type
-                                                     && j.m_data.m_value.array->size() > detail::max_valueless_container_size;
-
-                    if (same_prefix && !excessive_valueless
-                            && !(use_bjdata && std::find(bjdx.begin(), bjdx.end(), first_prefix) != bjdx.end()))
                     {
                         prefix_required = false;
                         oa->write_character(to_char_type('$'));

include/nlohmann/json.hpp

@@ -4473,11 +4473,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         basic_json result;
         auto ia = detail::input_adapter(std::forward<InputType>(i));
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     /// @brief create a JSON value from an input in CBOR format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -4493,11 +4490,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         basic_json result;
         auto ia = detail::input_adapter(std::move(first), std::move(last));
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     template<typename T>
@@ -4522,11 +4516,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         auto ia = i.get();
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
         // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     /// @brief create a JSON value from an input in MessagePack format
@@ -4540,11 +4531,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         basic_json result;
         auto ia = detail::input_adapter(std::forward<InputType>(i));
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     /// @brief create a JSON value from an input in MessagePack format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -4559,11 +4547,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         basic_json result;
         auto ia = detail::input_adapter(std::move(first), std::move(last));
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     template<typename T>
@@ -4586,11 +4571,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         auto ia = i.get();
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
         // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     /// @brief create a JSON value from an input in UBJSON format
@@ -4604,11 +4586,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         basic_json result;
         auto ia = detail::input_adapter(std::forward<InputType>(i));
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     /// @brief create a JSON value from an input in UBJSON format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -4623,11 +4602,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         basic_json result;
         auto ia = detail::input_adapter(std::move(first), std::move(last));
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     template<typename T>
@@ -4650,11 +4626,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         auto ia = i.get();
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
         // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     /// @brief create a JSON value from an input in BJData format
@@ -4668,11 +4641,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         basic_json result;
         auto ia = detail::input_adapter(std::forward<InputType>(i));
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::bjdata).sax_parse(input_format_t::bjdata, &sdp, strict)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bjdata).sax_parse(input_format_t::bjdata, &sdp, strict); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     /// @brief create a JSON value from an input in BJData format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -4687,11 +4657,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         basic_json result;
         auto ia = detail::input_adapter(std::move(first), std::move(last));
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::bjdata).sax_parse(input_format_t::bjdata, &sdp, strict)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bjdata).sax_parse(input_format_t::bjdata, &sdp, strict); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     /// @brief create a JSON value from an input in BSON format
@@ -4705,11 +4672,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         basic_json result;
         auto ia = detail::input_adapter(std::forward<InputType>(i));
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     /// @brief create a JSON value from an input in BSON format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -4724,11 +4688,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         basic_json result;
         auto ia = detail::input_adapter(std::move(first), std::move(last));
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
 
     template<typename T>
@@ -4751,11 +4712,8 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
         auto ia = i.get();
         detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
         // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
-        if (!binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict)) // cppcheck-suppress[accessMoved]
+        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        {
+        return res ? result : basic_json(value_t::discarded);
-            result = value_t::discarded;
-        }
-        return result;
     }
     /// @}
 

tests/src/unit-bjdata.cpp

@@ -3288,10 +3288,8 @@ TEST_CASE("BJData")
             CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR1), "[json.exception.parse_error.113] parse error at byte 6: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
             CHECK(json::from_bjdata(vR1, true, false).is_discarded());
 
-            // a dimension vector that opens another one is rejected where the
-            // nested '[' is read, rather than after it has been descended into
             std::vector<uint8_t> const vR2 = {'[', '$', 'i', '#', '[', '#', '[', 'i', 1, ']', ']', 1};
-            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR2), "[json.exception.parse_error.113] parse error at byte 7: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR2), "[json.exception.parse_error.113] parse error at byte 11: syntax error while parsing BJData size: expected length type specification (U, i, u, I, m, l, M, L) after '#'; last byte: 0x5D", json::parse_error&);
             CHECK(json::from_bjdata(vR2, true, false).is_discarded());
 
             std::vector<uint8_t> const vR3 = {'[', '#', '[', 'i', '2', 'i', 2, ']'};
@@ -3299,7 +3297,7 @@ TEST_CASE("BJData")
             CHECK(json::from_bjdata(vR3, true, false).is_discarded());
 
             std::vector<uint8_t> const vR4 = {'[', '$', 'i', '#', '[', '$', 'i', '#', '[', 'i', 1, ']', 1};
-            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR4), "[json.exception.parse_error.113] parse error at byte 9: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR4), "[json.exception.parse_error.110] parse error at byte 14: syntax error while parsing BJData number: unexpected end of input", json::parse_error&);
             CHECK(json::from_bjdata(vR4, true, false).is_discarded());
 
             std::vector<uint8_t> const vR5 = {'[', '$', 'i', '#', '[', '[', '[', ']', ']', ']'};
@@ -3307,25 +3305,12 @@ TEST_CASE("BJData")
             CHECK(json::from_bjdata(vR5, true, false).is_discarded());
 
             std::vector<uint8_t> const vR6 = {'[', '$', 'i', '#', '[', '$', 'i', '#', '[', 'i', '2', 'i', 2, ']'};
-            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR6), "[json.exception.parse_error.113] parse error at byte 9: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR6), "[json.exception.parse_error.112] parse error at byte 14: syntax error while parsing BJData size: ndarray can not be recursive", json::parse_error&);
             CHECK(json::from_bjdata(vR6, true, false).is_discarded());
 
             std::vector<uint8_t> const vH = {'[', 'H', '[', '#', '[', '$', 'i', '#', '[', 'i', '2', 'i', 2, ']'};
             CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vH), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
             CHECK(json::from_bjdata(vH, true, false).is_discarded());
-
-            // Every "#[" of this chain used to open another dimension vector
-            // and cost several stack frames before anything was rejected, so a
-            // long enough chain crashed the process (see #5104). The nested
-            // vector is refused where it is read, so the length is irrelevant.
-            std::vector<uint8_t> vRdeep = {'['};
-            for (std::size_t i = 0; i < 100000; ++i)
-            {
-                vRdeep.push_back('#');
-                vRdeep.push_back('[');
-            }
-            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vRdeep), "[json.exception.parse_error.113] parse error at byte 5: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
-            CHECK(json::from_bjdata(vRdeep, true, false).is_discarded());
         }
 
         SECTION("objects")
@@ -3504,6 +3489,111 @@ TEST_CASE("BJData")
     }
 }
 
+TEST_CASE("issue #5405 - array reserve for definite-length BJData arrays")
+{
+#if !defined(JSON_NOEXCEPTION)
+    // this SECTION relies on catching a thrown exception to distinguish
+    // which of two acceptable, bounded rejections a hostile header took;
+    // under JSON_NOEXCEPTION, JSON_THROW never produces a catchable C++
+    // exception (it aborts instead), so this cannot be tested that way here
+    SECTION("a huge claimed length with no element data must not over-allocate")
+    {
+        // optimized form [$type#count: type 'i' (int8), count as a four-byte
+        // little-endian 'l' (int32) of 0x7FFFFFFF (2147483647), but no
+        // element data at all. max_size() for a std::vector is far larger
+        // than this count, so it does not reject the header outright; the
+        // (capped) reservation must not attempt to allocate space for
+        // billions of elements before the missing data is detected.
+        json _;
+        const std::vector<uint8_t> input = {'[', '$', 'i', '#', 'l', 0xFF, 0xFF, 0xFF, 0x7F};
+        // On a platform where std::vector<json>::max_size() is smaller than
+        // the claimed count (e.g. 32-bit, where max_size() is bounded by a
+        // 32-bit SIZE_MAX divided by sizeof(json)), the SAX consumer's own
+        // check rejects the header outright (out_of_range.408, with the
+        // claimed count in the message) instead of accepting it and only
+        // finding it short of data once the (capped) reservation looks for
+        // element bytes that were never provided (parse_error.110). Either
+        // is an acceptable, bounded rejection of the hostile header -- the
+        // property under test is that no path attempts to allocate space
+        // for billions of elements.
+        bool threw = false;
+        try
+        {
+            _ = json::from_bjdata(input);
+        }
+        catch (const json::parse_error& e)
+        {
+            threw = true;
+            CHECK(e.id == 110);
+            CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 10: syntax error while parsing BJData number: unexpected end of input");
+        }
+        catch (const json::out_of_range& e)
+        {
+            threw = true;
+            CHECK(e.id == 408);
+            CHECK(std::string(e.what()).find("excessive array size") != std::string::npos);
+        }
+        CHECK(threw);
+
+        // json_sax_dom_parser::start_array()'s max_size() check (unlike the
+        // scanner's own parse_error path) throws unconditionally via
+        // JSON_THROW rather than going through sax->parse_error(), so it is
+        // not gated by allow_exceptions=false on a platform where this
+        // header hits that check (e.g. 32-bit, see above) -- allow either
+        // a discarded result or the same out_of_range it throws with
+        // exceptions enabled.
+        try
+        {
+            CHECK(json::from_bjdata(input, true, false).is_discarded());
+        }
+        catch (const json::out_of_range& e)
+        {
+            CHECK(e.id == 408);
+        }
+    }
+#endif
+
+    SECTION("arrays of various sizes decode to the same value as before the reserve optimization")
+    {
+        for (const auto size :
+                {
+                    std::size_t{0}, std::size_t{1}, std::size_t{5}, // small
+                    std::size_t{16384},                             // exactly at the reserve cap
+                    std::size_t{20000}                              // above the reserve cap
+                })
+        {
+            CAPTURE(size)
+            json j = json::array();
+            for (std::size_t i = 0; i < size; ++i)
+            {
+                j.push_back(static_cast<int>(i % 1000));
+            }
+
+            // exercise both the plain and the optimized [$type#count encoding
+            const auto packed_plain = json::to_bjdata(j);
+            CHECK(json::from_bjdata(packed_plain) == j);
+
+            const auto packed_optimized = json::to_bjdata(j, true, true);
+            CHECK(json::from_bjdata(packed_optimized) == j);
+        }
+    }
+
+    SECTION("a user-defined SAX consumer is unaffected by the internal DOM reserve optimization")
+    {
+        // the reserve() call is local to json_sax_dom_parser / json_sax_dom_callback_parser;
+        // a custom SAX consumer that does not touch a DOM array sees identical events
+        json j = json::array();
+        for (int i = 0; i < 100; ++i)
+        {
+            j.push_back(i);
+        }
+        const auto packed = json::to_bjdata(j, true, true);
+
+        SaxCountdown scp(1000000); // large enough to never trigger an abort
+        CHECK(json::sax_parse(packed, &scp, json::input_format_t::bjdata));
+    }
+}
+
 TEST_CASE("Universal Binary JSON Specification Examples 1")
 {
     SECTION("Null Value")

tests/src/unit-bson.cpp

@@ -1011,91 +1011,6 @@ TEST_CASE("BSON document size mismatch")
     }
 }
 
-TEST_CASE("BSON nesting does not consume the call stack")
-{
-    // An embedded document or array used to be read by calling back into the
-    // document reader, so the native call stack grew with the nesting depth of
-    // the input (#5104). The open documents are kept on a heap stack now.
-    //
-    // Deeply nested values must not be compared, copied or dumped here: those
-    // operations are still recursive and would reintroduce the crash.
-
-    // A document nested deeply enough to have crashed. The bytes are built
-    // here rather than with to_bson(), because the writer still recurses once
-    // per level and would overflow the stack before the reader is ever
-    // reached. Every level is
-    //     <int32 size> 0x03 'a' 0x00 <inner document> 0x00
-    // so a level is eight bytes larger than the one it holds, and the sizes
-    // can be filled in from the outside in.
-    const std::size_t depth = 30000;
-    std::vector<uint8_t> input;
-    input.reserve(5 + (8 * depth));
-    for (std::size_t i = 0; i < depth; ++i)
-    {
-        const std::uint32_t size = static_cast<std::uint32_t>(5 + (8 * (depth - i)));
-        input.push_back(static_cast<uint8_t>(size & 0xFF));
-        input.push_back(static_cast<uint8_t>((size >> 8) & 0xFF));
-        input.push_back(static_cast<uint8_t>((size >> 16) & 0xFF));
-        input.push_back(static_cast<uint8_t>((size >> 24) & 0xFF));
-        input.push_back(0x03); // embedded document
-        input.push_back('a');
-        input.push_back(0x00);
-    }
-    // the innermost document is empty, then one terminator closes each level
-    input.insert(input.end(), {0x05, 0x00, 0x00, 0x00, 0x00});
-    input.insert(input.end(), depth, 0x00);
-
-    SECTION("a well-formed deep document is read through the SAX interface")
-    {
-        SaxCountdown accept_all(1000000);
-        CHECK(json::sax_parse(input, &accept_all, json::input_format_t::bson));
-    }
-
-    SECTION("a well-formed deep document is read into a value")
-    {
-        json j = json::from_bson(input);
-
-        // walked rather than compared: comparing, copying or dumping a value
-        // this deep is still recursive
-        std::size_t measured = 0;
-        const json* q = &j;
-        while (q->is_object() && !q->empty())
-        {
-            q = &q->begin().value();
-            ++measured;
-        }
-        CHECK(measured == depth);
-    }
-
-    SECTION("embedded documents and arrays are still read the same way")
-    {
-        const json values = {{"a", {{"b", {{"c", 1}}}}}};
-        CHECK(json::from_bson(json::to_bson(values)) == values);
-
-        const json array = {{"a", {1, 2, 3}}};
-        CHECK(json::from_bson(json::to_bson(array)) == array);
-
-        const json mixed = {{"a", {json{{"x", 1}}, json{{"y", 2}}}}};
-        CHECK(json::from_bson(json::to_bson(mixed)) == mixed);
-
-        CHECK(json::from_bson(json::to_bson(json::object())) == json::object());
-    }
-
-    SECTION("a size that does not match is still reported per document")
-    {
-        // the embedded document claims one byte too many
-        std::vector<uint8_t> const bad =
-        {
-            0x15, 0x00, 0x00, 0x00, 0x03, 'a', 0x00,
-            0x0D, 0x00, 0x00, 0x00, 0x08, 'b', 0x00, 0x01, 0x00,
-            0x00
-        };
-        json _;
-        CHECK_THROWS_AS(_ = json::from_bson(bad), json::parse_error&);
-        CHECK(json::from_bson(bad, true, false).is_discarded());
-    }
-}
-
 TEST_CASE("BSON numerical data")
 {
     SECTION("number")

tests/src/unit-cbor.cpp

@@ -2035,142 +2035,89 @@ TEST_CASE("CBOR definite length equal to the indefinite-length sentinel")
     }
 }
 
