Merge remote-tracking branch 'origin/develop' into claude/fix-issue-3989-db7e45

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/CONTRIBUTING.md

@@ -111,6 +111,8 @@ context which existing file needs to be extended, and only very few cases requir
 When fixing a bug, edit `unit-regression3.cpp` and add a section referencing the fixed issue.
 `unit-regression2.cpp` holds the older tests; the two files exist because a single one grew large enough for the
 MinGW linker to fail relocating it, so please keep adding to the smaller file rather than growing the larger one.
+Tests that call `sax_parse` go into `unit-sax_parse.cpp` rather than into a large test file: every call instantiates
+the parser and the binary reader that recover from errors, which grows a test file considerably.
 
 #### Exceptions
 

README.md

@@ -495,7 +495,7 @@ bool key(string_t& val);
 bool parse_error(std::size_t position, const std::string& last_token, const detail::exception& ex);
 ```
 
-The return value of each function determines whether parsing should proceed.
+The return value of each function determines whether parsing should proceed. For `parse_error`, returning `true` [recovers from the error](https://json.nlohmann.me/features/parsing/error_recovery/): the parser repairs the input and continues.
 
 To implement your own SAX handler, proceed as follows:
 
@@ -503,7 +503,7 @@ To implement your own SAX handler, proceed as follows:
 2. Create an object of your SAX interface class, e.g. `my_sax`.
 3. Call `bool json::sax_parse(input, &my_sax)`; where the first parameter can be any input like a string or an input stream and the second parameter is a pointer to your SAX interface.
 
-Note the `sax_parse` function only returns a `bool` indicating the result of the last executed SAX event. It does not return a  `json` value - it is up to you to decide what to do with the SAX events. Furthermore, no exceptions are thrown in case of a parse error -- it is up to you what to do with the exception object passed to your `parse_error` implementation. Internally, the SAX interface is used for the DOM parser (class `json_sax_dom_parser`) as well as the acceptor (`json_sax_acceptor`), see file [`json_sax.hpp`](https://github.com/nlohmann/json/blob/develop/include/nlohmann/detail/input/json_sax.hpp).
+Note the `sax_parse` function only returns a `bool` indicating whether the input was parsed without errors and no SAX event returned `false`. It does not return a  `json` value - it is up to you to decide what to do with the SAX events. Furthermore, no exceptions are thrown in case of a parse error -- it is up to you what to do with the exception object passed to your `parse_error` implementation. Internally, the SAX interface is used for the DOM parser (class `json_sax_dom_parser`) as well as the acceptor (`json_sax_acceptor`), see file [`json_sax.hpp`](https://github.com/nlohmann/json/blob/develop/include/nlohmann/detail/input/json_sax.hpp).
 
 ### STL-like access
 

docs/mkdocs/docs/api/basic_json/binary_t.md

@@ -90,9 +90,8 @@ type `#!cpp binary_t*` must be dereferenced.
 
 - MessagePack
     - If a subtype is given and the binary array contains exactly 1, 2, 4, 8, or 16 elements, the fixext family (fixext1,
-      fixext2, fixext4, fixext8, fixext16) is used. For other sizes, the ext family (ext8, ext16, ext32) is used. The
+      fixext2, fixext4, fixext8) is used. For other sizes, the ext family (ext8, ext16, ext32) is used. The subtype is
-      subtype is then written as the signed 8-bit ext type: subtypes 128 to 255 map to the negative (reserved) ext
+      then added as a signed 8-bit integer.
-      types, and on reading the ext type is exposed as an unsigned subtype from 0 to 255.
     - If no subtype is given, the bin family (bin8, bin16, bin32) is used.
 
 - BSON

docs/mkdocs/docs/api/basic_json/bjdata_version_t.md

@@ -1,48 +0,0 @@
-# <small>nlohmann::basic_json::</small>bjdata_version_t
-
-```cpp
-enum class bjdata_version_t
-{
-    draft2,
-    draft3
-};
-```
-
-This enumeration is used in [`to_bjdata`](to_bjdata.md) to choose the version of the BJData specification to write:
-
-draft2
-:   BJData Draft 2 (the default). Binary values are written as arrays of `U` integers, and ND-arrays with
-    `"_ArrayType_": "byte"` are written as regular objects, since the `B` marker is not part of Draft 2.
-
-draft3
-:   BJData Draft 3. Binary values are written as `B` elements: as an optimized binary array (`[$B#`) if both `use_size`
-    and `use_type` are set, and as an array of `B`-prefixed elements otherwise. ND-arrays with
-    `"_ArrayType_": "byte"` are written as packed arrays (`[$B#[...]`).
-
-Only the writer is affected by the version. [`from_bjdata`](from_bjdata.md) reads the markers of both drafts.
-
-## Examples
-
-??? example
-
-    The example below shows how the different values of the `bjdata_version_t` influence the serialization of a binary
-    value with [`to_bjdata`](to_bjdata.md).
-
-    ```cpp
-    --8<-- "examples/bjdata_version_t.cpp"
-    ```
-
-    Output:
-
-    ```json
-    --8<-- "examples/bjdata_version_t.output"
-    ```
-
-## See also
-
-- [to_bjdata](to_bjdata.md) serializes a JSON value to BJData
-- [BJData](../../features/binary_formats/bjdata.md) - the article on the BJData format
-
-## Version history
-
-- Added in version 3.12.0.

docs/mkdocs/docs/api/basic_json/cbor_tag_handler_t.md

@@ -15,13 +15,11 @@ error
 :   report a parse error in case of a tag (the `from_cbor` overloads throw a `parse_error` exception by default)
 
 ignore
-:   ignore tags (also in front of a text string map key)
+:   ignore tags
 
 store
 :   store tagged byte strings (for bytes 0xd8..0xdb) as binary values with the tag as subtype; other tagged values are
-    read as if the tag were ignored. If several tags precede a byte string, only the tag directly in front of it is
+    read as if the tag were ignored. If several tags precede a byte string, only the innermost one is stored.
-    stored, and only when it has the form 0xd8..0xdb (a tag 0..23 written as 0xc0..0xd7 is skipped). Tags in front of a
-    text string map key are skipped.
 
 ## Examples
 

docs/mkdocs/docs/api/basic_json/from_bjdata.md

@@ -82,11 +82,8 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
 - Throws [parse_error.112](../../home/exceptions.md#jsonexceptionparse_error112) if a parse error occurs
 - Throws [parse_error.113](../../home/exceptions.md#jsonexceptionparse_error113) if a string could not be parsed
   successfully, or if a string value or object key is not valid UTF-8 and `error_handler` is `strict`
-- Throws [parse_error.115](../../home/exceptions.md#jsonexceptionparse_error115) if the text of a high-precision
-  number (`H`) is not a valid number
 - Throws [out_of_range.408](../../home/exceptions.md#jsonexceptionout_of_range408) if the size of an optimized container
-  cannot be represented by `std::size_t` or exceeds the container's `max_size()`, or if the product of the dimensions of
+  or n-dimensional array cannot be represented by `std::size_t`
-  an n-dimensional array overflows
 
 ## Complexity
 

docs/mkdocs/docs/api/basic_json/from_bon8.md

@@ -74,11 +74,6 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
 - Throws [parse_error.112](../../home/exceptions.md#jsonexceptionparse_error112) if a parse error occurs, for instance
   an invalid byte, a string that is not valid UTF-8, or an object key that is not a string
 
-The UTF-8 validity of strings is always checked, independent of
-[`JSON_STRICT_BINARY_UTF8`](../macros/json_strict_binary_utf8.md), because the end of a BON8 string is determined from
-its encoding. Duplicate object keys are accepted; the last value wins (see
-[BON8](../../features/binary_formats/bon8.md)).
-
 ## Complexity
 
 Linear in the size of the input.

docs/mkdocs/docs/api/basic_json/from_bson.md

@@ -80,8 +80,7 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
 - Throws [`parse_error.110`](../../home/exceptions.md#jsonexceptionparse_error110) if the given input ends prematurely or
   the end of the input was not reached when `strict` was set to true
 - Throws [`parse_error.112`](../../home/exceptions.md#jsonexceptionparse_error112) if a parse error occurs (e.g., an
-  invalid string or byte array length, an invalid inner length of a binary value with subtype `0x02`, or a document size
+  invalid string or byte array length)
-  that does not match the content; `strict` does not affect the document size checks)
 - Throws [`parse_error.114`](../../home/exceptions.md#jsonexceptionparse_error114) if an unsupported BSON record type is
   encountered
 - Throws [`parse_error.113`](../../home/exceptions.md#jsonexceptionparse_error113) if a string value or object key is

docs/mkdocs/docs/api/basic_json/from_cbor.md

@@ -32,10 +32,8 @@ The exact mapping and its limitations are described on a [dedicated page](../../
     
     - an `std::istream` object
     - a `FILE` pointer
-    - a C-style array of characters (its terminating NUL is read as trailing data: `parse_error.110` unless `strict` is
+    - a C-style array of characters
-      `false`)
+    - a pointer to a null-terminated string of single byte characters
-    - a pointer to a null-terminated string of single byte characters (read up to the first 0x00 byte, which is a valid
-      CBOR byte)
     - a container `obj` for which `begin(obj)` and `end(obj)` produce a valid pair of iterators
       (as found via ADL or member functions, with semantics compatible to `std::begin` and `std::end`)
 
@@ -91,14 +89,8 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
 - Throws [parse_error.112](../../home/exceptions.md#jsonexceptionparse_error112) if unsupported features from CBOR were
   used in the given input or if the input is not valid CBOR
 - Throws [parse_error.113](../../home/exceptions.md#jsonexceptionparse_error113) if a map key is not a string (keys of
-  other types are not supported, as JSON object keys are always strings), if the head of a string or byte string is
+  other types are not supported, as JSON object keys are always strings), or if a string value or object key is not
-  malformed (including a chunk of the wrong type or an indefinite-length string nested inside an indefinite-length
+  valid UTF-8 and `error_handler` is `strict`
-  string), or if a string value or object key (or one chunk of an indefinite-length string) is not valid UTF-8 and
-  `error_handler` is `strict`
-- Throws [out_of_range.408](../../home/exceptions.md#jsonexceptionout_of_range408) if an array or map announces
-  a length that `std::size_t` cannot hold, or that equals `std::size_t(-1)` (for example `9B FF FF FF FF FF FF FF FF`)
-- Throws [out_of_range.406](../../home/exceptions.md#jsonexceptionout_of_range406) if a floating-point number does not
-  fit into `number_float_t`
 
 ## Complexity
 

docs/mkdocs/docs/api/basic_json/from_ubjson.md

@@ -79,18 +79,11 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
 
 - Throws [parse_error.110](../../home/exceptions.md#jsonexceptionparse_error110) if the given input ends prematurely or
   the end of the file was not reached when `strict` was set to true
-- Throws [parse_error.112](../../home/exceptions.md#jsonexceptionparse_error112) if an invalid type marker is read
+- Throws [parse_error.112](../../home/exceptions.md#jsonexceptionparse_error112) if a parse error occurs
-  (including a type marker after `$` of an optimized container, even if its count is 0), or if `$` is not followed by `#`
 - Throws [parse_error.113](../../home/exceptions.md#jsonexceptionparse_error113) if a string could not be parsed
-  successfully (negative or non-integer length, `C` followed by a byte above 0x7F), if the count of an optimized
+  successfully, or if a string value or object key is not valid UTF-8 and `error_handler` is `strict`
-  container is negative, or if a string value or object key is not valid UTF-8 and `error_handler` is `strict`
+- Throws [out_of_range.408](../../home/exceptions.md#jsonexceptionout_of_range408) if the size of an optimized container
-- Throws [parse_error.115](../../home/exceptions.md#jsonexceptionparse_error115) if the text of a high-precision number
+  or n-dimensional array cannot be represented by `std::size_t`
-  (`H`) is not a valid JSON number
-- Throws [out_of_range.406](../../home/exceptions.md#jsonexceptionout_of_range406) if a high-precision number, or a
-  float64 when `number_float_t` is `float`, does not fit into `number_float_t`
-- Throws [out_of_range.408](../../home/exceptions.md#jsonexceptionout_of_range408) if the count of an optimized
-  container exceeds the capacity of the container (or of `std::size_t`), or if an optimized array of `Z`, `T`, or `F` has
-  more than 1,048,576 elements
 
 ## Complexity
 

docs/mkdocs/docs/api/basic_json/index.md

@@ -121,7 +121,6 @@ The class satisfies the following concept requirements:
 - [**json_pointer**](../json_pointer/index.md) - JSON Pointer implementation
 - [**json_serializer**](json_serializer.md) - type of the serializer to for conversions from/to JSON
 - [**error_handler_t**](error_handler_t.md) - type to choose behavior on decoding errors
-- [**bjdata_version_t**](bjdata_version_t.md) - type to choose the BJData version to write
 - [**cbor_tag_handler_t**](cbor_tag_handler_t.md) - type to choose how to handle CBOR tags
 - **initializer_list_t** - type for initializer lists of `basic_json` values
 - [**input_format_t**](input_format_t.md) - type to choose the format to parse

docs/mkdocs/docs/api/basic_json/sax_parse.md

@@ -104,7 +104,9 @@ The SAX event lister must follow the interface of [`json_sax`](../json_sax/index
 
 ## Return value
 
-return value of the last processed SAX event
+`#!cpp true` if the input was parsed without errors and no SAX event returned `#!cpp false`; `#!cpp false` otherwise.
+In particular, the result is `#!cpp false` for input with errors, even if the SAX parser recovered from all of them
+(see [error recovery](../../features/parsing/error_recovery.md)).
 
 ## Exception safety
 
@@ -161,6 +163,7 @@ use the same file with stdio functions, but it must not wait for another thread
 - Added `ignore_trailing_commas` in version 3.13.0.
 - Added `tag_handler` in version 3.13.0.
 - Extended container support (1) to include types with lvalue-only ADL `begin`/`end` (matching `std::begin`/`std::end` semantics) in version 3.13.0.
+- Recovering from parse errors (see [`parse_error`](../json_sax/parse_error.md)) added in version 3.13.0.
 - Extended overload (2) to accept heterogeneous iterator+sentinel pairs (C++20 ranges support) in version 3.13.0.
 - `JSON_PRECISE_STREAM_POSITION` added in version 3.13.0 to optionally leave a `#!cpp std::istream` positioned right
   after the parsed value when `strict` is `#!cpp false`.

docs/mkdocs/docs/api/basic_json/to_bjdata.md

@@ -43,8 +43,7 @@ The exact mapping and its limitations are described on a [dedicated page](../../
 `#!cpp false` by default.
 
 `version` (in)
-:   which version of BJData to use, see [`bjdata_version_t`](bjdata_version_t.md) and the note on "Binary values" on
+:   which version of BJData to use (see note on "Binary values" on [BJData](../../features/binary_formats/bjdata.md));
-[BJData](../../features/binary_formats/bjdata.md);
 optional, `#!cpp bjdata_version_t::draft2` by default.
 
 `error_handler` (in)
@@ -65,9 +64,7 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
 ## Exceptions
 
 - Throws [`other_error.502`](../../home/exceptions.md#jsonexceptionother_error502) if `use_type` is true and `use_size`
-  is false, and `j` contains a non-empty array or object, or a non-empty binary value (with
+  is false, and `j` contains a non-empty array, object, or binary value.
-  `version = bjdata_version_t::draft3`, any binary value, including an empty one).
-  Scalars, empty arrays, and empty objects do not throw.
 - Throws [type_error.316](../../home/exceptions.md#jsonexceptiontype_error316) if a string or object key in `j` is
   not valid UTF-8 and `error_handler` is `strict` (the default only if
   [`JSON_STRICT_BINARY_UTF8`](../macros/json_strict_binary_utf8.md) is enabled)

docs/mkdocs/docs/api/basic_json/to_bson.md

@@ -13,7 +13,7 @@ static void to_bson(const basic_json& j, detail::output_adapter<char> o,
 ```
 