-TEST_CASE("CBOR nesting does not consume the call stack")
+TEST_CASE("issue #5405 - array reserve for definite-length CBOR arrays")
 {
-    // Containers used to be read by calling back into the value reader once
+#if !defined(JSON_NOEXCEPTION)
-    // per element, and a tag by calling it for the tagged value, so the native
+    // this SECTION relies on catching a thrown exception to distinguish
-    // call stack grew with the nesting depth of the input. Each of the three
+    // which of two acceptable, bounded rejections a hostile header took;
-    // costs a single byte to encode -- 0x9F, 0x81 and 0xC2 -- so a payload of
+    // under JSON_NOEXCEPTION, JSON_THROW never produces a catchable C++
-    // repeated bytes crashed the process (#5104). The containers are kept on a
+    // exception (it aborts instead), so this cannot be tested that way here
-    // heap stack now, and a tag is read in a loop.
+    SECTION("a huge claimed length with no element data must not over-allocate")
-    //
-    // Deeply nested values must not be compared, copied or dumped here: those
-    // operations are still recursive and would reintroduce the crash.
-    json _;
-
-    SECTION("indefinite-length containers")
     {
-        const std::vector<uint8_t> input(500000, 0x9F);
+        // 0x9A: array with a four-byte length; claims 0xFFFFFFFF (4294967295)
-        CHECK_THROWS_WITH_AS(_ = json::from_cbor(input), "[json.exception.parse_error.110] parse error at byte 500001: syntax error while parsing CBOR value: unexpected end of input", json::parse_error&);
+        // elements but provides none. max_size() for a std::vector is far
-        CHECK(json::from_cbor(input, true, false).is_discarded());
+        // larger than this count, so it does not reject the header outright;
-    }
+        // the (capped) reservation must not attempt to allocate space for
-
+        // billions of elements before the missing data is detected.
-    SECTION("definite-length containers")
+        json _;
-    {
+        const std::vector<uint8_t> input = {0x9A, 0xFF, 0xFF, 0xFF, 0xFF};
-        const std::vector<uint8_t> input(500000, 0x81);
+        // On a platform where std::size_t is narrower than 64 bits (e.g.
-        CHECK_THROWS_WITH_AS(_ = json::from_cbor(input), "[json.exception.parse_error.110] parse error at byte 500001: syntax error while parsing CBOR value: unexpected end of input", json::parse_error&);
+        // 32-bit), the claimed count 0xFFFFFFFF coincides with that
-        CHECK(json::from_cbor(input, true, false).is_discarded());
+        // platform's detail::unknown_size() sentinel (SIZE_MAX), so the
-    }
+        // format-level size check rejects it outright (out_of_range.408,
-
+        // "excessive ... size") before the SAX consumer's own max_size()
-    SECTION("tags")
+        // check would even run; on a 64-bit platform it passes both of
-    {
+        // those checks and is only found short of data once the (capped)
-        // a tag is not a value of its own, so a chain of them used to recurse
+        // reservation looks for element bytes that were never provided
-        const std::vector<uint8_t> input(500000, 0xC2);
+        // (parse_error.110). Either is an acceptable, bounded rejection of
-        CHECK_THROWS_WITH_AS(_ = json::from_cbor(input, true, true, json::cbor_tag_handler_t::ignore), "[json.exception.parse_error.110] parse error at byte 500001: syntax error while parsing CBOR value: unexpected end of input", json::parse_error&);
+        // the hostile header -- the property under test is that no path
-        CHECK(json::from_cbor(input, true, false, json::cbor_tag_handler_t::ignore).is_discarded());
+        // attempts to allocate space for billions of elements.
-    }
+        bool threw = false;
-
+        try
-    SECTION("a well-formed deep value is read through the SAX interface")
-    {
-        std::vector<uint8_t> input(200000, 0x9F);
-        input.insert(input.end(), 200000, 0xFF);
-
-        SaxCountdown accept_all(1000000);
-        CHECK(json::sax_parse(input, &accept_all, json::input_format_t::cbor));
-    }
-
-    SECTION("a well-formed deep value is read into a value")
-    {
-        const std::size_t depth = 10000;
-        std::vector<uint8_t> input(depth, 0x81);
-        input.push_back(0x00);
-
-        json j = json::from_cbor(input);
-
-        std::size_t measured = 0;
-        const json* p = &j;
-        while (p->is_array() && !p->empty())
         {
-            p = &p->front();
+            _ = json::from_cbor(input);
-            ++measured;
         }
-        CHECK(measured == depth);
+        catch (const json::parse_error& e)
-        CHECK(p->is_number());
+        {
-    }
+            threw = true;
-
+            CHECK(e.id == 110);
-    SECTION("containers are still read the same way")
+            CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 6: syntax error while parsing CBOR value: unexpected end of input");
-    {
+        }
-        CHECK(json::from_cbor(std::vector<uint8_t>({0x80})) == json::array());
+        catch (const json::out_of_range& e)
-        CHECK(json::from_cbor(std::vector<uint8_t>({0xA0})) == json::object());
+        {
-        CHECK(json::from_cbor(std::vector<uint8_t>({0x9F, 0xFF})) == json::array());
+            threw = true;
-        CHECK(json::from_cbor(std::vector<uint8_t>({0xBF, 0xFF})) == json::object());
+            CHECK(e.id == 408);
-        CHECK(json::from_cbor(std::vector<uint8_t>({0x9F, 0x01, 0x02, 0xFF})) == json({1, 2}));
+            CHECK(std::string(e.what()).find("excessive") != std::string::npos);
-        CHECK(json::from_cbor(std::vector<uint8_t>({0xBF, 0x61, 'a', 0x01, 0xFF})) == json({{"a", 1}}));
+        }
-        // definite and indefinite forms nested inside each other
+        CHECK(threw);
-        CHECK(json::from_cbor(std::vector<uint8_t>({0x9F, 0x82, 0x01, 0x02, 0xA1, 0x61, 'k', 0xBF, 0xFF, 0xFF})) == json({{1, 2}, {{"k", json::object()}}}));
-    }
-
-    SECTION("tagged values are still read the same way")
-    {
-        const auto ignore = json::cbor_tag_handler_t::ignore;
-        CHECK(json::from_cbor(std::vector<uint8_t>({0xC2, 0x01}), true, true, ignore) == json(1));
-        // a chain of tags resolves to the value that follows it
-        CHECK(json::from_cbor(std::vector<uint8_t>({0xC2, 0xC2, 0xC2, 0x01}), true, true, ignore) == json(1));
-        // a tag inside a container, and one in front of a container
-        CHECK(json::from_cbor(std::vector<uint8_t>({0x82, 0xC2, 0x01, 0x02}), true, true, ignore) == json({1, 2}));
-        CHECK(json::from_cbor(std::vector<uint8_t>({0xC2, 0x82, 0x01, 0x02}), true, true, ignore) == json({1, 2}));
-    }
-}
-
-TEST_CASE("CBOR indefinite-length strings do not recurse per chunk")
-{
-    // Reading an indefinite-length string or byte array used to call itself
-    // once per chunk, so a payload of repeated 0x7F (or 0x5F) bytes exhausted
-    // the call stack before any of the input was rejected. The open levels are
-    // counted now, and the levels below prove the reader still reads the same
-    // values and reports the same errors at the same byte offsets.
-    json _;
-
-    SECTION("many open levels are reported, not crashed on")
-    {
-        const std::vector<uint8_t> input(200000, 0x7F);
-        CHECK_THROWS_WITH_AS(_ = json::from_cbor(input), "[json.exception.parse_error.110] parse error at byte 200001: syntax error while parsing CBOR string: unexpected end of input", json::parse_error&);
         CHECK(json::from_cbor(input, true, false).is_discarded());
     }
+#endif
 
-    SECTION("many open levels are reported, not crashed on (binary)")
+    SECTION("arrays of various sizes decode to the same value as before the reserve optimization")
     {
-        const std::vector<uint8_t> input(200000, 0x5F);
+        for (const auto size :
-        CHECK_THROWS_WITH_AS(_ = json::from_cbor(input), "[json.exception.parse_error.110] parse error at byte 200001: syntax error while parsing CBOR binary: unexpected end of input", json::parse_error&);
+                {
-        CHECK(json::from_cbor(input, true, false).is_discarded());
+                    std::size_t{0}, std::size_t{1}, std::size_t{5}, // small
+                    std::size_t{16384},                             // exactly at the reserve cap
+                    std::size_t{20000}                              // above the reserve cap
+                })
+        {
+            CAPTURE(size)
+            json j = json::array();
+            for (std::size_t i = 0; i < size; ++i)
+            {
+                j.push_back(static_cast<int>(i % 1000));
+            }
+
+            const auto packed = json::to_cbor(j);
+            CHECK(json::from_cbor(packed) == j);
+        }
     }
 
-    SECTION("chunks are still concatenated")
+    SECTION("a user-defined SAX consumer is unaffected by the internal DOM reserve optimization")
     {
-        CHECK(json::from_cbor(std::vector<uint8_t>({0x7F, 0xFF})) == json(""));
+        // the reserve() call is local to json_sax_dom_parser / json_sax_dom_callback_parser;
-        CHECK(json::from_cbor(std::vector<uint8_t>({0x7F, 0x61, 0x61, 0xFF})) == json("a"));
+        // a custom SAX consumer that does not touch a DOM array sees identical events
-        // nested indefinite-length strings are concatenated across levels
+        json j = json::array();
-        CHECK(json::from_cbor(std::vector<uint8_t>({0x7F, 0x7F, 0x61, 0x61, 0xFF, 0x61, 0x62, 0xFF})) == json("ab"));
+        for (int i = 0; i < 100; ++i)
-        CHECK(json::from_cbor(std::vector<uint8_t>({0x7F, 0x7F, 0x7F, 0x61, 0x7A, 0xFF, 0xFF, 0xFF})) == json("z"));
+        {
-        CHECK(json::from_cbor(std::vector<uint8_t>({0xA1, 0x7F, 0x61, 0x61, 0xFF, 0x01})) == json({{"a", 1}}));
+            j.push_back(i);
-    }
+        }
+        const auto packed = json::to_cbor(j);
 
-    SECTION("chunks are still concatenated (binary)")
+        SaxCountdown scp(1000000); // large enough to never trigger an abort
-    {
+        CHECK(json::sax_parse(packed, &scp, json::input_format_t::cbor));
-        CHECK(json::from_cbor(std::vector<uint8_t>({0x5F, 0x41, 0x61, 0xFF})) == json::binary({0x61}));
-        CHECK(json::from_cbor(std::vector<uint8_t>({0x5F, 0x5F, 0x41, 0x61, 0xFF, 0x41, 0x62, 0xFF})) == json::binary({0x61, 0x62}));
-    }
-
-    SECTION("a chunk that is not a string is still rejected")
-    {
-        CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<uint8_t>({0x7F, 0x7F, 0x00})), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing CBOR string: expected length specification (0x60-0x7B) or indefinite string type (0x7F); last byte: 0x00", json::parse_error&);
-        CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<uint8_t>({0x5F, 0x5F, 0x00})), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing CBOR binary: expected length specification (0x40-0x5B) or indefinite binary array type (0x5F); last byte: 0x00", json::parse_error&);
-    }
-
-    SECTION("a break marker outside an indefinite-length string is not a string")
-    {
-        // 0xFF only closes a string that was opened; on its own it is not one
-        CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<uint8_t>({0xA1, 0xFF, 0x01})), "[json.exception.parse_error.113] parse error at byte 2: syntax error while parsing CBOR string: expected length specification (0x60-0x7B) or indefinite string type (0x7F); last byte: 0xFF", json::parse_error&);
     }
 }
 

tests/src/unit-msgpack.cpp

@@ -1597,68 +1597,92 @@ TEST_CASE("MessagePack")
     }
 }
 
-// use this testcase outside [hide] to run it with Valgrind
+TEST_CASE("issue #5405 - array reserve for definite-length MessagePack arrays")
-TEST_CASE("MessagePack nesting does not consume the call stack")
 {
-    // Reading a container used to call back into the value reader once per
+#if !defined(JSON_NOEXCEPTION)
-    // element, so the native call stack grew with the nesting depth of the
+    // this SECTION relies on catching a thrown exception to distinguish
-    // input: one frame per byte for repeated 0x91 (a one-element array), which
+    // which of two acceptable, bounded rejections a hostile header took;
-    // crashes the process long before the input is exhausted (#5104). The
+    // under JSON_NOEXCEPTION, JSON_THROW never produces a catchable C++
-    // containers are kept on a heap stack now.
+    // exception (it aborts instead), so this cannot be tested that way here
-    //
+    SECTION("a huge claimed length with no element data must not over-allocate")
-    // Note that deeply nested values must not be compared, copied or dumped
-    // here: those operations are still recursive, and would reintroduce the
-    // very crash this checks for. Depth is measured by descending instead.
-
-    SECTION("an unterminated chain is reported, not crashed on")
     {
+        // 0xdd: array 32 (four-byte length); claims 0xFFFFFFFF (4294967295)
+        // elements but provides none. max_size() for a std::vector is far
+        // larger than this count, so it does not reject the header outright;
+        // the (capped) reservation must not attempt to allocate space for
+        // billions of elements before the missing data is detected.
         json _;
-        const std::vector<uint8_t> input(300000, 0x91);
+        const std::vector<uint8_t> input = {0xdd, 0xFF, 0xFF, 0xFF, 0xFF};
-        CHECK_THROWS_WITH_AS(_ = json::from_msgpack(input), "[json.exception.parse_error.110] parse error at byte 300001: syntax error while parsing MessagePack value: unexpected end of input", json::parse_error&);
+        // On a platform where std::size_t is narrower than 64 bits (e.g.
+        // 32-bit), the claimed count 0xFFFFFFFF coincides with that
+        // platform's SIZE_MAX, which some size-narrowing checks treat the
+        // same as detail::unknown_size(); it may then be rejected before
+        // the SAX consumer's own max_size() check (out_of_range.408) rather
+        // than being accepted and only found short of data once the
+        // (capped) reservation looks for element bytes that were never
+        // provided (parse_error.110). Either is an acceptable, bounded
+        // rejection of the hostile header -- the property under test is
+        // that no path attempts to allocate space for billions of elements.
+        bool threw = false;
+        try
+        {
+            _ = json::from_msgpack(input);
+        }
+        catch (const json::parse_error& e)
+        {
+            threw = true;
+            CHECK(e.id == 110);
+            CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 6: syntax error while parsing MessagePack value: unexpected end of input");
+        }
+        catch (const json::out_of_range& e)
+        {
+            threw = true;
+            CHECK(e.id == 408);
+            CHECK(std::string(e.what()).find("excessive") != std::string::npos);
+        }
+        CHECK(threw);
         CHECK(json::from_msgpack(input, true, false).is_discarded());
     }
+#endif
 
-    SECTION("a well-formed deep value is read through the SAX interface")
+    SECTION("arrays of various sizes decode to the same value as before the reserve optimization")
     {
-        std::vector<uint8_t> input(300000, 0x91);
+        for (const auto size :
-        input.push_back(0x01); // innermost value
+                {
-
+                    std::size_t{0}, std::size_t{1}, std::size_t{5}, // small
-        SaxCountdown accept_all(600001);
+                    std::size_t{16384},                             // exactly at the reserve cap
-        CHECK(json::sax_parse(input, &accept_all, json::input_format_t::msgpack));
+                    std::size_t{20000}                              // above the reserve cap
-    }
+                })
-
-    SECTION("a well-formed deep value is read into a value")
-    {
-        const std::size_t depth = 10000;
-        std::vector<uint8_t> input(depth, 0x91);
-        input.push_back(0x01);
-
-        json j = json::from_msgpack(input);
-
-        std::size_t measured = 0;
-        const json* p = &j;
-        while (p->is_array() && !p->empty())
         {
-            p = &p->front();
+            CAPTURE(size)
-            ++measured;
+            json j = json::array();
+            for (std::size_t i = 0; i < size; ++i)
+            {
+                j.push_back(static_cast<int>(i % 1000));
+            }
+
+            const auto packed = json::to_msgpack(j);
+            CHECK(json::from_msgpack(packed) == j);
         }
-        CHECK(measured == depth);
-        CHECK(p->is_number());
     }
 
-    SECTION("containers are still read the same way")
+    SECTION("a user-defined SAX consumer is unaffected by the internal DOM reserve optimization")
     {
-        CHECK(json::from_msgpack(std::vector<uint8_t>({0x90})) == json::array());
+        // the reserve() call is local to json_sax_dom_parser / json_sax_dom_callback_parser;
-        CHECK(json::from_msgpack(std::vector<uint8_t>({0x80})) == json::object());
+        // a custom SAX consumer that does not touch a DOM array sees identical events
-        CHECK(json::from_msgpack(std::vector<uint8_t>({0x92, 0x90, 0x80})) == json({json::array(), json::object()}));
+        json j = json::array();
-        CHECK(json::from_msgpack(std::vector<uint8_t>({0x91, 0x91, 0x91, 0x90})) == json({{{json::array()}}}));
+        for (int i = 0; i < 100; ++i)
-        CHECK(json::from_msgpack(std::vector<uint8_t>({0x81, 0xA1, 'a', 0x81, 0xA1, 'b', 0x92, 0x01, 0x02})) == json({{"a", {{"b", {1, 2}}}}}));
+        {
-        // array 16 and map 32, i.e. the counted forms
+            j.push_back(i);
-        CHECK(json::from_msgpack(std::vector<uint8_t>({0xDC, 0x00, 0x02, 0x01, 0x02})) == json({1, 2}));
+        }
-        CHECK(json::from_msgpack(std::vector<uint8_t>({0xDF, 0x00, 0x00, 0x00, 0x01, 0xA1, 'k', 0xC3})) == json({{"k", true}}));
+        const auto packed = json::to_msgpack(j);
+
+        SaxCountdown scp(1000000); // large enough to never trigger an abort
+        CHECK(json::sax_parse(packed, &scp, json::input_format_t::msgpack));
     }
 }
 
+// use this testcase outside [hide] to run it with Valgrind
 TEST_CASE("single MessagePack roundtrip")
 {
     SECTION("sample.json")

tests/src/unit-regression2.cpp

@@ -239,6 +239,209 @@ class my_allocator : public std::allocator<T>
     };
 };
 
+/////////////////////////////////////////////////////////////////////
+// for #3077
+/////////////////////////////////////////////////////////////////////
+
+class FooAlloc
+{};
+
+class Foo
+{
+  public:
+    explicit Foo(const FooAlloc& /* unused */ = FooAlloc()) {}
+
+    bool value = false;
+};
+
+class FooBar
+{
+  public:
+    Foo foo{}; // NOLINT(readability-redundant-member-init)
+};
+
+inline void from_json(const nlohmann::json& j, FooBar& fb) // NOLINT(misc-use-internal-linkage)
+{
+    j.at("value").get_to(fb.foo.value);
+}
+
+/////////////////////////////////////////////////////////////////////
+// for #3171
+/////////////////////////////////////////////////////////////////////
+
+struct for_3171_base // NOLINT(cppcoreguidelines-special-member-functions)
+{
+    for_3171_base(const std::string& /*unused*/ = {}) {}
+    virtual ~for_3171_base();
+
+    for_3171_base(const for_3171_base& other) // NOLINT(hicpp-use-equals-default,modernize-use-equals-default)
+        : str(other.str)
+    {}
+
+    for_3171_base& operator=(const for_3171_base& other)
+    {
+        if (this != &other)
+        {
+            str = other.str;
+        }
+        return *this;
+    }
+
+    for_3171_base(for_3171_base&& other) noexcept
+        : str(std::move(other.str))
+    {}
+
+    for_3171_base& operator=(for_3171_base&& other) noexcept
+    {
+        if (this != &other)
+        {
+            str = std::move(other.str);
+        }
+        return *this;
+    }
+
+    virtual void _from_json(const json& j)
+    {
+        j.at("str").get_to(str);
+    }
+
+    std::string str{}; // NOLINT(readability-redundant-member-init)
+};
+
+for_3171_base::~for_3171_base() = default;
+
+struct for_3171_derived : public for_3171_base
+{
+    for_3171_derived() = default;
+    ~for_3171_derived() override;
+    explicit for_3171_derived(const std::string& /*unused*/) { }
+
+    for_3171_derived(const for_3171_derived& other) // NOLINT(hicpp-use-equals-default,modernize-use-equals-default)
+        : for_3171_base(other)
+    {}
+
+    for_3171_derived& operator=(const for_3171_derived& other)
+    {
+        if (this != &other)
+        {
+            for_3171_base::operator=(other); // Call base class assignment operator
+        }
+        return *this;
+    }
+
+    for_3171_derived(for_3171_derived&& other) noexcept
+        : for_3171_base(std::move(other))
+    {}
+
+    for_3171_derived& operator=(for_3171_derived&& other) noexcept
+    {
+        if (this != &other)
+        {
+            for_3171_base::operator=(std::move(other)); // Call base class move assignment operator
+        }
+        return *this;
+    }
+};
+
+for_3171_derived::~for_3171_derived() = default;
+
+inline void from_json(const json& j, for_3171_base& tb) // NOLINT(misc-use-internal-linkage)
+{
+    tb._from_json(j);
+}
+
+/////////////////////////////////////////////////////////////////////
+// for #3312
+/////////////////////////////////////////////////////////////////////
+
+#ifdef JSON_HAS_CPP_20
+struct for_3312
+{
+    std::string name;
+};
+
+inline void from_json(const json& j, for_3312& obj) // NOLINT(misc-use-internal-linkage)
+{
+    j.at("name").get_to(obj.name);
+}
+#endif
+
+/////////////////////////////////////////////////////////////////////
+// for #3204
+/////////////////////////////////////////////////////////////////////
+
+struct for_3204_foo
+{
+    for_3204_foo() = default;
+    explicit for_3204_foo(std::string /*unused*/) {} // NOLINT(performance-unnecessary-value-param)
+};
+
+struct for_3204_bar
+{
+    enum constructed_from_t // NOLINT(cppcoreguidelines-use-enum-class)
+    {
+        constructed_from_none = 0,
+        constructed_from_foo = 1,
+        constructed_from_json = 2
+    };
+
+    explicit for_3204_bar(std::function<void(for_3204_foo)> /*unused*/) noexcept // NOLINT(performance-unnecessary-value-param)
+        : constructed_from(constructed_from_foo) {}
+    explicit for_3204_bar(std::function<void(json)> /*unused*/) noexcept // NOLINT(performance-unnecessary-value-param)
+        : constructed_from(constructed_from_json) {}
+
+    constructed_from_t constructed_from = constructed_from_none;
+};
+
+/////////////////////////////////////////////////////////////////////
+// for #3333
+/////////////////////////////////////////////////////////////////////
+
+struct for_3333 final
+{
+    for_3333(int x_ = 0, int y_ = 0) : x(x_), y(y_) {}
+
+    template <class T>
+    for_3333(const T& /*unused*/)
+    {
+        CHECK(false);
+    }
+
+    int x = 0;
+    int y = 0;
+};
+
+template <>
+inline for_3333::for_3333(const json& j)
+    : for_3333(j.value("x", 0), j.value("y", 0))
+{}
+
+/////////////////////////////////////////////////////////////////////
+// for #3810
+/////////////////////////////////////////////////////////////////////
+
+struct Example_3810
+{
+    int bla{};
+
+    Example_3810() = default;
+};
+
+NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(Example_3810, bla) // NOLINT(misc-use-internal-linkage)
+
+/////////////////////////////////////////////////////////////////////
+// for #4740
+/////////////////////////////////////////////////////////////////////
+
+#ifdef JSON_HAS_CPP_17
+struct Example_4740
+{
+    std::optional<std::string> host = std::nullopt;
+    std::optional<int> port = std::nullopt;
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(Example_4740, host, port)
+};
+#endif
+
 TEST_CASE("regression tests 2")
 {
     SECTION("issue #1001 - Fix memory leak during parser callback")
@@ -756,6 +959,611 @@ TEST_CASE("regression tests 2")
         CHECK(j == k);
     }
 