 BSON (Binary JSON) is a binary format in which zero or more ordered key/value pairs are stored as a single entity (a
-so-called document). The members of an object are written in the order in which iteration visits them.
+so-called document).
 
 1. Returns a byte vector containing the BSON serialization.
 2. Writes the BSON serialization to an output adapter.

docs/mkdocs/docs/api/basic_json/to_cbor.md

@@ -42,8 +42,7 @@ The exact mapping and its limitations are described on a [dedicated page](../../
 
 ## Exception safety
 
-Strong guarantee: if an exception is thrown, there are no changes in the JSON value. Bytes that were already written to
+Strong guarantee: if an exception is thrown, there are no changes in the JSON value.
-the output adapter are not taken back.
 
 ## Exceptions
 

docs/mkdocs/docs/api/basic_json/to_msgpack.md

@@ -53,7 +53,7 @@ Strong guarantee: if an exception is thrown, there are no changes in the JSON va
   value, array, or object exceeds 4294967295, the maximum MessagePack can store; example:
   `"MessagePack length 4294967296 exceeds maximum of 4294967295"`
 - Throws [`out_of_range.415`](../../home/exceptions.md#jsonexceptionout_of_range415) if the subtype of a binary value
-  exceeds 255, the largest value the library can store in the one-byte MessagePack ext type; example:
+  exceeds 255, the maximum of the MessagePack ext type; example:
   `"subtype 70000 is too large for the MessagePack ext type (max 255)"`
 - Throws [type_error.316](../../home/exceptions.md#jsonexceptiontype_error316) if a string or object key in `j` is
   not valid UTF-8 and `error_handler` is `strict`

docs/mkdocs/docs/api/byte_container_with_subtype/index.md

@@ -6,7 +6,7 @@ class byte_container_with_subtype : public BinaryType;
 ```
 
 This type extends the template parameter `BinaryType` provided to [`basic_json`](../basic_json/index.md) with a subtype
-used by BSON, CBOR, and MessagePack. This type exists so that the user does not have to specify a type themselves with a
+used by BSON and MessagePack. This type exists so that the user does not have to specify a type themselves with a
 specific naming scheme in order to override the binary type.
 
 ## Template parameters

docs/mkdocs/docs/api/json_sax/index.md

@@ -7,7 +7,8 @@ struct json_sax;
 
 This class describes the SAX interface used by [sax_parse](../basic_json/sax_parse.md). Each function is called in
 different situations while the input is parsed. The boolean return value informs the parser whether to continue
-processing the input.
+processing the input; for [`parse_error`](parse_error.md), it decides whether to
+[recover from the error](../../features/parsing/error_recovery.md).
 
 For instance, parsing the JSON text `{"a": [1, true]}` triggers the following callbacks, in order:
 

docs/mkdocs/docs/api/json_sax/parse_error.md

@@ -21,11 +21,18 @@ A parse error occurred.
 
 ## Return value
 
-Whether parsing should proceed (**must return `#!cpp false`**).
+Whether to recover from the error:
+
+- `#!cpp false` stops parsing.
+- `#!cpp true` recovers from the error: the error is repaired and parsing continues. If that is not possible, which
+  happens in the binary formats when the end of the item with the error is unknown, the value read so far is completed
+  and parsing stops. See [error recovery](../../features/parsing/error_recovery.md) for how errors are repaired.
+
+Either way, [`sax_parse`](../basic_json/sax_parse.md) returns `#!cpp false`.
 
 ## Examples
 
-??? example
+??? example "Example: (1) the SAX interface"
 
     The example below shows how the SAX interface is used.
 
@@ -39,12 +46,29 @@ Whether parsing should proceed (**must return `#!cpp false`**).
     --8<-- "examples/sax_parse.output"
     ```
 
+??? example "Example: (2) recovering from errors"
+
+    The example below shows how a SAX parser recovers from errors.
+
+    ```cpp
+    --8<-- "examples/sax_parse__error_recovery.cpp"
+    ```
+    
+    Output:
+    
+    ```
+    --8<-- "examples/sax_parse__error_recovery.output"
+    ```
+
 ## See also
 
 - [sax_parse](../basic_json/sax_parse.md) - SAX parser
 - [Parsing and Exceptions](../../features/parsing/parse_exceptions.md) - the article on handling parse errors without
   exceptions
+- [Error Recovery](../../features/parsing/error_recovery.md) - the article on recovering from parse errors
 
 ## Version history
 
 - Added in version 3.2.0.
+- Returning `#!cpp true` recovers from the error since version 3.13.0; before, parsing stopped, but the result of
+  [`sax_parse`](../basic_json/sax_parse.md) could be wrong.

docs/mkdocs/docs/examples/bjdata_version_t.cpp

@@ -1,33 +0,0 @@
-#include <iomanip>
-#include <iostream>
-#include <nlohmann/json.hpp>
-
-using json = nlohmann::json;
-
-void print_hex(const char* label, const std::vector<std::uint8_t>& v)
-{
-    std::cout << label << ':';
-    for (auto b : v)
-    {
-        std::cout << ' ' << std::hex << std::setw(2) << std::setfill('0') << static_cast<int>(b);
-    }
-    std::cout << std::dec << std::setfill(' ') << '\n';
-}
-
-int main()
-{
-    // a binary value
-    json j = json::binary({0xCA, 0xFE, 0xBA, 0xBE});
-
-    // Draft 2 (the default) writes an array of integers
-    auto v2 = json::to_bjdata(j, true, true, json::bjdata_version_t::draft2);
-    print_hex("draft2", v2);
-
-    // Draft 3 writes an optimized binary array
-    auto v3 = json::to_bjdata(j, true, true, json::bjdata_version_t::draft3);
-    print_hex("draft3", v3);
-
-    // reading yields an array for Draft 2 and a binary value for Draft 3
-    std::cout << json::from_bjdata(v2) << '\n';
-    std::cout << json::from_bjdata(v3) << '\n';
-}

docs/mkdocs/docs/examples/bjdata_version_t.output

@@ -1,4 +0,0 @@
-draft2: 5b 24 55 23 69 04 ca fe ba be
-draft3: 5b 24 42 23 69 04 ca fe ba be
-[202,254,186,190]
-{"bytes":[202,254,186,190],"subtype":null}

docs/mkdocs/docs/examples/sax_parse__error_recovery.cpp

@@ -0,0 +1,43 @@
+#include <iostream>
+#include <iomanip>
+#include <nlohmann/json.hpp>
+
+using json = nlohmann::json;
+
+// a SAX parser that creates a JSON value like json::parse does, but that
+// recovers from parse errors instead of stopping at the first one
+class recovering_parser : public nlohmann::detail::json_sax_dom_parser<json>
+{
+  public:
+    explicit recovering_parser(json& result)
+        : nlohmann::detail::json_sax_dom_parser<json>(result, false)
+    {}
+
+    bool parse_error(std::size_t position,
+                     const std::string& /*last_token*/,
+                     const json::exception& ex)
+    {
+        std::cout << "byte " << position << ": " << ex.what() << '\n';
+
+        // repair the input and continue
+        return true;
+    }
+};
+
+int main()
+{
+    // JSON text with several mistakes that ends too early
+    const std::string text = R"({
+    "name": "Hello World",
+    "tags": ["a" "b",],
+    "valid": tru,
+    "size": 1.,
+    "nested": {"x": 1)";
+
+    json result;
+    recovering_parser sax(result);
+    const bool valid = json::sax_parse(text, &sax);
+
+    std::cout << "\nvalid JSON: " << std::boolalpha << valid << '\n'
+              << std::setw(4) << result << std::endl;
+}

docs/mkdocs/docs/examples/sax_parse__error_recovery.output

@@ -0,0 +1,19 @@
+byte 49: [json.exception.parse_error.101] parse error at line 3, column 20: syntax error while parsing array - unexpected string literal; expected ']'
+byte 51: [json.exception.parse_error.101] parse error at line 3, column 22: syntax error while parsing value - unexpected ']'; expected '[', '{', or a literal
+byte 70: [json.exception.parse_error.101] parse error at line 4, column 17: syntax error while parsing value - invalid literal; last read: '"valid": tru,'
+byte 86: [json.exception.parse_error.101] parse error at line 5, column 15: syntax error while parsing value - invalid number; expected digit after '.'; last read: '1.,'
+byte 109: [json.exception.parse_error.101] parse error at line 6, column 22: syntax error while parsing object - unexpected end of input; expected '}'
+
+valid JSON: false
+{
+    "name": "Hello World",
+    "nested": {
+        "x": 1
+    },
+    "size": 1,
+    "tags": [
+        "a",
+        "b"
+    ],
+    "valid": null
+}

docs/mkdocs/docs/features/binary_formats/bjdata.md

@@ -2,9 +2,9 @@
 
 The [BJData format](https://neurojson.org) was derived from and improved upon
 [Universal Binary JSON(UBJSON)](https://ubjson.org) specification (Draft 12). Specifically, it introduces an optimized
-array container for efficient storage of N-dimensional packed arrays (**ND-arrays**); it also adds four new type markers -
+array container for efficient storage of N-dimensional packed arrays (**ND-arrays**); it also adds 5 new type markers -
-`[u] - uint16`, `[m] - uint32`, `[M] - uint64`, and `[h] - float16` - to unambiguously map common binary numeric types
+`[u] - uint16`, `[m] - uint32`, `[M] - uint64`, `[h] - float16` and `[B] - byte` - to unambiguously map common binary
-(Draft 3 adds `[B] - byte`); furthermore, it uses little-endian (LE) to store all numerics instead of big-endian (BE) as in UBJSON to
+numeric types; furthermore, it uses little-endian (LE) to store all numerics instead of big-endian (BE) as in UBJSON to
 avoid unnecessary conversions on commonly available platforms.
 
 Compared to other binary JSON-like formats such as MessagePack and CBOR, both BJData and UBJSON demonstrate a rare
@@ -15,30 +15,11 @@ simple processing.
 
 !!! abstract "References"
 
-    - [BJData Specification (Draft 3)](https://neurojson.org/bjdata/draft3)
+    - [BJData Specification](https://neurojson.org/bjdata/draft2)
-    - [BJData Specification (Draft 2)](https://neurojson.org/bjdata/draft2)
-
-!!! info "Supported drafts"
-
-    The library supports BJData Draft 2 (the default) and Draft 3, except for column-major N-dimensional arrays (see
-    below). The draft used for writing is selected with the
-    [`version` parameter](../../api/basic_json/bjdata_version_t.md) of
-    [`to_bjdata`](../../api/basic_json/to_bjdata.md); [`from_bjdata`](../../api/basic_json/from_bjdata.md) has no such
-    parameter and reads the markers of both drafts.
-
-!!! warning "Draft 4 and column-major ND-arrays are not supported"
-
-    BJData Draft 4 (April 2026) adds structure-of-arrays (SoA) containers (`[$` or `{$` followed by a schema object)
-    and the extension type `E`. `from_bjdata` does not implement them and throws
-    [`parse_error.112`](../../home/exceptions.md#jsonexceptionparse_error112) for such input; `to_bjdata` never writes
-    them.
-
-    Likewise, column-major ND-arrays of Draft 3 (the `#` marker followed by an array that wraps the dimension vector)
-    are rejected with [`parse_error.113`](../../home/exceptions.md#jsonexceptionparse_error113).
 
 ## Byte layout
 
-BJData follows the structure of UBJSON: a one-byte, human-readable ASCII *type marker* followed by the payload of that type, with strings prefixed by a length that is itself an integer value. In contrast to UBJSON, numbers are stored in little-endian byte order, and additional markers cover unsigned 16/32/64-bit integers, half-precision floats, and bytes. Containers can be written unoptimized (opened with `[` or `{`, closed with `]` or `}`) or optimized with a count (`#`), optionally preceded by a declared element type (`$`). BJData extends the optimized form: the count can be a list of dimensions, which stores an N-dimensional packed array as a flat sequence of values without any per-element markers.
+BJData follows the structure of UBJSON: a one-byte, human-readable ASCII *type marker* followed by the payload of that type, with strings prefixed by a length that is itself an integer value. In contrast to UBJSON, numbers are stored in little-endian byte order, and additional markers cover unsigned 16/32/64-bit integers, half-precision floats, and bytes. Containers can be written unoptimized (opened with `[` or `{`, closed with `]` or `}`) or optimized with a declared element type (`$`) and/or count (`#`). BJData extends the optimized form: the count can be a list of dimensions, which stores an N-dimensional packed array as a flat sequence of values without any per-element markers.
 