+#if JSON_HAS_FILESYSTEM || JSON_HAS_EXPERIMENTAL_FILESYSTEM
+    // JSON_HAS_CPP_17 (do not remove; see note at top of file)
+    SECTION("issue #3070 - Version 3.10.3 breaks backward-compatibility with 3.10.2 ")
+    {
+        nlohmann::detail::std_fs::path text_path("/tmp/text.txt");
+        const json j(text_path);
+
+        const auto j_path = j.get<nlohmann::detail::std_fs::path>();
+        CHECK(j_path == text_path);
+
+#if DOCTEST_CLANG || DOCTEST_GCC >= DOCTEST_COMPILER(8, 4, 0)
+        // only known to work on Clang and GCC >=8.4
+        CHECK_THROWS_WITH_AS(nlohmann::detail::std_fs::path(json(1)), "[json.exception.type_error.302] type must be string, but is number", json::type_error);
+#endif
+    }
+#endif
+
+    SECTION("issue #3077 - explicit constructor with default does not compile")
+    {
+        json j;
+        j[0]["value"] = true;
+        std::vector<FooBar> foo;
+        j.get_to(foo);
+    }
+
+    SECTION("issue #3108 - ordered_json doesn't support range based erase")
+    {
+        ordered_json j = {1, 2, 2, 4};
+
+        auto last = std::unique(j.begin(), j.end());
+        j.erase(last, j.end());
+
+        CHECK(j.dump() == "[1,2,4]");
+
+        j.erase(std::remove_if(j.begin(), j.end(), [](const ordered_json & val)
+        {
+            return val == 2;
+        }), j.end());
+
+        CHECK(j.dump() == "[1,4]");
+    }
+
+    SECTION("issue #3343 - json and ordered_json are not interchangeable")
+    {
+        json::object_t jobj({ { "product", "one" } });
+        ordered_json::object_t ojobj({{"product", "one"}});
+
+        auto jit = jobj.begin();
+        auto ojit = ojobj.begin();
+
+        CHECK(jit->first == ojit->first);
+        CHECK(jit->second.get<std::string>() == ojit->second.get<std::string>());
+    }
+
+    SECTION("issue #3171 - if class is_constructible from std::string wrong from_json overload is being selected, compilation failed")
+    {
+        const json j{{ "str", "value"}};
+
+        // failed with: error: no match for ‘operator=’ (operand types are ‘for_3171_derived’ and ‘const nlohmann::basic_json<>::string_t’
+        //                                               {aka ‘const std::__cxx11::basic_string<char>’})
+        //                  s = *j.template get_ptr<const typename BasicJsonType::string_t*>();
+        auto td = j.get<for_3171_derived>();
+
+        CHECK(td.str == "value");
+    }
+
+#ifdef JSON_HAS_CPP_20
+    SECTION("issue #3312 - Parse to custom class from unordered_json breaks on G++11.2.0 with C++20")
+    {
+        // see test for #3171
+        const ordered_json j = {{"name", "class"}};
+        for_3312 obj{};
+
+        j.get_to(obj);
+
+        CHECK(obj.name == "class");
+    }
+#endif
+
+#if defined(JSON_HAS_CPP_17) && JSON_USE_IMPLICIT_CONVERSIONS
+    SECTION("issue #3428 - Error occurred when converting nlohmann::json to std::any")
+    {
+        const json j;
+        const std::any a1 = j;
+        std::any&& a2 = j;
+
+        CHECK(a1.type() == typeid(j));
+        CHECK(a2.type() == typeid(j));
+    }
+#endif
+
+    SECTION("issue #3204 - ambiguous regression")
+    {
+        const for_3204_bar bar_from_foo([](for_3204_foo) noexcept {}); // NOLINT(performance-unnecessary-value-param)
+        const for_3204_bar bar_from_json([](json) noexcept {}); // NOLINT(performance-unnecessary-value-param)
+
+        CHECK(bar_from_foo.constructed_from == for_3204_bar::constructed_from_foo);
+        CHECK(bar_from_json.constructed_from == for_3204_bar::constructed_from_json);
+    }
+
+    SECTION("issue #3333 - Ambiguous conversion from nlohmann::basic_json<> to custom class")
+    {
+        const json j
+        {
+            {"x", 1},
+            {"y", 2}
+        };
+        const for_3333 p = j;
+
+        CHECK(p.x == 1);
+        CHECK(p.y == 2);
+    }
+
+    SECTION("issue #3810 - ordered_json doesn't support construction from C array of custom type")
+    {
+        Example_3810 states[45]; // NOLINT(cppcoreguidelines-avoid-c-arrays,hicpp-avoid-c-arrays,modernize-avoid-c-arrays)
+
+        // fix "not used" warning
+        states[0].bla = 1;
+
+        const auto* const expected = R"([{"bla":1},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0}])";
+
+        // This works:
+        nlohmann::json j;
+        j["test"] = states;
+        CHECK(j["test"].dump() == expected);
+
+        // This doesn't compile:
+        nlohmann::ordered_json oj;
+        oj["test"] = states;
+        CHECK(oj["test"].dump() == expected);
+    }
+
+#ifdef JSON_HAS_CPP_17
+    SECTION("issue #4740 - build issue with std::optional")
+    {
+        const auto t1 = Example_4740();
+        const auto j1 = nlohmann::json(t1);
+        CHECK(j1.dump() == "{\"host\":null,\"port\":null}");
+        const auto t2 = j1.get<Example_4740>();
+        CHECK(!t2.host.has_value());
+        CHECK(!t2.port.has_value());
+
+        // improve coverage
+        auto t3 = Example_4740();
+        t3.port = 80;
+        t3.host = "example.com";
+        const auto j2 = nlohmann::json(t3);
+        CHECK(j2.dump() == "{\"host\":\"example.com\",\"port\":80}");
+        const auto t4 = j2.get<Example_4740>();
+        CHECK(t4.host.has_value());
+        CHECK(t4.port.has_value());
+    }
+#endif
+
+#if !defined(_MSVC_LANG)
+    // MSVC returns garbage on invalid enum values, so this test is excluded
+    // there.
+    SECTION("issue #4762 - json exception 302 with unhelpful explanation : type must be number, but is number")
+    {
+        // In #4762, the main issue was that a json object with an invalid type
+        // returned "number" as type_name(), because this was the default case.
+        // This test makes sure we now return "invalid" instead.
+        json j;
+        j.m_data.m_type = static_cast<json::value_t>(100); // NOLINT(clang-analyzer-optin.core.EnumCastOutOfRange)
+        CHECK(j.type_name() == "invalid");
+    }
+#endif
+
+#ifdef JSON_HAS_CPP_17
+    SECTION("issue #4804: from_cbor incompatible with std::vector<std::byte> as binary_t")
+    {
+        const std::vector<std::uint8_t> data = {0x80};
+        const auto decoded = json_4804::from_cbor(data);
+        CHECK((decoded == json_4804::array()));
+    }
+
+    SECTION("discussion #4209 - custom BinaryType direct assignment and round-tripping")
+    {
+        // Test that assigning a custom BinaryType directly creates a binary value, not an array
+        const std::vector<std::byte> original{std::byte{1}, std::byte{2}, std::byte{3}};
+        const json_4804 j = original;
+        CHECK(j.is_binary());
+        CHECK(!j.is_array());
+
+        // Test round-tripping: extracting the binary value back as the custom container type
+        const auto extracted = j.get<std::vector<std::byte>>();
+        CHECK(extracted == original);
+
+        // Test that the default json alias behavior is unchanged: std::vector<uint8_t> -> array
+        const json default_json = std::vector<std::uint8_t> {1, 2, 3};
+        CHECK(default_json.is_array());
+        CHECK(!default_json.is_binary());
+    }
+
+    SECTION("discussion #4209 - custom BinaryType extraction from parsed array")
+    {
+        // Test that extracting a custom BinaryType from a parsed JSON array still works
+        // (not just from a binary-typed node)
+        const auto j = json_4804::parse("[1,2,3]");
+        CHECK(j.is_array());
+        CHECK(!j.is_binary());
+
+        // Extracting as custom BinaryType should work from arrays
+        const auto extracted = j.get<std::vector<std::byte>>();
+        CHECK(extracted.size() == 3);
+        CHECK(extracted[0] == std::byte{1});
+        CHECK(extracted[1] == std::byte{2});
+        CHECK(extracted[2] == std::byte{3});
+    }
+
+    SECTION("issue #5046 - implicit conversion of return json to std::optional no longer implicit")
+    {
+        const json jval{};
+        auto GetValue = [](const json & valRoot) -> std::optional<json>
+        {
+            if (valRoot.contains("default"))
+            {
+                return valRoot.at("default");
+            }
+            return std::nullopt;
+        };
+        auto result = GetValue(jval);
+        CHECK(!result.has_value());
+    }
+#endif
+
+#if JSON_HAS_RANGES == 1
+    SECTION("issue #4440 - assert when using std::views::filter and GCC 10")
+    {
+        auto noOpFilter = std::views::filter([](auto&&) noexcept
+        {
+            return true;
+        });
+        json j = {1, 2, 3};
+        auto filtered = j | noOpFilter;
+        CHECK(*filtered.begin() == 1);
+    }
+#endif
+
+#if JSON_HAS_RANGES && !defined(__MINGW32__)
+    SECTION("issue #4916 - constructing array from C++20 ranges view does not work")
+    {
+        std::vector<int> nums{1, 2, 37, 42, 21};
+        auto filteredNums = nums | std::views::filter([](int i)
+        {
+            return i > 10;
+        });
+        json const j(filteredNums);
+        CHECK(j.type() == json::value_t::array);
+        CHECK(j == json({37, 42, 21}));
+    }
+#endif
+
+    // owning_view is not available in libstdc++ < 12
+#if JSON_HAS_RANGES && !defined(__MINGW32__) && !(defined(__GLIBCXX__) && _GLIBCXX_RELEASE < 12)
+    SECTION("issue #4916 - constructing array from prvalue C++20 ranges view (owning_view)")
+    {
+        json const j(std::vector<int> {1, 2, 37, 42, 21} | std::views::filter([](int i)
+        {
+            return i > 10;
+        }));
+        CHECK(j.type() == json::value_t::array);
+        CHECK(j == json({37, 42, 21}));
+    }
+#endif
+
+#if JSON_HAS_RANGES && !defined(__MINGW32__)
+    SECTION("issue #4916 - constructing array from C++20 transform view (prvalue elements)")
+    {
+        std::vector<int> nums{1, 2, 3};
+        auto t = nums | std::views::transform([](int i) noexcept
+        {
+            return i * 2;
+        });
+        json const j(t);
+        CHECK(j.type() == json::value_t::array);
+        CHECK(j == json({2, 4, 6}));
+    }
+#endif
+}
+
+TEST_CASE_TEMPLATE("issue #4798 - nlohmann::json::to_msgpack() encode float NaN as double", T, double, float) // NOLINT(readability-math-missing-parentheses, bugprone-throwing-static-initialization)
+{
+    // With issue #4798, we encode NaN, infinity, and -infinity as float instead
+    // of double to allow for smaller encodings.
+    const json jx = std::numeric_limits<T>::quiet_NaN();
+    const json jy = std::numeric_limits<T>::infinity();
+    const json jz = -std::numeric_limits<T>::infinity();
+
+    /////////////////////////////////////////////////////////////////////////
+    // MessagePack
+    /////////////////////////////////////////////////////////////////////////
+
+    // expected MessagePack values
+    const std::vector<std::uint8_t> msgpack_x = {{0xCA, 0x7F, 0xC0, 0x00, 0x00}};
+    const std::vector<std::uint8_t> msgpack_y = {{0xCA, 0x7F, 0x80, 0x00, 0x00}};
+    const std::vector<std::uint8_t> msgpack_z = {{0xCA, 0xFF, 0x80, 0x00, 0x00}};
+
+    CHECK(json::to_msgpack(jx) == msgpack_x);
+    CHECK(json::to_msgpack(jy) == msgpack_y);
+    CHECK(json::to_msgpack(jz) == msgpack_z);
+
+    CHECK(std::isnan(json::from_msgpack(msgpack_x).get<T>()));
+    CHECK(json::from_msgpack(msgpack_y).get<T>() == std::numeric_limits<T>::infinity());
+    CHECK(json::from_msgpack(msgpack_z).get<T>() == -std::numeric_limits<T>::infinity());
+
+    // Make sure the other MessagePakc encodings for NaN, infinity, and
+    // -infinity are still supported.
+    const std::vector<std::uint8_t> msgpack_x_2 = {{0xCB, 0x7F, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
+    const std::vector<std::uint8_t> msgpack_y_2 = {{0xCB, 0x7F, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
+    const std::vector<std::uint8_t> msgpack_z_2 = {{0xCB, 0xFF, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
+    CHECK(std::isnan(json::from_msgpack(msgpack_x_2).get<T>()));
+    CHECK(json::from_msgpack(msgpack_y_2).get<T>() == std::numeric_limits<T>::infinity());
+    CHECK(json::from_msgpack(msgpack_z_2).get<T>() == -std::numeric_limits<T>::infinity());
+
+    /////////////////////////////////////////////////////////////////////////
+    // CBOR
+    /////////////////////////////////////////////////////////////////////////
+
+    // expected CBOR values
+    const std::vector<std::uint8_t> cbor_x = {{0xF9, 0x7E, 0x00}};
+    const std::vector<std::uint8_t> cbor_y = {{0xF9, 0x7C, 0x00}};
+    const std::vector<std::uint8_t> cbor_z = {{0xF9, 0xfC, 0x00}};
+
+    CHECK(json::to_cbor(jx) == cbor_x);
+    CHECK(json::to_cbor(jy) == cbor_y);
+    CHECK(json::to_cbor(jz) == cbor_z);
+
+    CHECK(std::isnan(json::from_cbor(cbor_x).get<T>()));
+    CHECK(json::from_cbor(cbor_y).get<T>() == std::numeric_limits<T>::infinity());
+    CHECK(json::from_cbor(cbor_z).get<T>() == -std::numeric_limits<T>::infinity());
+
+    // Make sure the other CBOR encodings for NaN, infinity, and -infinity are
+    // still supported.
+    const std::vector<std::uint8_t> cbor_x_2 = {{0xFA, 0x7F, 0xC0, 0x00, 0x00}};
+    const std::vector<std::uint8_t> cbor_y_2 = {{0xFA, 0x7F, 0x80, 0x00, 0x00}};
+    const std::vector<std::uint8_t> cbor_z_2 = {{0xFA, 0xFF, 0x80, 0x00, 0x00}};
+    const std::vector<std::uint8_t> cbor_x_3 = {{0xFB, 0x7F, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
+    const std::vector<std::uint8_t> cbor_y_3 = {{0xFB, 0x7F, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
+    const std::vector<std::uint8_t> cbor_z_3 = {{0xFB, 0xFF, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
+    CHECK(std::isnan(json::from_cbor(cbor_x_2).get<T>()));
+    CHECK(json::from_cbor(cbor_y_2).get<T>() == std::numeric_limits<T>::infinity());
+    CHECK(json::from_cbor(cbor_z_2).get<T>() == -std::numeric_limits<T>::infinity());
+    CHECK(std::isnan(json::from_cbor(cbor_x_3).get<T>()));
+    CHECK(json::from_cbor(cbor_y_3).get<T>() == std::numeric_limits<T>::infinity());
+    CHECK(json::from_cbor(cbor_z_3).get<T>() == -std::numeric_limits<T>::infinity());
+}
+
+TEST_CASE("regression test #5074 - portable workaround for single-element brace init")
+{
+    json const j_obj = {{"key", "value"}};
+
+    json const j = json::array({j_obj});
+    CHECK(j.is_array());
+    CHECK(j.size() == 1);
+    CHECK(j[0] == j_obj);
+}
+
+#if defined(JSON_BRACE_INIT_COPY_SEMANTICS) && (JSON_BRACE_INIT_COPY_SEMANTICS == 1)
+TEST_CASE("regression test #5074 - single-element brace init with JSON_BRACE_INIT_COPY_SEMANTICS")
+{
+    // with JSON_BRACE_INIT_COPY_SEMANTICS: single-element brace init copies/moves
+    json const j_obj = {{"key", "value"}, {"num", 42}};
+    json const j_arr = {1, 2, 3};
+
+    // object: brace init copies instead of wrapping
+    json const j1{j_obj};
+    CHECK(j1.is_object());
+    CHECK(j1 == j_obj);
+
+    // array: brace init copies instead of wrapping
+    json const j2{j_arr};
+    CHECK(j2.is_array());
+    CHECK(j2.size() == 3);
+    CHECK(j2 == j_arr);
+
+    // primitives still work as initializer lists
+    json const j3{true};
+    CHECK(j3.is_boolean());
+
+    json const j4{42};
+    CHECK(j4.is_number_integer());
+}
+#endif
+
+struct Example_5122
+{
+    float b = 2;
+    nlohmann::ordered_map<std::string, std::string> c{}; // NOLINT(readability-redundant-member-init): needed for GCC -Weffc++
+    int a = 1;
+    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(Example_5122, b, c, a)
+};
+
+TEST_CASE("regression test #5122 - from_json into types holding nlohmann::ordered_map")
+{
+    Example_5122 src;
+    src.c.emplace("first", "1");
+    src.c.emplace("second", "2");
+
+    ordered_json const j = src;
+    Example_5122 const dst = j.get<Example_5122>();
+
+    CHECK(dst.b == src.b);
+    CHECK(dst.a == src.a);
+    REQUIRE(dst.c.size() == src.c.size());
+    auto src_it = src.c.begin();
+    auto dst_it = dst.c.begin();
+    for (; src_it != src.c.end(); ++src_it, ++dst_it)
+    {
+        CHECK(dst_it->first == src_it->first);
+        CHECK(dst_it->second == src_it->second);
+    }
+}
+
+// -Wself-assign-overloaded was introduced in Clang 7. Gate the pragma on
+// __has_warning so older Clang versions do not error with "unknown warning
+// group". The __has_warning check has to stay inside the __clang__ branch
+// because GCC does not provide it and would tokenize-error on the argument.
+#if defined(__clang__) && defined(__has_warning)
+    #if __has_warning("-Wself-assign-overloaded")
+        DOCTEST_CLANG_SUPPRESS_WARNING_PUSH
+        DOCTEST_CLANG_SUPPRESS_WARNING("-Wself-assign-overloaded")
+    #endif
+#endif
+
+TEST_CASE("regression test #5122 - nlohmann::ordered_map copy-assignment is self-assignment safe")
+{
+    nlohmann::ordered_map<std::string, std::string> m;
+    m.emplace("first", "1");
+    m.emplace("second", "2");
+
+    // Insertion order is preserved by ordered_map, so we can check it directly.
+    m = m;
+
+    REQUIRE(m.size() == 2);
+    auto it = m.begin();
+    CHECK(it->first == "first");
+    CHECK(it->second == "1");
+    ++it;
+    CHECK(it->first == "second");
+    CHECK(it->second == "2");
+}
+
+#if defined(__clang__) && defined(__has_warning)
+    #if __has_warning("-Wself-assign-overloaded")
+        DOCTEST_CLANG_SUPPRESS_WARNING_POP
+    #endif
+#endif
+
+TEST_CASE("regression test #5122 - nlohmann::ordered_map move-assignment transfers contents")
+{
+    nlohmann::ordered_map<std::string, std::string> src;
+    src.emplace("first", "1");
+    src.emplace("second", "2");
+
+    nlohmann::ordered_map<std::string, std::string> dst;
+    dst.emplace("stale", "x");
+    dst = std::move(src);
+
+    REQUIRE(dst.size() == 2);
+    auto it = dst.begin();
+    CHECK(it->first == "first");
+    CHECK(it->second == "1");
+    ++it;
+    CHECK(it->first == "second");
+    CHECK(it->second == "2");
+
+    // Re-assigning into the moved-from object must leave it in a usable state.
+    src = nlohmann::ordered_map<std::string, std::string> {};
+    src.emplace("after-move", "3");
+    REQUIRE(src.size() == 1);
+    CHECK(src.begin()->first == "after-move");
+}
+
+// Stand-in for a third-party library (e.g., Eigen as of 3.4, which added
+// STL-compatible begin()/end() to its vector types), living in its own
+// namespace with its own to_json overload for its vector type.
+namespace issue_4320_eigen
+{
+// "array-compatible" from the library's point of view (it has begin()/end()),
+// but for which this (fake) third-party namespace provides its own to_json.
+struct vector3
+{
+    double v[3]; // NOLINT(cppcoreguidelines-avoid-c-arrays,hicpp-avoid-c-arrays,modernize-avoid-c-arrays,cppcoreguidelines-use-default-member-init,modernize-use-default-member-init)
+    vector3(double x, double y, double z) : v{x, y, z} {} // NOLINT(hicpp-member-init,cppcoreguidelines-pro-type-member-init)
+    double x() const
+    {
+        return v[0];
+    }
+    double y() const
+    {
+        return v[1];
+    }
+    double z() const
+    {
+        return v[2];
+    }
+    double* begin()
+    {
+        return v;
+    }
+    double* end()
+    {
+        return v + 3;
+    }
+    const double* begin() const
+    {
+        return v;
+    }
+    const double* end() const
+    {
+        return v + 3;
+    }
+};
+
+inline void to_json(json& j, const vector3& v) // NOLINT(misc-use-internal-linkage)
+{
+    j = {{"x", v.x()}, {"y", v.y()}, {"z", v.z()}};
+}
+} // namespace issue_4320_eigen
+
+// The user's own namespace, using the (fake) Eigen type as an implementation
+// detail behind a payload type that has nothing to do with vectors/arrays.
+namespace issue_4320
+{
+// Publicly derives from issue_4320_eigen::vector3 but does *not* define its
+// own to_json - it is only ever used as a temporary to reach the base
+// class's to_json via ADL.
+struct vector3_wrapper : issue_4320_eigen::vector3
+{
+    using issue_4320_eigen::vector3::vector3;
+};
+
+struct payload
+{
+    double x, y, z;
+};
+
+inline vector3_wrapper to_eigen(const payload& p) // NOLINT(misc-use-internal-linkage)
+{
+    return {p.x, p.y, p.z};
+}
+
+inline void to_json(json& j, const payload& p) // NOLINT(misc-use-internal-linkage)
+{
+    // Unqualified call, passing a *derived* vector3_wrapper: relies on ADL
+    // finding issue_4320_eigen::to_json(json&, const vector3&) through the
+    // vector3 base class, via a derived-to-base conversion. Must NOT resolve
+    // to the library's own generic array-compatible to_json (an exact-match
+    // template for vector3_wrapper, since it also has begin()/end()), which
+    // would serialize this as [x, y, z] instead of {"x":x, "y":y, "z":z}.
+    to_json(j, to_eigen(p));
+}
+} // namespace issue_4320
+
+TEST_CASE("issue #4320 - custom base class must not leak nlohmann::detail into ADL")
+{
+    // Before the fix, basic_json unconditionally derived from a type living in
+    // nlohmann::detail (json_default_base), which made nlohmann::detail an
+    // associated namespace of every basic_json for ADL purposes. That leaked
+    // the library's internal generic-array to_json overload into unqualified
+    // to_json() calls made from user code, silently bypassing user-defined
+    // to_json overloads reached via a derived-to-base conversion.
+    const issue_4320::payload p{1.0, 2.0, 3.0};
+
+    json j;
+    to_json(j, p);
+    CHECK(j == json({{"x", 1.0}, {"y", 2.0}, {"z", 3.0}}));
+}
+
+TEST_CASE("issue #5338 - truncated CBOR tagged binary subtype is rejected")
+{
+    const std::vector<std::vector<std::uint8_t>> truncated_tags =
+    {
+        {0xD8},
+        {0xD9, 0x00},
+        {0xDA, 0x00, 0x00, 0x00},
+        {0xDB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
+    };
+
+    for (const auto& data : truncated_tags)
+    {
+        CAPTURE(data);
+        for (const auto tag_handler :
+                {
+                    json::cbor_tag_handler_t::ignore, json::cbor_tag_handler_t::store
+                })
+        {
+            CAPTURE(tag_handler);
+            const auto result = json::from_cbor(data, true, false, tag_handler);
+            CHECK(result.is_discarded());
+        }
+    }
+}
+
+TEST_CASE("issue #5402 - update(merge_objects=true) overwrites a primitive with an object")
+{
+    json t = {{"k", 1}};
+    t.update(json{{"k", {{"x", 2}}}}, true);
+    CHECK(t == json({{"k", {{"x", 2}}}}));
+
+    json mixed = {{"keep", {{"a", 1}}}, {"replace", 1}};
+    mixed.update(json{{"keep", {{"b", 2}}}, {"replace", {{"x", 2}}}}, true);
+    CHECK(mixed == json({{"keep", {{"a", 1}, {"b", 2}}}, {"replace", {{"x", 2}}}}));
 }
 