 Consider the following JSON value (shown formatted for readability):
 
@@ -73,35 +54,35 @@ Consider the following JSON value (shown formatted for readability):
 
 The library uses the following mapping from JSON values types to BJData types according to the BJData specification:
 
-| JSON value type | value/range                               | BJData type | marker                                                                  |
+| JSON value type | value/range                               | BJData type    | marker |
-|-----------------|-------------------------------------------|-------------|-------------------------------------------------------------------------|
+|-----------------|-------------------------------------------|----------------|--------|
-| null            | `null`                                    | null        | `Z`                                                                     |
+| null            | `null`                                    | null           | `Z`    |
-| boolean         | `true`                                    | true        | `T`                                                                     |
+| boolean         | `true`                                    | true           | `T`    |
-| boolean         | `false`                                   | false       | `F`                                                                     |
+| boolean         | `false`                                   | false          | `F`    |
-| number_integer  | -9223372036854775808..-2147483649         | int64       | `L`                                                                     |
+| number_integer  | -9223372036854775808..-2147483649         | int64          | `L`    |
-| number_integer  | -2147483648..-32769                       | int32       | `l`                                                                     |
+| number_integer  | -2147483648..-32769                       | int32          | `l`    |
-| number_integer  | -32768..-129                              | int16       | `I`                                                                     |
+| number_integer  | -32768..-129                              | int16          | `I`    |
-| number_integer  | -128..127                                 | int8        | `i`                                                                     |
+| number_integer  | -128..127                                 | int8           | `i`    |
-| number_integer  | 128..255                                  | uint8       | `U`                                                                     |
+| number_integer  | 128..255                                  | uint8          | `U`    |
-| number_integer  | 256..32767                                | int16       | `I`                                                                     |
+| number_integer  | 256..32767                                | int16          | `I`    |
-| number_integer  | 32768..65535                              | uint16      | `u`                                                                     |
+| number_integer  | 32768..65535                              | uint16         | `u`    |
-| number_integer  | 65536..2147483647                         | int32       | `l`                                                                     |
+| number_integer  | 65536..2147483647                         | int32          | `l`    |
-| number_integer  | 2147483648..4294967295                    | uint32      | `m`                                                                     |
+| number_integer  | 2147483648..4294967295                    | uint32         | `m`    |
-| number_integer  | 4294967296..9223372036854775807           | int64       | `L`                                                                     |
+| number_integer  | 4294967296..9223372036854775807           | int64          | `L`    |
-| number_integer  | 9223372036854775808..18446744073709551615 | uint64      | `M`                                                                     |
+| number_integer  | 9223372036854775808..18446744073709551615 | uint64         | `M`    |
-| number_unsigned | 0..127                                    | int8        | `i`                                                                     |
+| number_unsigned | 0..127                                    | int8           | `i`    |
-| number_unsigned | 128..255                                  | uint8       | `U`                                                                     |
+| number_unsigned | 128..255                                  | uint8          | `U`    |
-| number_unsigned | 256..32767                                | int16       | `I`                                                                     |
+| number_unsigned | 256..32767                                | int16          | `I`    |
-| number_unsigned | 32768..65535                              | uint16      | `u`                                                                     |
+| number_unsigned | 32768..65535                              | uint16         | `u`    |
-| number_unsigned | 65536..2147483647                         | int32       | `l`                                                                     |
+| number_unsigned | 65536..2147483647                         | int32          | `l`    |
-| number_unsigned | 2147483648..4294967295                    | uint32      | `m`                                                                     |
+| number_unsigned | 2147483648..4294967295                    | uint32         | `m`    |
-| number_unsigned | 4294967296..9223372036854775807           | int64       | `L`                                                                     |
+| number_unsigned | 4294967296..9223372036854775807           | int64          | `L`    |
-| number_unsigned | 9223372036854775808..18446744073709551615 | uint64      | `M`                                                                     |
+| number_unsigned | 9223372036854775808..18446744073709551615 | uint64         | `M`    |
-| number_float    | *any value*                               | float64     | `D`                                                                     |
+| number_float    | *any value*                               | float64        | `D`    |
-| string          | *with shortest length indicator*          | string      | `S`                                                                     |
+| string          | *with shortest length indicator*          | string         | `S`    |
-| array           | *see notes on optimized format/ND-array*  | array       | `[`                                                                     |
+| array           | *see notes on optimized format/ND-array*  | array          | `[`    |
-| object          | *see notes on optimized format*           | map         | `{`                                                                     |
+| object          | *see notes on optimized format*           | map            | `{`    |
-| binary          | *see notes on binary values*              | array       | `[$B` (Draft 3 with `use_size` and `use_type`), `[U`, or `[B` otherwise |
+| binary          | *see notes on binary values*              | array          | `[$B`  |
 
 !!! success "Complete mapping"
 
@@ -126,16 +107,10 @@ The library uses the following mapping from JSON values types to BJData types ac
 
 !!! info "Unused BJData markers"
 
-    The following markers are not written:
+    The following markers are not used in the conversion:
 
-    - `N`: no-op values are not created (they are skipped when reading).
+    - `Z`: no-op values are not created.
-    - `C`: single-character strings are serialized with `S` markers (`C` is read, and written for the elements of
+    - `C`: single-byte strings are serialized with `S` markers.
-      ND-arrays with `"_ArrayType_": "char"`).
-    - `h`: floating-point numbers are written as `D`, not as float16 (`h` is read).
-    - `B`: only written in Draft 3 mode.
-    - `d` is only written for `single` ND-arrays or if `number_float_t` is `float`; `H` is only written for integers
-      wider than 64 bits (custom `number_integer_t`/`number_unsigned_t`). An unsigned integer above 9223372036854775807
-      is written as `M`.
 
 !!! info "NaN/infinity handling"
 
@@ -167,7 +142,7 @@ The library uses the following mapping from JSON values types to BJData types ac
     BJData extends UBJSON's optimized array **size** marker to support ND-arrays of uniform numerical data types
     (referred to as *packed arrays*). For example, the 2-D `uint8` integer array `[[1,2],[3,4],[5,6]]`, stored as nested
     optimized array in UBJSON `[ [$U#i2 1 2 [$U#i2 3 4 [$U#i2 5 6 ]`, can be further compressed in BJData to
-    `[$U#[$i#i2 3 2 1 2 3 4 5 6` or `[$U#[i3 i2] 1 2 3 4 5 6`.
+    `[$U#[$i#i2 2 3 1 2 3 4 5 6` or `[$U#[i2 i3] 1 2 3 4 5 6`.
 
     To maintain type and size information, ND-arrays are converted to JSON objects following the **annotated array
     format** (defined in the [JData specification (Draft 3)][JDataAAFmt]), when parsed using
@@ -177,14 +152,11 @@ The library uses the following mapping from JSON values types to BJData types ac
     ```json
     {
         "_ArrayType_": "uint8",
-        "_ArraySize_": [3,2],
+        "_ArraySize_": [2,3],
         "_ArrayData_": [1,2,3,4,5,6]
     }
     ```
 
-    ND-arrays with the element type `h` (float16) are returned with `"_ArrayType_": "half"`. `to_bjdata` does not pack
-    `"half"` objects; they are written as regular objects, which read back as an equal value.
-
     Likewise, when a JSON object in the above form is serialized using
     [`to_bjdata`](../../api/basic_json/to_bjdata.md), it is automatically converted into a compact BJData ND-array.
 
@@ -195,40 +167,34 @@ The library uses the following mapping from JSON values types to BJData types ac
     object; otherwise it is serialized as a regular JSON object, so the annotation is never lost in a round trip. This requires
     all of the following:
 