 DOCTEST_CLANG_SUPPRESS_WARNING_POP

tests/src/unit-regression3.cpp

@@ -1,899 +0,0 @@
-//     __ _____ _____ _____
-//  __|  |   __|     |   | |  JSON for Modern C++ (supporting code)
-// |  |  |__   |  |  | | | |  version 3.12.0
-// |_____|_____|_____|_|___|  https://github.com/nlohmann/json
-//
-// SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
-// SPDX-License-Identifier: MIT
-
-// cmake/test.cmake selects the C++ standard versions with which to build a
-// unit test based on the presence of JSON_HAS_CPP_<VERSION> macros.
-// When using macros that are only defined for particular versions of the standard
-// (e.g., JSON_HAS_FILESYSTEM for C++17 and up), please mention the corresponding
-// version macro in a comment close by, like this:
-// JSON_HAS_CPP_<VERSION> (do not remove; see note at top of file)
-
-#include "doctest_compatibility.h"
-
-// for some reason including this after the json header leads to linker errors with VS 2017...
-#include <locale>
-
-#define JSON_TESTS_PRIVATE
-#include <nlohmann/json.hpp>
-using json = nlohmann::json;
-using ordered_json = nlohmann::ordered_json;
-#ifdef JSON_TEST_NO_GLOBAL_UDLS
-    using namespace nlohmann::literals; // NOLINT(google-build-using-namespace)
-#endif
-
-#include <cstdio>
-#include <list>
-#include <type_traits>
-#include <utility>
-
-#ifdef JSON_HAS_CPP_17
-    #include <any>
-    #include <variant>
-#endif
-
-#ifdef JSON_HAS_CPP_17
-    #if __has_include(<optional>)
-        #include <optional>
-    #elif __has_include(<experimental/optional>)
-    #endif
-
-    /////////////////////////////////////////////////////////////////////
-    // for #4804
-    /////////////////////////////////////////////////////////////////////
-    using json_4804 = nlohmann::basic_json<std::map,        // ObjectType
-    std::vector,     // ArrayType
-    std::string,     // StringType
-    bool,            // BooleanType
-    std::int64_t,    // NumberIntegerType
-    std::uint64_t,   // NumberUnsignedType
-    double,          // NumberFloatType
-    std::allocator,  // AllocatorType
-    nlohmann::adl_serializer,  // JSONSerializer
-    std::vector<std::byte>,    // BinaryType
-    void                       // CustomBaseClass
-    >;
-#endif
-
-#ifdef JSON_HAS_CPP_20
-    #if __has_include(<span>)
-        #include <span>
-    #endif
-#endif
-
-/////////////////////////////////////////////////////////////////////
-// for #4825 - explicitly instantiating basic_json must compile; this
-// forces instantiation of binary_writer::write_bjdata_ndarray, whose
-// static_cast<string_t> was ambiguous under explicit instantiation on
-// C++17. Merely compiling this translation unit is the regression test.
-/////////////////////////////////////////////////////////////////////
-template class nlohmann::basic_json<>;
-
-/////////////////////////////////////////////////////////////////////
-// for #4440
-/////////////////////////////////////////////////////////////////////
-#if JSON_HAS_RANGES == 1
-    #include <ranges>
-#endif
-
-// NLOHMANN_JSON_SERIALIZE_ENUM uses a static std::pair
-DOCTEST_CLANG_SUPPRESS_WARNING_PUSH
-DOCTEST_CLANG_SUPPRESS_WARNING("-Wexit-time-destructors")
-/////////////////////////////////////////////////////////////////////
-// for #3077
-/////////////////////////////////////////////////////////////////////
-
-class FooAlloc
-{};
-
-class Foo
-{
-  public:
-    explicit Foo(const FooAlloc& /* unused */ = FooAlloc()) {}
-
-    bool value = false;
-};
-
-class FooBar
-{
-  public:
-    Foo foo{}; // NOLINT(readability-redundant-member-init)
-};
-
-inline void from_json(const nlohmann::json& j, FooBar& fb) // NOLINT(misc-use-internal-linkage)
-{
-    j.at("value").get_to(fb.foo.value);
-}
-
-/////////////////////////////////////////////////////////////////////
-// for #3171
-/////////////////////////////////////////////////////////////////////
-
-struct for_3171_base // NOLINT(cppcoreguidelines-special-member-functions)
-{
-    for_3171_base(const std::string& /*unused*/ = {}) {}
-    virtual ~for_3171_base();
-
-    for_3171_base(const for_3171_base& other) // NOLINT(hicpp-use-equals-default,modernize-use-equals-default)
-        : str(other.str)
-    {}
-
-    for_3171_base& operator=(const for_3171_base& other)
-    {
-        if (this != &other)
-        {
-            str = other.str;
-        }
-        return *this;
-    }
-
-    for_3171_base(for_3171_base&& other) noexcept
-        : str(std::move(other.str))
-    {}
-
-    for_3171_base& operator=(for_3171_base&& other) noexcept
-    {
-        if (this != &other)
-        {
-            str = std::move(other.str);
-        }
-        return *this;
-    }
-
-    virtual void _from_json(const json& j)
-    {
-        j.at("str").get_to(str);
-    }
-
-    std::string str{}; // NOLINT(readability-redundant-member-init)
-};
-
-for_3171_base::~for_3171_base() = default;
-
-struct for_3171_derived : public for_3171_base
-{
-    for_3171_derived() = default;
-    ~for_3171_derived() override;
-    explicit for_3171_derived(const std::string& /*unused*/) { }
-
-    for_3171_derived(const for_3171_derived& other) // NOLINT(hicpp-use-equals-default,modernize-use-equals-default)
-        : for_3171_base(other)
-    {}
-
-    for_3171_derived& operator=(const for_3171_derived& other)
-    {
-        if (this != &other)
-        {
-            for_3171_base::operator=(other); // Call base class assignment operator
-        }
-        return *this;
-    }
-
-    for_3171_derived(for_3171_derived&& other) noexcept
-        : for_3171_base(std::move(other))
-    {}
-
-    for_3171_derived& operator=(for_3171_derived&& other) noexcept
-    {
-        if (this != &other)
-        {
-            for_3171_base::operator=(std::move(other)); // Call base class move assignment operator
-        }
-        return *this;
-    }
-};
-
-for_3171_derived::~for_3171_derived() = default;
-
-inline void from_json(const json& j, for_3171_base& tb) // NOLINT(misc-use-internal-linkage)
-{
-    tb._from_json(j);
-}
-
-/////////////////////////////////////////////////////////////////////
-// for #3312
-/////////////////////////////////////////////////////////////////////
-
-#ifdef JSON_HAS_CPP_20
-struct for_3312
-{
-    std::string name;
-};
-
-inline void from_json(const json& j, for_3312& obj) // NOLINT(misc-use-internal-linkage)
-{
-    j.at("name").get_to(obj.name);
-}
-#endif
-
-/////////////////////////////////////////////////////////////////////
-// for #3204
-/////////////////////////////////////////////////////////////////////
-
-struct for_3204_foo
-{
-    for_3204_foo() = default;
-    explicit for_3204_foo(std::string /*unused*/) {} // NOLINT(performance-unnecessary-value-param)
-};
-
-struct for_3204_bar
-{
-    enum constructed_from_t // NOLINT(cppcoreguidelines-use-enum-class)
-    {
-        constructed_from_none = 0,
-        constructed_from_foo = 1,
-        constructed_from_json = 2
-    };
-
-    explicit for_3204_bar(std::function<void(for_3204_foo)> /*unused*/) noexcept // NOLINT(performance-unnecessary-value-param)
-        : constructed_from(constructed_from_foo) {}
-    explicit for_3204_bar(std::function<void(json)> /*unused*/) noexcept // NOLINT(performance-unnecessary-value-param)
-        : constructed_from(constructed_from_json) {}
-
-    constructed_from_t constructed_from = constructed_from_none;
-};
-
-/////////////////////////////////////////////////////////////////////
-// for #3333
-/////////////////////////////////////////////////////////////////////
-
-struct for_3333 final
-{
-    for_3333(int x_ = 0, int y_ = 0) : x(x_), y(y_) {}
-
-    template <class T>
-    for_3333(const T& /*unused*/)
-    {
-        CHECK(false);
-    }
-
-    int x = 0;
-    int y = 0;
-};
-
-template <>
-inline for_3333::for_3333(const json& j)
-    : for_3333(j.value("x", 0), j.value("y", 0))
-{}
-
-/////////////////////////////////////////////////////////////////////
-// for #3810
-/////////////////////////////////////////////////////////////////////
-
-struct Example_3810
-{
-    int bla{};
-
-    Example_3810() = default;
-};
-
-NLOHMANN_DEFINE_TYPE_NON_INTRUSIVE(Example_3810, bla) // NOLINT(misc-use-internal-linkage)
-
-/////////////////////////////////////////////////////////////////////
-// for #4740
-/////////////////////////////////////////////////////////////////////
-
-#ifdef JSON_HAS_CPP_17
-struct Example_4740
-{
-    std::optional<std::string> host = std::nullopt;
-    std::optional<int> port = std::nullopt;
-    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(Example_4740, host, port)
-};
-#endif
-
-TEST_CASE("regression tests 3")
-{
-#if JSON_HAS_FILESYSTEM || JSON_HAS_EXPERIMENTAL_FILESYSTEM
-    // JSON_HAS_CPP_17 (do not remove; see note at top of file)
-    SECTION("issue #3070 - Version 3.10.3 breaks backward-compatibility with 3.10.2 ")
-    {
-        nlohmann::detail::std_fs::path text_path("/tmp/text.txt");
-        const json j(text_path);
-
-        const auto j_path = j.get<nlohmann::detail::std_fs::path>();
-        CHECK(j_path == text_path);
-
-#if DOCTEST_CLANG || DOCTEST_GCC >= DOCTEST_COMPILER(8, 4, 0)
-        // only known to work on Clang and GCC >=8.4
-        CHECK_THROWS_WITH_AS(nlohmann::detail::std_fs::path(json(1)), "[json.exception.type_error.302] type must be string, but is number", json::type_error);
-#endif
-    }
-#endif
-
-    SECTION("issue #3077 - explicit constructor with default does not compile")
-    {
-        json j;
-        j[0]["value"] = true;
-        std::vector<FooBar> foo;
-        j.get_to(foo);
-    }
-
-    SECTION("issue #3108 - ordered_json doesn't support range based erase")
-    {
-        ordered_json j = {1, 2, 2, 4};
-
-        auto last = std::unique(j.begin(), j.end());
-        j.erase(last, j.end());
-
-        CHECK(j.dump() == "[1,2,4]");
-
-        j.erase(std::remove_if(j.begin(), j.end(), [](const ordered_json & val)
-        {
-            return val == 2;
-        }), j.end());
-
-        CHECK(j.dump() == "[1,4]");
-    }
-
-    SECTION("issue #3343 - json and ordered_json are not interchangeable")
-    {
-        json::object_t jobj({ { "product", "one" } });
-        ordered_json::object_t ojobj({{"product", "one"}});
-
-        auto jit = jobj.begin();
-        auto ojit = ojobj.begin();
-
-        CHECK(jit->first == ojit->first);
-        CHECK(jit->second.get<std::string>() == ojit->second.get<std::string>());
-    }
-
-    SECTION("issue #3171 - if class is_constructible from std::string wrong from_json overload is being selected, compilation failed")
-    {
-        const json j{{ "str", "value"}};
-
-        // failed with: error: no match for ‘operator=’ (operand types are ‘for_3171_derived’ and ‘const nlohmann::basic_json<>::string_t’
-        //                                               {aka ‘const std::__cxx11::basic_string<char>’})
-        //                  s = *j.template get_ptr<const typename BasicJsonType::string_t*>();
-        auto td = j.get<for_3171_derived>();
-
-        CHECK(td.str == "value");
-    }
-
-#ifdef JSON_HAS_CPP_20
-    SECTION("issue #3312 - Parse to custom class from unordered_json breaks on G++11.2.0 with C++20")
-    {
-        // see test for #3171
-        const ordered_json j = {{"name", "class"}};
-        for_3312 obj{};
-
-        j.get_to(obj);
-
-        CHECK(obj.name == "class");
-    }
-#endif
-
-#if defined(JSON_HAS_CPP_17) && JSON_USE_IMPLICIT_CONVERSIONS
-    SECTION("issue #3428 - Error occurred when converting nlohmann::json to std::any")
-    {
-        const json j;
-        const std::any a1 = j;
-        std::any&& a2 = j;
-
-        CHECK(a1.type() == typeid(j));
-        CHECK(a2.type() == typeid(j));
-    }
-#endif
-
-    SECTION("issue #3204 - ambiguous regression")
-    {
-        const for_3204_bar bar_from_foo([](for_3204_foo) noexcept {}); // NOLINT(performance-unnecessary-value-param)
-        const for_3204_bar bar_from_json([](json) noexcept {}); // NOLINT(performance-unnecessary-value-param)
-
-        CHECK(bar_from_foo.constructed_from == for_3204_bar::constructed_from_foo);
-        CHECK(bar_from_json.constructed_from == for_3204_bar::constructed_from_json);
-    }
-
-    SECTION("issue #3333 - Ambiguous conversion from nlohmann::basic_json<> to custom class")
-    {
-        const json j
-        {
-            {"x", 1},
-            {"y", 2}
-        };
-        const for_3333 p = j;
-
-        CHECK(p.x == 1);
-        CHECK(p.y == 2);
-    }
-
-    SECTION("issue #3810 - ordered_json doesn't support construction from C array of custom type")
-    {
-        Example_3810 states[45]; // NOLINT(cppcoreguidelines-avoid-c-arrays,hicpp-avoid-c-arrays,modernize-avoid-c-arrays)
-
-        // fix "not used" warning
-        states[0].bla = 1;
-
-        const auto* const expected = R"([{"bla":1},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0},{"bla":0}])";
-
-        // This works:
-        nlohmann::json j;
-        j["test"] = states;
-        CHECK(j["test"].dump() == expected);
-
-        // This doesn't compile:
-        nlohmann::ordered_json oj;
-        oj["test"] = states;
-        CHECK(oj["test"].dump() == expected);
-    }
-
-#ifdef JSON_HAS_CPP_17
-    SECTION("issue #4740 - build issue with std::optional")
-    {
-        const auto t1 = Example_4740();
-        const auto j1 = nlohmann::json(t1);
-        CHECK(j1.dump() == "{\"host\":null,\"port\":null}");
-        const auto t2 = j1.get<Example_4740>();
-        CHECK(!t2.host.has_value());
-        CHECK(!t2.port.has_value());
-
-        // improve coverage
-        auto t3 = Example_4740();
-        t3.port = 80;
-        t3.host = "example.com";
-        const auto j2 = nlohmann::json(t3);
-        CHECK(j2.dump() == "{\"host\":\"example.com\",\"port\":80}");
-        const auto t4 = j2.get<Example_4740>();
-        CHECK(t4.host.has_value());
-        CHECK(t4.port.has_value());
-    }
-#endif
-
-#if !defined(_MSVC_LANG)
-    // MSVC returns garbage on invalid enum values, so this test is excluded
-    // there.
-    SECTION("issue #4762 - json exception 302 with unhelpful explanation : type must be number, but is number")
-    {
-        // In #4762, the main issue was that a json object with an invalid type
-        // returned "number" as type_name(), because this was the default case.
-        // This test makes sure we now return "invalid" instead.
-        json j;
-        j.m_data.m_type = static_cast<json::value_t>(100); // NOLINT(clang-analyzer-optin.core.EnumCastOutOfRange)
-        CHECK(j.type_name() == "invalid");
-    }
-#endif
-
-#ifdef JSON_HAS_CPP_17
-    SECTION("issue #4804: from_cbor incompatible with std::vector<std::byte> as binary_t")
-    {
-        const std::vector<std::uint8_t> data = {0x80};
-        const auto decoded = json_4804::from_cbor(data);
-        CHECK((decoded == json_4804::array()));
-    }
-
-    SECTION("discussion #4209 - custom BinaryType direct assignment and round-tripping")
-    {
-        // Test that assigning a custom BinaryType directly creates a binary value, not an array
-        const std::vector<std::byte> original{std::byte{1}, std::byte{2}, std::byte{3}};
-        const json_4804 j = original;
-        CHECK(j.is_binary());
-        CHECK(!j.is_array());
-
-        // Test round-tripping: extracting the binary value back as the custom container type
-        const auto extracted = j.get<std::vector<std::byte>>();
-        CHECK(extracted == original);
-
-        // Test that the default json alias behavior is unchanged: std::vector<uint8_t> -> array
-        const json default_json = std::vector<std::uint8_t> {1, 2, 3};
-        CHECK(default_json.is_array());
-        CHECK(!default_json.is_binary());
-    }
-
-    SECTION("discussion #4209 - custom BinaryType extraction from parsed array")
-    {
-        // Test that extracting a custom BinaryType from a parsed JSON array still works
-        // (not just from a binary-typed node)
-        const auto j = json_4804::parse("[1,2,3]");
-        CHECK(j.is_array());
-        CHECK(!j.is_binary());
-
-        // Extracting as custom BinaryType should work from arrays
-        const auto extracted = j.get<std::vector<std::byte>>();
-        CHECK(extracted.size() == 3);
-        CHECK(extracted[0] == std::byte{1});
-        CHECK(extracted[1] == std::byte{2});
-        CHECK(extracted[2] == std::byte{3});
-    }
-
-    SECTION("issue #5046 - implicit conversion of return json to std::optional no longer implicit")
-    {
-        const json jval{};
-        auto GetValue = [](const json & valRoot) -> std::optional<json>
-        {
-            if (valRoot.contains("default"))
-            {
-                return valRoot.at("default");
-            }
-            return std::nullopt;
-        };
-        auto result = GetValue(jval);
-        CHECK(!result.has_value());
-    }
-#endif
-
-#if JSON_HAS_RANGES == 1
-    SECTION("issue #4440 - assert when using std::views::filter and GCC 10")
-    {
-        auto noOpFilter = std::views::filter([](auto&&) noexcept
-        {
-            return true;
-        });
-        json j = {1, 2, 3};
-        auto filtered = j | noOpFilter;
-        CHECK(*filtered.begin() == 1);
-    }
-#endif
-
-#if JSON_HAS_RANGES && !defined(__MINGW32__)
-    SECTION("issue #4916 - constructing array from C++20 ranges view does not work")
-    {
-        std::vector<int> nums{1, 2, 37, 42, 21};
-        auto filteredNums = nums | std::views::filter([](int i)
-        {
-            return i > 10;
-        });
-        json const j(filteredNums);
-        CHECK(j.type() == json::value_t::array);
-        CHECK(j == json({37, 42, 21}));
-    }
-#endif
-
-    // owning_view is not available in libstdc++ < 12
-#if JSON_HAS_RANGES && !defined(__MINGW32__) && !(defined(__GLIBCXX__) && _GLIBCXX_RELEASE < 12)
-    SECTION("issue #4916 - constructing array from prvalue C++20 ranges view (owning_view)")
-    {
-        json const j(std::vector<int> {1, 2, 37, 42, 21} | std::views::filter([](int i)
-        {
-            return i > 10;
-        }));
-        CHECK(j.type() == json::value_t::array);
-        CHECK(j == json({37, 42, 21}));
-    }
-#endif
-
-#if JSON_HAS_RANGES && !defined(__MINGW32__)
-    SECTION("issue #4916 - constructing array from C++20 transform view (prvalue elements)")
-    {
-        std::vector<int> nums{1, 2, 3};
-        auto t = nums | std::views::transform([](int i) noexcept
-        {
-            return i * 2;
-        });
-        json const j(t);
-        CHECK(j.type() == json::value_t::array);
-        CHECK(j == json({2, 4, 6}));
-    }
-#endif
-}
-
-TEST_CASE_TEMPLATE("issue #4798 - nlohmann::json::to_msgpack() encode float NaN as double", T, double, float) // NOLINT(readability-math-missing-parentheses, bugprone-throwing-static-initialization)
-{
-    // With issue #4798, we encode NaN, infinity, and -infinity as float instead
-    // of double to allow for smaller encodings.
-    const json jx = std::numeric_limits<T>::quiet_NaN();
-    const json jy = std::numeric_limits<T>::infinity();
-    const json jz = -std::numeric_limits<T>::infinity();
-
-    /////////////////////////////////////////////////////////////////////////
-    // MessagePack
-    /////////////////////////////////////////////////////////////////////////
-
-    // expected MessagePack values
-    const std::vector<std::uint8_t> msgpack_x = {{0xCA, 0x7F, 0xC0, 0x00, 0x00}};
-    const std::vector<std::uint8_t> msgpack_y = {{0xCA, 0x7F, 0x80, 0x00, 0x00}};
-    const std::vector<std::uint8_t> msgpack_z = {{0xCA, 0xFF, 0x80, 0x00, 0x00}};
-
-    CHECK(json::to_msgpack(jx) == msgpack_x);
-    CHECK(json::to_msgpack(jy) == msgpack_y);
-    CHECK(json::to_msgpack(jz) == msgpack_z);
-
-    CHECK(std::isnan(json::from_msgpack(msgpack_x).get<T>()));
-    CHECK(json::from_msgpack(msgpack_y).get<T>() == std::numeric_limits<T>::infinity());
-    CHECK(json::from_msgpack(msgpack_z).get<T>() == -std::numeric_limits<T>::infinity());
-
-    // Make sure the other MessagePakc encodings for NaN, infinity, and
-    // -infinity are still supported.
-    const std::vector<std::uint8_t> msgpack_x_2 = {{0xCB, 0x7F, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
-    const std::vector<std::uint8_t> msgpack_y_2 = {{0xCB, 0x7F, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
-    const std::vector<std::uint8_t> msgpack_z_2 = {{0xCB, 0xFF, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
-    CHECK(std::isnan(json::from_msgpack(msgpack_x_2).get<T>()));
-    CHECK(json::from_msgpack(msgpack_y_2).get<T>() == std::numeric_limits<T>::infinity());
-    CHECK(json::from_msgpack(msgpack_z_2).get<T>() == -std::numeric_limits<T>::infinity());
-
-    /////////////////////////////////////////////////////////////////////////
-    // CBOR
-    /////////////////////////////////////////////////////////////////////////
-
-    // expected CBOR values
-    const std::vector<std::uint8_t> cbor_x = {{0xF9, 0x7E, 0x00}};
-    const std::vector<std::uint8_t> cbor_y = {{0xF9, 0x7C, 0x00}};
-    const std::vector<std::uint8_t> cbor_z = {{0xF9, 0xfC, 0x00}};
-
-    CHECK(json::to_cbor(jx) == cbor_x);
-    CHECK(json::to_cbor(jy) == cbor_y);
-    CHECK(json::to_cbor(jz) == cbor_z);
-
-    CHECK(std::isnan(json::from_cbor(cbor_x).get<T>()));
-    CHECK(json::from_cbor(cbor_y).get<T>() == std::numeric_limits<T>::infinity());
-    CHECK(json::from_cbor(cbor_z).get<T>() == -std::numeric_limits<T>::infinity());
-
-    // Make sure the other CBOR encodings for NaN, infinity, and -infinity are
-    // still supported.
-    const std::vector<std::uint8_t> cbor_x_2 = {{0xFA, 0x7F, 0xC0, 0x00, 0x00}};
-    const std::vector<std::uint8_t> cbor_y_2 = {{0xFA, 0x7F, 0x80, 0x00, 0x00}};
-    const std::vector<std::uint8_t> cbor_z_2 = {{0xFA, 0xFF, 0x80, 0x00, 0x00}};
-    const std::vector<std::uint8_t> cbor_x_3 = {{0xFB, 0x7F, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
-    const std::vector<std::uint8_t> cbor_y_3 = {{0xFB, 0x7F, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
-    const std::vector<std::uint8_t> cbor_z_3 = {{0xFB, 0xFF, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
-    CHECK(std::isnan(json::from_cbor(cbor_x_2).get<T>()));
-    CHECK(json::from_cbor(cbor_y_2).get<T>() == std::numeric_limits<T>::infinity());
-    CHECK(json::from_cbor(cbor_z_2).get<T>() == -std::numeric_limits<T>::infinity());
-    CHECK(std::isnan(json::from_cbor(cbor_x_3).get<T>()));
-    CHECK(json::from_cbor(cbor_y_3).get<T>() == std::numeric_limits<T>::infinity());
-    CHECK(json::from_cbor(cbor_z_3).get<T>() == -std::numeric_limits<T>::infinity());
-}
-
-TEST_CASE("regression test #5074 - portable workaround for single-element brace init")
-{
-    json const j_obj = {{"key", "value"}};
-
-    json const j = json::array({j_obj});
-    CHECK(j.is_array());
-    CHECK(j.size() == 1);
-    CHECK(j[0] == j_obj);
-}
-
-#if defined(JSON_BRACE_INIT_COPY_SEMANTICS) && (JSON_BRACE_INIT_COPY_SEMANTICS == 1)
-TEST_CASE("regression test #5074 - single-element brace init with JSON_BRACE_INIT_COPY_SEMANTICS")
-{
-    // with JSON_BRACE_INIT_COPY_SEMANTICS: single-element brace init copies/moves
-    json const j_obj = {{"key", "value"}, {"num", 42}};
-    json const j_arr = {1, 2, 3};
-
-    // object: brace init copies instead of wrapping
-    json const j1{j_obj};
-    CHECK(j1.is_object());
-    CHECK(j1 == j_obj);
-
-    // array: brace init copies instead of wrapping
-    json const j2{j_arr};
-    CHECK(j2.is_array());
-    CHECK(j2.size() == 3);
-    CHECK(j2 == j_arr);
-
-    // primitives still work as initializer lists
-    json const j3{true};
-    CHECK(j3.is_boolean());
-
-    json const j4{42};
-    CHECK(j4.is_number_integer());
-}
-#endif
-
-struct Example_5122
-{
-    float b = 2;
-    nlohmann::ordered_map<std::string, std::string> c{}; // NOLINT(readability-redundant-member-init): needed for GCC -Weffc++
-    int a = 1;
-    NLOHMANN_DEFINE_TYPE_INTRUSIVE_WITH_DEFAULT(Example_5122, b, c, a)
-};
-
-TEST_CASE("regression test #5122 - from_json into types holding nlohmann::ordered_map")
-{
-    Example_5122 src;
-    src.c.emplace("first", "1");
-    src.c.emplace("second", "2");
-
-    ordered_json const j = src;
-    Example_5122 const dst = j.get<Example_5122>();
-
-    CHECK(dst.b == src.b);
-    CHECK(dst.a == src.a);
-    REQUIRE(dst.c.size() == src.c.size());
-    auto src_it = src.c.begin();
-    auto dst_it = dst.c.begin();
-    for (; src_it != src.c.end(); ++src_it, ++dst_it)
-    {
-        CHECK(dst_it->first == src_it->first);
-        CHECK(dst_it->second == src_it->second);
-    }
-}
-
-// -Wself-assign-overloaded was introduced in Clang 7. Gate the pragma on
-// __has_warning so older Clang versions do not error with "unknown warning
-// group". The __has_warning check has to stay inside the __clang__ branch
-// because GCC does not provide it and would tokenize-error on the argument.
-#if defined(__clang__) && defined(__has_warning)
-    #if __has_warning("-Wself-assign-overloaded")
-        DOCTEST_CLANG_SUPPRESS_WARNING_PUSH
-        DOCTEST_CLANG_SUPPRESS_WARNING("-Wself-assign-overloaded")
-    #endif
-#endif
-
-TEST_CASE("regression test #5122 - nlohmann::ordered_map copy-assignment is self-assignment safe")
-{
-    nlohmann::ordered_map<std::string, std::string> m;
-    m.emplace("first", "1");
-    m.emplace("second", "2");
-
-    // Insertion order is preserved by ordered_map, so we can check it directly.
-    m = m;
-
-    REQUIRE(m.size() == 2);
-    auto it = m.begin();
-    CHECK(it->first == "first");
-    CHECK(it->second == "1");
-    ++it;
-    CHECK(it->first == "second");
-    CHECK(it->second == "2");
-}
-
-#if defined(__clang__) && defined(__has_warning)
-    #if __has_warning("-Wself-assign-overloaded")
-        DOCTEST_CLANG_SUPPRESS_WARNING_POP
-    #endif
-#endif
-
-TEST_CASE("regression test #5122 - nlohmann::ordered_map move-assignment transfers contents")
-{
-    nlohmann::ordered_map<std::string, std::string> src;
-    src.emplace("first", "1");
-    src.emplace("second", "2");
-
-    nlohmann::ordered_map<std::string, std::string> dst;
-    dst.emplace("stale", "x");
-    dst = std::move(src);
-
-    REQUIRE(dst.size() == 2);
-    auto it = dst.begin();
-    CHECK(it->first == "first");
-    CHECK(it->second == "1");
-    ++it;
-    CHECK(it->first == "second");
-    CHECK(it->second == "2");
-
-    // Re-assigning into the moved-from object must leave it in a usable state.
-    src = nlohmann::ordered_map<std::string, std::string> {};
-    src.emplace("after-move", "3");
-    REQUIRE(src.size() == 1);
-    CHECK(src.begin()->first == "after-move");
-}
-
-// Stand-in for a third-party library (e.g., Eigen as of 3.4, which added
-// STL-compatible begin()/end() to its vector types), living in its own
-// namespace with its own to_json overload for its vector type.
-namespace issue_4320_eigen
-{
-// "array-compatible" from the library's point of view (it has begin()/end()),
-// but for which this (fake) third-party namespace provides its own to_json.
-struct vector3
-{
-    double v[3]; // NOLINT(cppcoreguidelines-avoid-c-arrays,hicpp-avoid-c-arrays,modernize-avoid-c-arrays,cppcoreguidelines-use-default-member-init,modernize-use-default-member-init)
-    vector3(double x, double y, double z) : v{x, y, z} {} // NOLINT(hicpp-member-init,cppcoreguidelines-pro-type-member-init)
-    double x() const
-    {
-        return v[0];
-    }
-    double y() const
-    {
-        return v[1];
-    }
-    double z() const
-    {
-        return v[2];
-    }
-    double* begin()
-    {
-        return v;
-    }
-    double* end()
-    {
-        return v + 3;
-    }
-    const double* begin() const
-    {
-        return v;
-    }
-    const double* end() const
-    {
-        return v + 3;
-    }
-};
-
-inline void to_json(json& j, const vector3& v) // NOLINT(misc-use-internal-linkage)
-{
-    j = {{"x", v.x()}, {"y", v.y()}, {"z", v.z()}};
-}
-} // namespace issue_4320_eigen
-
-// The user's own namespace, using the (fake) Eigen type as an implementation
-// detail behind a payload type that has nothing to do with vectors/arrays.
-namespace issue_4320
-{
-// Publicly derives from issue_4320_eigen::vector3 but does *not* define its
-// own to_json - it is only ever used as a temporary to reach the base
-// class's to_json via ADL.
-struct vector3_wrapper : issue_4320_eigen::vector3
-{
-    using issue_4320_eigen::vector3::vector3;
-};
-
-struct payload
-{
-    double x, y, z;
-};
-
-inline vector3_wrapper to_eigen(const payload& p) // NOLINT(misc-use-internal-linkage)
-{
-    return {p.x, p.y, p.z};
-}
-
-inline void to_json(json& j, const payload& p) // NOLINT(misc-use-internal-linkage)
-{
-    // Unqualified call, passing a *derived* vector3_wrapper: relies on ADL
-    // finding issue_4320_eigen::to_json(json&, const vector3&) through the
-    // vector3 base class, via a derived-to-base conversion. Must NOT resolve
-    // to the library's own generic array-compatible to_json (an exact-match
-    // template for vector3_wrapper, since it also has begin()/end()), which
-    // would serialize this as [x, y, z] instead of {"x":x, "y":y, "z":z}.
-    to_json(j, to_eigen(p));
-}
-} // namespace issue_4320
-
-TEST_CASE("issue #4320 - custom base class must not leak nlohmann::detail into ADL")
-{
-    // Before the fix, basic_json unconditionally derived from a type living in
-    // nlohmann::detail (json_default_base), which made nlohmann::detail an
-    // associated namespace of every basic_json for ADL purposes. That leaked
-    // the library's internal generic-array to_json overload into unqualified
-    // to_json() calls made from user code, silently bypassing user-defined
-    // to_json overloads reached via a derived-to-base conversion.
-    const issue_4320::payload p{1.0, 2.0, 3.0};
-
-    json j;
-    to_json(j, p);
-    CHECK(j == json({{"x", 1.0}, {"y", 2.0}, {"z", 3.0}}));
-}
-
-TEST_CASE("issue #5338 - truncated CBOR tagged binary subtype is rejected")
-{
-    const std::vector<std::vector<std::uint8_t>> truncated_tags =
-    {
-        {0xD8},
-        {0xD9, 0x00},
-        {0xDA, 0x00, 0x00, 0x00},
-        {0xDB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}
-    };
-
-    for (const auto& data : truncated_tags)
-    {
-        CAPTURE(data);
-        for (const auto tag_handler :
-                {
-                    json::cbor_tag_handler_t::ignore, json::cbor_tag_handler_t::store
-                })
-        {
-            CAPTURE(tag_handler);
-            const auto result = json::from_cbor(data, true, false, tag_handler);
-            CHECK(result.is_discarded());
-        }
-    }
-}
-
-TEST_CASE("issue #5402 - update(merge_objects=true) overwrites a primitive with an object")
-{
-    json t = {{"k", 1}};
-    t.update(json{{"k", {{"x", 2}}}}, true);
-    CHECK(t == json({{"k", {{"x", 2}}}}));
-
-    json mixed = {{"keep", {{"a", 1}}}, {"replace", 1}};
-    mixed.update(json{{"keep", {{"b", 2}}}, {"replace", {{"x", 2}}}}, true);
-    CHECK(mixed == json({{"keep", {{"a", 1}, {"b", 2}}}, {"replace", {{"x", 2}}}}));
-}
-
-
-DOCTEST_CLANG_SUPPRESS_WARNING_POP