-    - the object has exactly the three keys `"_ArrayType_"`, `"_ArraySize_"`, and `"_ArrayData_"` (any other key, e.g.,
-      `"_ArrayOrder_"`, makes it a regular object),
     - `"_ArrayType_"` is one of `uint8`, `int8`, `uint16`, `int16`, `uint32`, `int32`, `uint64`, `int64`, `single`,
-      `double`, `char`, or (only with `version = bjdata_version_t::draft3`, since the `B` marker is not part of Draft 2)
+      `double`, `char`, or `byte`,
-      `byte`; the names are case-sensitive,
     - `"_ArraySize_"` is an array, since the dimensions are written as the ND-array header's length,
-    - `"_ArraySize_"` has at least two entries and is not a two-entry row vector (`[1,N]`), since other shapes are
+    - `"_ArraySize_"` has at least two entries and is not a 1×N row vector (first entry 1), since other shapes are
-      parsed back as a regular array (`[1,2,2]` is packed, `[1,4]` is not),
+      parsed back as a regular array,
     - every entry of `"_ArraySize_"` is a positive integer, and their product is representable as a `std::size_t`,
     - `"_ArrayData_"` is an array holding exactly that many elements, and
-    - every element of `"_ArrayData_"` is a number of the kind named by `"_ArrayType_"`: for the integer types, an
+    - every element of `"_ArrayData_"` is a number of the kind named by `"_ArrayType_"`: for the integer types, a
-      integer (a floating-point number such as `1.0` does not qualify) that fits the named width (for `char`, 0..127);
+      value that fits the named width; for `double`, any value; for `single`, a value that survives narrowing to
-      for `double`, a floating-point number (an integer such as `1` does not qualify); for `single`, a floating-point
+      `float` and back without change (for instance, `0.1` does not, since it is not exactly representable as
-      number that survives narrowing to `float` and back without change (for instance, `0.1` does not, since it is not
+      `float`).
-      exactly representable as `float`).
 
-    With `ordered_json`, an annotated object read from BJData has its keys in the order `"_ArrayType_"`,
+    An annotated object is always read back with its keys in the order shown above, `"_ArrayType_"`, `"_ArraySize_"`,
-    `"_ArraySize_"`, `"_ArrayData_"`; with `json`, they are sorted like those of any other object.
+    `"_ArrayData_"`, regardless of the order the ND-array's header stores them in on the wire. This matters for
+    `ordered_json`, whose comparison takes key order into account.
 
     The current version of this library does not yet support automatic detection of and conversion from a nested JSON
     array input to a BJData ND-array.
 
-    [JDataAAFmt]: https://github.com/NeuroJSON/jdata/blob/Draft-3/JData_specification.md#annotated-storage-of-n-d-arrays
+    [JDataAAFmt]: https://github.com/NeuroJSON/jdata/blob/master/JData_specification.md#annotated-storage-of-n-d-arrays
 
 !!! info "Restrictions in optimized data types for arrays and objects"
 
-    Due to diminished space saving, hampered readability, and increased security risks, in BJData, the
+    Due to diminished space saving, hampered readability, and increased security risks, in BJData, the allowed data
-    allowed data types following the `$` marker in an optimized array and object container are restricted to
+    types following the `$` marker in an optimized array and object container are restricted to
     **non-zero-fixed-length** data types. Therefore, the valid optimized type markers can only be one of
-    `UiuImlMLhdDC`, plus `B` since Draft 3 (the reader accepts `B` in both drafts). This also means other variable (`[{SH`) or zero-length types (`TFZN`) can not be used in an
+    `UiuImlMLhdDCB`. This also means other variable (`[{SH`) or zero-length types (`TFN`) can not be used in an
-    optimized array or object in BJData. The library enforces this restriction for both drafts. A `C` (char) element above 127 is rejected on read with
+    optimized array or object in BJData.
-    [`parse_error.113`](../../home/exceptions.md#jsonexceptionparse_error113), in 1-D and in N-dimensional arrays. With `use_type`, the
-    elements must have the same marker (`[1,200,3]` is not optimized, since it mixes `i` and `U`); booleans, null,
-    strings, arrays, and objects are never optimized with `$`.
 
 !!! info "Binary values"
 
@@ -236,16 +202,14 @@ The library uses the following mapping from JSON values types to BJData types ac
     in optimized arrays to designate binary data. This means that, unlike UBJSON, binary data can be both serialized and
     deserialized.
 
-    To preserve compatibility with BJData Draft 2, the Draft 3 optimized binary array must be explicitly enabled: pass
+    To preserve compatibility with BJData Draft 2, the Draft 3 optimized binary array must be explicitly enabled using
-    `version = bjdata_version_t::draft3` together with `use_size = true` and `use_type = true` to
+    the `version` parameter of [`to_bjdata`](../../api/basic_json/to_bjdata.md).
-    [`to_bjdata`](../../api/basic_json/to_bjdata.md). With Draft 3 and only `use_size` (or neither), a binary value is
-    written as an array of `B` elements.
 
-    In Draft 2 mode (default), if the JSON data contains the binary type, the value is stored as a list of integers, as
+    In Draft2 mode (default), if the JSON data contains the binary type, the value stored as a list of integers, as
     suggested by the BJData documentation. In particular, this means that the serialization and the deserialization of
     JSON containing binary values into BJData and back will result in a different JSON object.
 
-    [BJDataBinArr]: https://github.com/NeuroJSON/bjdata/blob/Draft-3/Binary_JData_Specification.md#optimized-binary-array
+    [BJDataBinArr]: https://github.com/NeuroJSON/bjdata/blob/master/Binary_JData_Specification.md#optimized-binary-array
 
 ??? example "Example: serialize JSON values to BJData, with and without size/type optimization"
 
@@ -263,46 +227,34 @@ The library uses the following mapping from JSON values types to BJData types ac
 
 The library maps BJData types to JSON value types as follows:
 
-| BJData type           | JSON value type                                  | marker   |
+| BJData type | JSON value type                          | marker   |
-|-----------------------|--------------------------------------------------|----------|
+|-------------|------------------------------------------|----------|
-| no-op                 | *no value, next value is read*                   | `N`      |
+| no-op       | *no value, next value is read*           | `N`      |
-| null                  | `null`                                           | `Z`      |
+| null        | `null`                                   | `Z`      |
-| false                 | `false`                                          | `F`      |
+| false       | `false`                                  | `F`      |
-| true                  | `true`                                           | `T`      |
+| true        | `true`                                   | `T`      |
-| float16               | number_float                                     | `h`      |
+| float16     | number_float                             | `h`      |
-| float32               | number_float                                     | `d`      |
+| float32     | number_float                             | `d`      |
-| float64               | number_float                                     | `D`      |
+| float64     | number_float                             | `D`      |
-| high-precision number | number_integer, number_unsigned, or number_float | `H`      |
+| uint8       | number_unsigned                          | `U`      |
-| uint8                 | number_unsigned                                  | `U`      |
+| int8        | number_integer                           | `i`      |
-| int8                  | number_integer                                   | `i`      |
+| uint16      | number_unsigned                          | `u`      |
-| uint16                | number_unsigned                                  | `u`      |
+| int16       | number_integer                           | `I`      |
-| int16                 | number_integer                                   | `I`      |
+| uint32      | number_unsigned                          | `m`      |
-| uint32                | number_unsigned                                  | `m`      |
+| int32       | number_integer                           | `l`      |
-| int32                 | number_integer                                   | `l`      |
+| uint64      | number_unsigned                          | `M`      |
-| uint64                | number_unsigned                                  | `M`      |
+| int64       | number_integer                           | `L`      |
-| int64                 | number_integer                                   | `L`      |
+| byte        | number_unsigned                          | `B`      |
-| byte                  | number_unsigned                                  | `B`      |
+| string      | string                                   | `S`      |
-| string                | string                                           | `S`      |
+| char        | string                                   | `C`      |
-| char                  | string                                           | `C`      |
+| array       | array (optimized values are supported)   | `[`      |
-| array                 | array (optimized values are supported)           | `[`      |
+| ND-array    | object (in JData annotated array format) | `[$.#[.` |
-| ND-array              | object (in JData annotated array format)         | `[$.#[.` |
+| object      | object (optimized values are supported)  | `{`      |
-| object                | object (optimized values are supported)          | `{`      |
+| binary      | binary (strongly-typed byte array)       | `[$B`    |
-| binary                | binary (strongly-typed byte array)               | `[$B`    |
 
 !!! success "Complete mapping"
 
-    The mapping is **complete** for the BJData types of Draft 2 and Draft 3 with one exception: column-major
+    The mapping is **complete** in the sense that any BJData value can be converted to a JSON value.
-    N-dimensional arrays are rejected with [`parse_error.113`](../../home/exceptions.md#jsonexceptionparse_error113).
-    The Draft 4 constructs (structure-of-arrays containers and the extension type `E`) are not supported either.
-
-    The digits of an `H` value are parsed like a JSON number: integers that fit 64 bits become `number_integer` or
-    `number_unsigned`, anything else a `number_float`; invalid text throws
-    [`parse_error.115`](../../home/exceptions.md#jsonexceptionparse_error115).
-
-!!! info "Duplicate object keys"
-
-    If an object contains the same key more than once, `from_bjdata` accepts it and keeps the last value; with
-    `ordered_json`, the key keeps the position of its first occurrence.
 
 !!! warning "Ill-formed UTF-8 in string values and object keys"
 

docs/mkdocs/docs/features/binary_formats/bon8.md

@@ -1,6 +1,6 @@
 # BON8
 
-BON8 (Binary Object Notation 8) is a compact binary serialization format for JSON values. It uses byte values that
+BON8 (Binary Object Notation 8) is a compact binary serialization format for JSON values. It uses the byte values that
 cannot begin a UTF-8 character as type markers, so strings are stored as plain UTF-8 without a length prefix: a string
 ends at the first byte that cannot continue it. Integers from -10 to 39, `true`, `false`, `null`, and the floating-point
 values -1.0, 0.0, and 1.0 take a single byte, and arrays and objects with up to four elements need no terminator.
@@ -12,7 +12,7 @@ values -1.0, 0.0, and 1.0 take a single byte, and arrays and objects with up to
 
 ## Byte layout
 
-BON8 exploits the fact that some byte values can never start a UTF-8 character. These bytes serve as *type markers*, so strings can be stored as plain UTF-8 without a length prefix: a string ends at the first byte that cannot continue it: a marker byte, or a lead byte 0xC2..0xF7 followed by a byte outside 0x80..0xBF. The ending byte is often the marker of the next value. Small integers, `true`, `false`, `null`, and a few common floats are a single byte. Arrays and objects are introduced by a marker; those with up to four elements encode their size in the marker and need no terminator, while larger ones are closed by the end marker `0xFE`.
+BON8 exploits the fact that some byte values can never start a UTF-8 character. These bytes serve as *type markers*, so strings can be stored as plain UTF-8 without a length prefix: a string ends at the first byte that cannot continue it (often the marker of the next value). Small integers, `true`, `false`, `null`, and a few common floats are a single byte. Arrays and objects are introduced by a marker; those with up to four elements encode their size in the marker and need no terminator, while larger ones are closed by the end marker `0xFE`.
 
 Consider the following JSON value (shown formatted for readability):
 
@@ -33,7 +33,7 @@ Consider the following JSON value (shown formatted for readability):
 <div class="byte-layout" markdown="0"><table>
 <thead><tr><th>JSON</th><th>Bytes</th><th>Meaning</th></tr></thead><tbody>
 <tr><td><code>{</code></td><td><span class="bl bl-t">8A</span></td><td>object with 4 members</td></tr>
-<tr><td><code>&quot;id&quot;: 300,</code></td><td><span class="bl bl-d">69 64</span> <span class="bl bl-t">C4</span> <span class="bl bl-d">04</span></td><td>key: UTF-8 bytes; the string ends at 0xC4, because the byte after it (0x04) is not a UTF-8 continuation byte, so 0xC4 starts an integer; value: 2-byte positive integer (lead byte, then a byte below 0x80)</td></tr>
+<tr><td><code>&quot;id&quot;: 300,</code></td><td><span class="bl bl-d">69 64</span> <span class="bl bl-t">C4</span> <span class="bl bl-d">04</span></td><td>key: UTF-8 bytes; the string ends at the next byte, which cannot continue a UTF-8 character; value: 2-byte positive integer (lead byte, then a byte below 0x80)</td></tr>
 <tr><td><code>&quot;name&quot;: &quot;json&quot;,</code></td><td><span class="bl bl-d">6E 61 6D 65</span> <span class="bl bl-l">FF</span> <span class="bl bl-d">6A 73 6F 6E</span> <span class="bl bl-l">FF</span></td><td>key: UTF-8 bytes; 0xFF terminates the string as another string follows; value: UTF-8 bytes; terminated as a string key follows</td></tr>
 <tr><td><code>&quot;pi&quot;: 3.14,</code></td><td><span class="bl bl-d">70 69</span> <span class="bl bl-t">8F</span> <span class="bl bl-d">40 09 1E B8 51 EB 85 1F</span></td><td>key: UTF-8 bytes; value: binary64 (IEEE 754, big-endian); its marker also ends <code>&quot;pi&quot;</code></td></tr>
 <tr><td><code>&quot;tags&quot;: [</code></td><td><span class="bl bl-d">74 61 67 73</span> <span class="bl bl-t">82</span></td><td>key: UTF-8 bytes; value: array with 2 elements; its marker also ends <code>&quot;tags&quot;</code></td></tr>
@@ -100,8 +100,7 @@ serialized as 0x81 0x65 0xFF, but `[1,2,3,4,"e"]` as 0x85 0x91 0x92 0x93 0x94 0x
 
     The following values can **not** be converted to a BON8 value:
 
-      - integers outside the int64 range (unsigned integers above 9223372036854775807 and, for number types wider than
+      - unsigned integers above 9223372036854775807, because BON8 has no unsigned 64-bit integer type
-        64 bits, any larger or smaller integer), because BON8 integers are limited to int64
         ([out_of_range.407](../../home/exceptions.md#jsonexceptionout_of_range407))
       - strings that are not valid UTF-8, because the end of a string is determined from its encoding
         ([type_error.316](../../home/exceptions.md#jsonexceptiontype_error316))
@@ -169,13 +168,7 @@ The library maps BON8 types to JSON value types as follows:
 
 Non-negative integers are read as number_unsigned, negative integers as number_integer.
 
-A byte 0xF5..0xF7 followed by 0x80..0xBF is neither a string nor an integer and is rejected with
+!!! info
-[parse_error.112](../../home/exceptions.md#jsonexceptionparse_error112) (invalid UTF-8 byte). The same error is
-reported for any other invalid byte (such as a stray 0xFE), for ill-formed UTF-8, and for an object key that is not a
-string. Input that ends prematurely, trailing data after the value, and a missing final 0xFF after a string at the end
-of the message are reported as [parse_error.110](../../home/exceptions.md#jsonexceptionparse_error110).
-
-!!! info "Non-canonical input"
 
     Values that do not use the canonical representation, such as integers with a longer encoding than necessary,
     arrays and objects with up to four elements that are terminated by 0xFE, unsorted object keys, or a 0xFF after a
@@ -183,10 +176,7 @@ of the message are reported as [parse_error.110](../../home/exceptions.md#jsonex
 
     Strings must be valid UTF-8, and a string at the very end of a message must be terminated by 0xFF.
 
-    Duplicate object keys are accepted; the last value wins (`ordered_json` keeps the position of the first occurrence).
+!!! info
-    The specification does not say how to treat them; the HikoGUI reference decoder keeps the first value.
-
-!!! info "Round trips"
 
     Any BON8 output created by `to_bon8` can be successfully parsed by `from_bon8`.
 

docs/mkdocs/docs/features/binary_formats/bson.md

@@ -66,12 +66,7 @@ The library uses the following mapping from JSON values types to BSON types:
 !!! warning "Incomplete mapping"
 
     The mapping is **incomplete**, since only JSON-objects (and things contained therein) can be serialized to BSON.
-    Also, keys may not contain U+0000, since they are serialized as zero-terminated C strings.
+    Also, keys may not contain U+0000, since they are serialized a zero-terminated c-strings.
-
-!!! info "Order of object members"
-
-    The members of an object are written in the order in which iteration visits them: sorted by key for
-    [`json`](../../api/json.md), in insertion order for [`ordered_json`](../../api/ordered_json.md).
 
 !!! warning "BSON type 0x11 interoperability"
 
@@ -86,19 +81,6 @@ The library uses the following mapping from JSON values types to BSON types:
     As a result, serializing and deserializing a JSON object containing such a value produces a different JSON object,
     even though the binary data is unchanged.
 
-!!! info "Binary subtype 0x02 (old binary)"
-
-    The BSON specification defines the payload of the "binary (old)" subtype `0x02` as an int32 followed by that many
-    bytes, so the value is preceded by two lengths: the length of the binary element and, as the first four bytes of
-    the payload, the number of bytes that follow. A binary value with subtype `2` is therefore written with the outer
-    length 4 bytes larger than its size and the size as inner length: `binary({1, 2, 3}, 2)` becomes
-    `07 00 00 00 02 03 00 00 00 01 02 03`. When reading, the inner length is checked and removed, so the value
-    contains only the bytes that follow it. `from_bson()` throws
-    [`parse_error.112`](../../home/exceptions.md#jsonexceptionparse_error112) if the outer length is less than 4 or the
-    inner length is not the outer length minus 4. Versions before 3.13.0 did not write the inner length and returned
-    it as part of the payload; BSON data written by those versions with subtype 2 is not readable any more and must be
-    written again.
-
 ??? example "Example: serialize a JSON value to BSON"
 
     ```cpp
@@ -153,29 +135,12 @@ The library maps BSON record types to JSON value types as follows:
     The BSON reader is lenient in a few areas where the BSON specification is more restrictive:
 
     - array element keys are not checked against the required decimal sequence (`0`, `1`, `2`, ...),
-    - any non-zero byte is accepted as `true` for the boolean type,
+    - any non-zero byte is accepted as `true` for the boolean type, and
-    - the payloads of the binary subtypes `0x03` (UUID, old), `0x04` (UUID), and `0x05` (MD5) are not checked to have
+    - the payload for binary subtype `0x02` is returned as-is, including its inner length prefix.
-      16 bytes,
-    - duplicate keys within a document are accepted; the last value wins (`{"a": 1, "a": 2}` is read as `{"a": 2}`),
-      while a SAX handler receives every occurrence,
-    - a `string` value may contain embedded `0x00` bytes, and
-    - with `strict` set to `false`, bytes after the end of the document are ignored.
 
     If BSON input must be validated for strict specification compliance, validate it separately before passing it to
     `from_bson()`.
 