tests/src/unit-ubjson.cpp

@@ -2149,169 +2149,108 @@ TEST_CASE("UBJSON")
     }
 }
 
-TEST_CASE("UBJSON nesting does not consume the call stack")
+TEST_CASE("issue #5405 - array reserve for definite-length UBJSON arrays")
 {
-    // Containers used to be read by calling back into the value reader once
+#if !defined(JSON_NOEXCEPTION)
-    // per element, so the native call stack grew with the nesting depth of the
+    // this SECTION relies on catching a thrown exception to distinguish
-    // input. '[' alone opens a container, so a payload of repeated '[' crashed
+    // which of two acceptable, bounded rejections a hostile header took;
-    // the process (#5104), as did the optimized forms, which reach the same
+    // under JSON_NOEXCEPTION, JSON_THROW never produces a catchable C++
-    // path through a type or size annotation. The containers are kept on a
+    // exception (it aborts instead), so this cannot be tested that way here
-    // heap stack now.
+    SECTION("a huge claimed length with no element data must not over-allocate")
-    //
-    // Deeply nested values must not be compared, copied or dumped here: those
-    // operations are still recursive and would reintroduce the crash.
-    json _;
-
-    SECTION("containers that end at a marker")
     {
-        const std::vector<uint8_t> input(500000, '[');
+        // optimized form [$type#count: type 'i' (int8), count as a four-byte
-        CHECK_THROWS_WITH_AS(_ = json::from_ubjson(input), "[json.exception.parse_error.110] parse error at byte 500001: syntax error while parsing UBJSON value: unexpected end of input", json::parse_error&);
+        // 'l' (int32) of 0x7FFFFFFF (2147483647), but no element data at all.
-        CHECK(json::from_ubjson(input, true, false).is_discarded());
+        // max_size() for a std::vector is far larger than this count, so it
-    }
+        // does not reject the header outright; the (capped) reservation must
-
+        // not attempt to allocate space for billions of elements before the
-    SECTION("containers with a size")
+        // missing data is detected.
-    {
+        json _;
-        std::vector<uint8_t> input;
+        const std::vector<uint8_t> input = {'[', '$', 'i', '#', 'l', 0x7F, 0xFF, 0xFF, 0xFF};
-        for (std::size_t i = 0; i < 100000; ++i)
+        // On a platform where std::vector<json>::max_size() is smaller than
+        // the claimed count (e.g. 32-bit, where max_size() is bounded by a
+        // 32-bit SIZE_MAX divided by sizeof(json)), the SAX consumer's own
+        // check rejects the header outright (out_of_range.408, with the
+        // claimed count in the message) instead of accepting it and only
+        // finding it short of data once the (capped) reservation looks for
+        // element bytes that were never provided (parse_error.110). Either
+        // is an acceptable, bounded rejection of the hostile header -- the
+        // property under test is that no path attempts to allocate space
+        // for billions of elements.
+        bool threw = false;
+        try
         {
-            input.push_back('[');
+            _ = json::from_ubjson(input);
-            input.push_back('#');
-            input.push_back('i');
-            input.push_back(1);
         }
-        CHECK_THROWS_AS(_ = json::from_ubjson(input), json::parse_error&);
+        catch (const json::parse_error& e)
-        CHECK(json::from_ubjson(input, true, false).is_discarded());
-    }
-
-    SECTION("containers with a type and a size")
-    {
-        // '[' is a permitted optimized type in UBJSON, so each element of such
-        // a container is itself a container, read without a marker of its own
-        std::vector<uint8_t> input;
-        for (std::size_t i = 0; i < 100000; ++i)
         {
-            const std::vector<uint8_t> level = {'[', '$', '[', '#', 'i', 1};
+            threw = true;
-            input.insert(input.end(), level.begin(), level.end());
+            CHECK(e.id == 110);
+            CHECK(std::string(e.what()) == "[json.exception.parse_error.110] parse error at byte 10: syntax error while parsing UBJSON number: unexpected end of input");
         }
-        CHECK_THROWS_AS(_ = json::from_ubjson(input), json::parse_error&);
+        catch (const json::out_of_range& e)
-        CHECK(json::from_ubjson(input, true, false).is_discarded());
-    }
-
-    SECTION("a well-formed deep value is read through the SAX interface")
-    {
-        std::vector<uint8_t> input(100000, '[');
-        input.insert(input.end(), 100000, ']');
-
-        SaxCountdown accept_all(1000000);
-        CHECK(json::sax_parse(input, &accept_all, json::input_format_t::ubjson));
-    }
-
-    SECTION("a well-formed deep value is read into a value")
-    {
-        const std::size_t depth = 10000;
-        std::vector<uint8_t> input(depth, '[');
-        input.insert(input.end(), depth, ']');
-
-        json j = json::from_ubjson(input);
-
-        std::size_t measured = 0;
-        const json* p = &j;
-        while (p->is_array() && !p->empty())
         {
-            p = &p->front();
+            threw = true;
-            ++measured;
+            CHECK(e.id == 408);
+            CHECK(std::string(e.what()).find("excessive array size") != std::string::npos);
         }
-        // the innermost array is empty, so the descent stops one level short
+        CHECK(threw);
-        CHECK(measured == depth - 1);
-    }
 
-    SECTION("containers are still read the same way")
+        // json_sax_dom_parser::start_array()'s max_size() check (unlike the
-    {
+        // scanner's own parse_error path) throws unconditionally via
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', ']'})) == json::array());
+        // JSON_THROW rather than going through sax->parse_error(), so it is
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'{', '}'})) == json::object());
+        // not gated by allow_exceptions=false on a platform where this
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '#', 'i', 0})) == json::array());
+        // header hits that check (e.g. 32-bit, see above) -- allow either
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'{', '#', 'i', 0})) == json::object());
+        // a discarded result or the same out_of_range it throws with
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '$', 'i', '#', 'i', 2, 1, 2})) == json({1, 2}));
+        // exceptions enabled.
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '#', 'i', 2, 'i', 1, 'i', 2})) == json({1, 2}));
+        try
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'{', '$', 'i', '#', 'i', 1, 'i', 1, 'a', 1})) == json({{"a", 1}}));
-        // a no-op is not a value, so a container of them holds none
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '$', 'N', '#', 'i', 2})) == json::array());
-        // sized and unsized forms nested inside one another
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '[', '#', 'i', 2, 'i', 1, 'i', 2, ']'})) == json({{1, 2}}));
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '#', 'i', 1, '[', 'i', 1, ']'})) == json({{1}}));
-        // an optimized container of containers
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '$', '[', '#', 'i', 2, 'i', 1, ']', 'i', 2, ']'})) == json({{1}, {2}}));
-    }
-
-    SECTION("BJData containers are still read the same way")
-    {
-        // the ND-array wrapper and the binary shortcut are complete values,
-        // not containers the reader descends into
-        CHECK(json::from_bjdata(std::vector<uint8_t>({'[', '$', 'U', '#', '[', '$', 'i', '#', 'i', 2, 2, 3, 1, 2, 3, 4, 5, 6})) ==
-        json({{"_ArrayType_", "uint8"}, {"_ArraySize_", {2, 3}}, {"_ArrayData_", {1, 2, 3, 4, 5, 6}}}));
-        CHECK(json::from_bjdata(std::vector<uint8_t>({'[', '$', 'i', '#', 'i', 2, 1, 2})) == json({1, 2}));
-        CHECK(json::from_bjdata(std::vector<uint8_t>({'[', '[', 'i', 1, ']', ']'})) == json({{1}}));
-    }
-}
-
-TEST_CASE("UBJSON optimized arrays of a valueless type are bounded")
-{
-    // An element of type 'Z', 'T' or 'F' is encoded by its marker alone, so an
-    // optimized array of one of those has no payload and the declared count is
-    // the only thing deciding how much is allocated. Ten bytes used to produce
-    // billions of values (#2793); every other type costs at least one byte per
-    // element and is bounded by the end of the input.
-    json _;
-
-    SECTION("an excessive count is rejected")
-    {
-        // 'l' is a big-endian int32: 0x7FFFFFFF elements, about 34 GB of value
-        for (const auto marker :
-                {'Z', 'T', 'F'
-                })
         {
-            const std::vector<uint8_t> input = {'[', '$', static_cast<uint8_t>(marker), '#', 'l', 0x7F, 0xFF, 0xFF, 0xFF};
-            CHECK_THROWS_WITH_AS(_ = json::from_ubjson(input), "[json.exception.out_of_range.408] syntax error while parsing UBJSON size: excessive array size", json::out_of_range&);
             CHECK(json::from_ubjson(input, true, false).is_discarded());
         }
+        catch (const json::out_of_range& e)
+        {
+            CHECK(e.id == 408);
+        }
+    }
+#endif
+
+    SECTION("arrays of various sizes decode to the same value as before the reserve optimization")
+    {
+        for (const auto size :
+                {
+                    std::size_t{0}, std::size_t{1}, std::size_t{5}, // small
+                    std::size_t{16384},                             // exactly at the reserve cap
+                    std::size_t{20000}                              // above the reserve cap
+                })
+        {
+            CAPTURE(size)
+            json j = json::array();
+            for (std::size_t i = 0; i < size; ++i)
+            {
+                j.push_back(static_cast<int>(i % 1000));
+            }
+
+            // exercise both the plain and the optimized [$type#count encoding
+            const auto packed_plain = json::to_ubjson(j);
+            CHECK(json::from_ubjson(packed_plain) == j);
+
+            const auto packed_optimized = json::to_ubjson(j, true, true);
+            CHECK(json::from_ubjson(packed_optimized) == j);
+        }
     }
 
-    SECTION("ordinary counts are unaffected")
+    SECTION("a user-defined SAX consumer is unaffected by the internal DOM reserve optimization")
     {
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '$', 'Z', '#', 'i', 3})) == json({nullptr, nullptr, nullptr}));
+        // the reserve() call is local to json_sax_dom_parser / json_sax_dom_callback_parser;
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '$', 'T', '#', 'i', 2})) == json({true, true}));
+        // a custom SAX consumer that does not touch a DOM array sees identical events
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '$', 'F', '#', 'i', 2})) == json({false, false}));
+        json j = json::array();
-        // 'N' is a no-op rather than a value, and still yields an empty array
+        for (int i = 0; i < 100; ++i)
-        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '$', 'N', '#', 'i', 2})) == json::array());
+        {
-    }
+            j.push_back(i);
+        }
+        const auto packed = json::to_ubjson(j, true, true);
 
-    SECTION("a type with a payload is unaffected")
+        SaxCountdown scp(1000000); // large enough to never trigger an abort
-    {
+        CHECK(json::sax_parse(packed, &scp, json::input_format_t::ubjson));
-        // A count past the limit is not rejected for 'U', which costs a byte
-        // per element and is bounded by the end of the input instead. The
-        // count is kept just past the limit rather than made huge, because a
-        // count that also exceeds the array's max_size() is reported as
-        // out_of_range before the input runs out, and max_size() depends on
-        // the width of std::size_t.
-        const std::vector<uint8_t> input = {'[', '$', 'U', '#', 'l', 0x00, 0x10, 0x00, 0x01};
-        CHECK_THROWS_WITH_AS(_ = json::from_ubjson(input), "[json.exception.parse_error.110] parse error at byte 10: syntax error while parsing UBJSON number: unexpected end of input", json::parse_error&);
-        CHECK(json::from_ubjson(input, true, false).is_discarded());
-    }
-
-    SECTION("the writer stays within what the reader accepts")
-    {
-        // below the limit the optimized form is used and is tiny; above it the
-        // writer falls back so that the result can still be read back
-        json const at_limit(1048576, nullptr);
-        const auto v_at_limit = json::to_ubjson(at_limit, true, true);
-        CHECK(v_at_limit.size() == 9);
-        CHECK(v_at_limit.at(1) == '$');
-        CHECK(json::from_ubjson(v_at_limit) == at_limit);
-
-        json const above_limit(1048577, nullptr);
-        const auto v_above_limit = json::to_ubjson(above_limit, true, true);
-        CHECK(v_above_limit.at(1) != '$');
-        CHECK(json::from_ubjson(v_above_limit) == above_limit);
     }
 }