-!!! note "Document size"
-
-    Every document starts with its size. `from_bson()` rejects a document with
-    [`parse_error.112`](../../home/exceptions.md#jsonexceptionparse_error112) if the size is less than 5 (the size prefix and the terminator), if an embedded document does not end before the
-    end of the document that contains it, if the elements do not fit into the declared size, or if the size does not
-    match the number of bytes read when the terminating `0x00` byte is reached. A size that is too small is detected
-    before an element is read whose type byte and name no longer fit; an element that starts inside the declared size
-    but extends past it is read, and reported to a SAX handler, before the mismatch is found at the terminator. A size
-    that is too large is likewise found only at the terminator. Passing `strict` as `false` skips only the check for bytes after
-    the end of the document ([`parse_error.110`](../../home/exceptions.md#jsonexceptionparse_error110)), not the
-    document size checks.
-
 !!! warning "Ill-formed UTF-8 in string values"
 
     The BSON specification requires `string` values (type `0x02`) to be valid UTF-8, but this is not required of a
@@ -189,9 +154,8 @@ The library maps BSON record types to JSON value types as follows:
     ill-formed bytes. `to_bson()`'s own `error_handler` parameter defaults to `keep`, so such a string value or element
     (key) name is written unchanged; with `strict` (the default if
     [`JSON_STRICT_BINARY_UTF8`](../../api/macros/json_strict_binary_utf8.md) is enabled), it throws the same exception
-    instead. Element (key) names are treated like string values: with `keep` they are read unchanged, with `strict`,
+    instead. Element (key) names are never validated on read, since they are read byte-by-byte as a C string. `binary`
-    `replace`, or `ignore` they are checked and handled in the same way. `binary` values (type `0x05`) are unaffected,
+    values (type `0x05`) are unaffected, since they are not required to hold text.
-    since they are not required to hold text.
 
 ??? example "Example: deserialize a JSON value from BSON"
 

docs/mkdocs/docs/features/binary_formats/cbor.md

@@ -11,7 +11,7 @@ extremely small code sizes, fairly small message size, and extensibility without
 
 ## Byte layout
 
-CBOR encodes every data item as a *head* followed by optional content. The first byte of the head holds the *major type* in its upper three bits (unsigned integer, negative integer, byte string, text string, array, map, tag, or simple/float) and an *additional information* value in its lower five bits. Additional information below 24 is the argument itself (for example, a small integer or a short length); the values 24 to 27 announce that the argument follows in 1, 2, 4, or 8 big-endian bytes. Strings, arrays, and maps are prefixed with their length (or count of elements/pairs), and content follows directly. A reader of definite-length items knows how many items to expect without a terminator; indefinite-length items (additional information 31) are instead closed by the "break" byte 0xFF, which `from_cbor` reads but `to_cbor` never writes.
+CBOR encodes every data item as a *head* followed by optional content. The first byte of the head holds the *major type* in its upper three bits (unsigned integer, negative integer, byte string, text string, array, map, tag, or simple/float) and an *additional information* value in its lower five bits. Additional information below 24 is the argument itself (for example, a small integer or a short length); the values 24 to 27 announce that the argument follows in 1, 2, 4, or 8 big-endian bytes. Strings, arrays, and maps are prefixed with their length (or count of elements/pairs), and content follows directly, so a reader always knows how many items to expect without a terminator.
 
 Consider the following JSON value (shown formatted for readability):
 
@@ -52,16 +52,16 @@ The library uses the following mapping from JSON values types to CBOR types acco
 | null            | `null`                                     | Null                              | 0xF6       |
 | boolean         | `true`                                     | True                              | 0xF5       |
 | boolean         | `false`                                    | False                             | 0xF4       |
-| number_integer  | -9223372036854775808..-4294967297          | Negative integer (8 bytes follow) | 0x3B       |
+| number_integer  | -9223372036854775808..-2147483649          | Negative integer (8 bytes follow) | 0x3B       |
-| number_integer  | -4294967296..-65537                        | Negative integer (4 bytes follow) | 0x3A       |
+| number_integer  | -2147483648..-32769                        | Negative integer (4 bytes follow) | 0x3A       |
-| number_integer  | -65536..-257                               | Negative integer (2 bytes follow) | 0x39       |
+| number_integer  | -32768..-129                               | Negative integer (2 bytes follow) | 0x39       |
-| number_integer  | -256..-25                                  | Negative integer (1 byte follow)  | 0x38       |
+| number_integer  | -128..-25                                  | Negative integer (1 byte follow)  | 0x38       |
 | number_integer  | -24..-1                                    | Negative integer                  | 0x20..0x37 |
 | number_integer  | 0..23                                      | Integer                           | 0x00..0x17 |
 | number_integer  | 24..255                                    | Unsigned integer (1 byte follow)  | 0x18       |
 | number_integer  | 256..65535                                 | Unsigned integer (2 bytes follow) | 0x19       |
 | number_integer  | 65536..4294967295                          | Unsigned integer (4 bytes follow) | 0x1A       |
-| number_integer  | 4294967296..9223372036854775807            | Unsigned integer (8 bytes follow) | 0x1B       |
+| number_integer  | 4294967296..18446744073709551615           | Unsigned integer (8 bytes follow) | 0x1B       |
 | number_unsigned | 0..23                                      | Integer                           | 0x00..0x17 |
 | number_unsigned | 24..255                                    | Unsigned integer (1 byte follow)  | 0x18       |
 | number_unsigned | 256..65535                                 | Unsigned integer (2 bytes follow) | 0x19       |
@@ -95,24 +95,7 @@ see "binary" cells in the table above.
 
 !!! success "Complete mapping"
 
-    The mapping is **complete** in the sense that any JSON value type can be converted to a CBOR value, with one
+    The mapping is **complete** in the sense that any JSON value type can be converted to a CBOR value.
-    exception: an integer outside the range of CBOR integers (only possible with a number type wider than 64 bits)
-    throws [`out_of_range.407`](../../home/exceptions.md#jsonexceptionout_of_range407).
-
-!!! info "Not a deterministic encoding"
-
-    `to_cbor` does not produce the deterministic encoding of
-    [RFC 8949, Section 4.2.1](https://www.rfc-editor.org/rfc/rfc8949.html#section-4.2.1), and not always the preferred
-    serialization of Section 4.1:
-
-    - floating-point numbers are written as single precision (0xFA) when that is exact and as double precision (0xFB)
-      otherwise; half precision (0xF9) is used only for `NaN` and `Infinity`/`-Infinity` (`1.0` is `fa 3f 80 00 00`);
-    - a binary subtype 0..23 is written as `d8 xx` instead of the one-byte tag 0xC0..0xD7 (`d8 01 41 01`);
-    - object members are written in the order of `object_t` (for the default `std::map`: sorted by the key string, not
-      by the encoded key bytes).
-
-    Integers and lengths use the shortest form, and indefinite-length items are never written. Decoders must accept all
-    of this; the RFC does not require the preferred serialization.
 
 !!! info "NaN/infinity handling"
 
@@ -122,8 +105,9 @@ see "binary" cells in the table above.
 
 !!! note
 
-    Prior to version 3.8.0, NaN and Infinity were instead serialized as a CBOR double-precision float (type 0xFB,
+    Prior to version 3.13.0, NaN and Infinity were instead serialized as a CBOR double-precision float (type 0xFB,
-    9 bytes total).
+    9 bytes total), because the check used to select a smaller encoding compared magnitudes with NaN, which is
+    always `false` and caused the intended half-precision path to be skipped.
 
 !!! info "Unused CBOR types"
 
@@ -140,6 +124,7 @@ see "binary" cells in the table above.
       - expected conversions (0xD5..0xD7)
       - simple values (0xE0..0xF3, 0xF8)
       - undefined (0xF7)
+      - half-precision floats (0xF9)
       - break (0xFF)
 
 !!! info "Tagged items"
@@ -241,20 +226,10 @@ string of the same major type, as required by [RFC 8949, Section 3.2.3](https://
     ([RFC 8392](https://www.rfc-editor.org/rfc/rfc8392.html)), cannot be read with this library and need a
     general-purpose CBOR library instead.
 
-    A tag in front of a text string key is handled like a tag in front of a value: it is skipped with
-    `cbor_tag_handler_t::ignore` or `cbor_tag_handler_t::store` and rejected with the default `error`. A tag does not
-    turn a key of another type into a text string.
-
-    A map with duplicate keys is well-formed, but invalid under
-    [RFC 8949, Section 5.3.1](https://www.rfc-editor.org/rfc/rfc8949.html#section-5.3.1). `from_cbor` accepts it and the
-    last value wins; the [SAX interface](../parsing/sax_interface.md) reports every occurrence.
-
 !!! warning "Ill-formed UTF-8 in text strings"
 
     [RFC 8949, Section 3.1](https://www.rfc-editor.org/rfc/rfc8949.html#section-3.1) requires CBOR text strings (major
-    type 3) to be valid UTF-8 (a string with ill-formed UTF-8 is "well-formed but invalid"), and
+    type 3) to be valid UTF-8, but leaves it up to the decoder whether to enforce this, so checking is opt-in: with the
-    [Section 5.3.1](https://www.rfc-editor.org/rfc/rfc8949.html#section-5.3.1) leaves it up to the decoder whether to
-    verify this, so checking is opt-in: with the
     [`error_handler`](../../api/basic_json/from_cbor.md) parameter left at `keep` (the default), `from_cbor()` accepts a
     text string (object keys included) whose bytes are not valid UTF-8 and hands them back unchanged. Passing
     `error_handler_t::strict` makes `from_cbor()` check and throw
@@ -267,14 +242,9 @@ string of the same major type, as required by [RFC 8949, Section 3.2.3](https://
     [`JSON_STRICT_BINARY_UTF8`](../../api/macros/json_strict_binary_utf8.md) is enabled), it throws the same exception
     instead. Byte strings (major type 2) are unaffected, since they are not required to hold text.
 
-    The chunks of an indefinite-length text string are checked one by one, as required by
-    [RFC 8949, Section 3.2.3](https://www.rfc-editor.org/rfc/rfc8949.html#section-3.2.3): a code point cannot be spread
-    over two chunks. With `error_handler_t::strict` such a string throws `parse_error.113`; `replace` and `ignore`
-    sanitize each chunk on its own.
-
 !!! warning "Tagged items"
 
-    Tagged items (0xC0..0xDB) will throw a parse error by default. They can be ignored by passing `cbor_tag_handler_t::ignore` to function `from_cbor`, in which case the tag is skipped and the enclosed data item is parsed on its own. Passing `cbor_tag_handler_t::store` to function `from_cbor` stores tagged byte strings (for bytes 0xd8..0xdb) as binary values with the tag as subtype; other tagged values are read as if the tag were ignored. If several tags precede a byte string, only the tag directly in front of it is stored, and only when it has the form 0xD8..0xDB (a tag 0..23 written as 0xC0..0xD7 is skipped); for example, `D8 05 C1 41 AA` yields subtype `null`, whereas `C1 D8 05 41 AA` yields 5. Tags in front of a text string map key are skipped as well. Note that no tag is ever interpreted: for instance, a text string tagged with tag 0 (date/time) stays a string.
+    Tagged items (0xC0..0xDB) will throw a parse error by default. They can be ignored by passing `cbor_tag_handler_t::ignore` to function `from_cbor`, in which case the tag is skipped and the enclosed data item is parsed on its own. Passing `cbor_tag_handler_t::store` to function `from_cbor` stores tagged byte strings (for bytes 0xd8..0xdb) as binary values with the tag as subtype; other tagged values are read as if the tag were ignored. If several tags precede a byte string, only the innermost one is stored. Note that no tag is ever interpreted: for instance, a text string tagged with tag 0 (date/time) stays a string.
 
 ??? example "Example: deserialize a JSON value from CBOR"
 

docs/mkdocs/docs/features/binary_formats/index.md

@@ -16,25 +16,25 @@ to efficiently encode JSON values to byte vectors and to decode such vectors.
 
 ### Completeness
 
-| Format      | Serialization                                 | Deserialization                                                       |
+| Format      | Serialization                                 | Deserialization                              |
-|-------------|-----------------------------------------------|-----------------------------------------------------------------------|
+|-------------|-----------------------------------------------|----------------------------------------------|
-| BJData      | complete                                      | incomplete: no column-major ND-arrays, no Draft 4 SoA/extension types |
+| BJData      | complete                                      | complete                                     |
-| BON8        | incomplete: no unsigned integers above int64  | complete                                                              |
+| BON8        | incomplete: no unsigned integers above int64  | complete                                     |
-| BSON        | incomplete: top-level value must be an object | incomplete, but all JSON types are supported                          |
+| BSON        | incomplete: top-level value must be an object | incomplete, but all JSON types are supported |
-| CBOR        | complete                                      | incomplete, but all JSON types are supported                          |
+| CBOR        | complete                                      | incomplete, but all JSON types are supported |
-| MessagePack | complete                                      | incomplete, but all JSON types are supported                          |
+| MessagePack | complete                                      | complete                                     |
-| UBJSON      | complete                                      | complete                                                              |
+| UBJSON      | complete                                      | complete                                     |
 
 ### Binary values
 
-| Format      | Binary values            | Binary subtypes |
+| Format      | Binary values | Binary subtypes |
-|-------------|--------------------------|-----------------|
+|-------------|---------------|-----------------|
-| BJData      | supported (Draft 3 only) | not supported   |
+| BJData      | not supported | not supported   |
-| BON8        | not supported            | not supported   |
+| BON8        | not supported | not supported   |
-| BSON        | supported                | supported       |
+| BSON        | supported     | supported       |
-| CBOR        | supported                | supported       |
+| CBOR        | supported     | supported       |
-| MessagePack | supported                | supported       |
+| MessagePack | supported     | supported       |
-| UBJSON      | not supported            | not supported   |
+| UBJSON      | not supported | not supported   |
 
 See [binary values](../binary_values.md) for more information.
 

docs/mkdocs/docs/features/binary_formats/messagepack.md

@@ -11,7 +11,7 @@ extra byte in addition to the strings themselves.
 
 ## Byte layout
 
-MessagePack encodes each value as a one-byte *format marker*, optionally followed by a length or the payload. The marker range is partitioned to keep common values small: small non-negative integers (0 to 127) and small negative integers (-32 to -1) are the marker byte itself; short strings, arrays, and maps (up to 31 bytes for strings and up to 15 elements for arrays and maps) hide their length in the marker's lower bits. Larger values use dedicated markers that announce the width (8, 16, 32, or 64 bits) of the length or number that follows, in big-endian byte order. Like CBOR, containers are length-prefixed, so no terminator is needed.
+MessagePack encodes each value as a one-byte *format marker*, optionally followed by a length or the payload. The marker range is partitioned to keep common values small: small non-negative integers (0 to 127) and small negative integers (-32 to -1) are the marker byte itself; short strings, arrays, and maps (up to 31 or 15 elements) hide their length in the marker's lower bits. Larger values use dedicated markers that announce the width (8, 16, 32, or 64 bits) of the length or number that follows, in big-endian byte order. Like CBOR, containers are length-prefixed, so no terminator is needed.
 
 Consider the following JSON value (shown formatted for readability):
 
@@ -109,9 +109,8 @@ specification:
 !!! note
 
     Prior to version 3.13.0, NaN and Infinity were instead serialized as a MessagePack float 64 (type 0xCB, 9 bytes
-    total), because the check used to select the smaller float 32 encoding failed for NaN (all comparisons are `false`)
+    total), because the check used to select the smaller float 32 encoding compared magnitudes with NaN, which is
-    and for Infinity and -Infinity (outside the float range checked against `std::numeric_limits<float>::lowest()` and
+    always `false` and caused the float 32 path to be skipped.
-    `max()`), so the float 32 path was skipped.
 
 ??? example "Example: serialize a JSON value to MessagePack"
 
@@ -136,7 +135,6 @@ The library maps MessagePack types to JSON value types as follows:
 | fixarray         | array           | 0x90..0x9F |
 | fixstr           | string          | 0xA0..0xBF |
 | nil              | `null`          | 0xC0       |
-| (never used)     | –               | 0xC1       |
 | false            | `false`         | 0xC2       |
 | true             | `true`          | 0xC3       |
 | float 32         | number_float    | 0xCA       |
@@ -169,30 +167,6 @@ The library maps MessagePack types to JSON value types as follows:
 | fixext 16        | binary          | 0xD8       |
 | negative fixint  | number_integer  | 0xE0-0xFF  |
 
-The byte 0xC1 is reserved as "never used" by the specification. As a value it is rejected with
-[`parse_error.112`](../../home/exceptions.md#jsonexceptionparse_error112) (`invalid byte: 0xC1`); as a map key it is
-rejected with [`parse_error.113`](../../home/exceptions.md#jsonexceptionparse_error113) and the generic "expected length
-specification" message, because the key is read as a string.
-
-Duplicate keys in a map are accepted; the last value wins.
-
-### Extension types (ext, fixext)
-
-MessagePack ext and fixext values are read as binary values, and the ext type byte is stored as the binary subtype.
-Although the specification defines the type as a signed 8-bit integer (0 to 127 for applications, -128 to -1 reserved,
-with -1 being the Timestamp extension), the library reads it as an unsigned byte: a negative ext type `n` becomes
-subtype `256+n`, so ext type -1 is read as subtype 255 and -128 as subtype 128. The Timestamp extension is not
-interpreted; it is returned as binary with subtype 255. Use
-[`has_subtype()`](../../api/byte_container_with_subtype/has_subtype.md) to tell a `bin` value (no subtype) from an ext
-value (subtype, even if it is 0).
-
-When serializing, a binary value with a subtype is always written as fixext (1, 2, 4, 8, or 16 bytes) or ext, even
-for subtype 0 (`d6 00 01 02 03 04`); a binary value without a subtype is written as bin. Subtypes 128 to 255 are
-written as the reserved negative ext types (255 as -1), so `json::binary({1,2,3,4}, 255)` becomes
-`d6 ff 01 02 03 04`, which other MessagePack libraries decode as a 32-bit timestamp. A subtype above 255 throws
-[`out_of_range.415`](../../home/exceptions.md#jsonexceptionout_of_range415). The payload length is limited to
-4294967295 bytes like all other lengths.
-
 !!! info
 
     Any MessagePack output created by `to_msgpack` can be successfully parsed by `from_msgpack`.
@@ -203,8 +177,7 @@ written as the reserved negative ext types (255 as -1), so `json::binary({1,2,3,
     JSON-compatible [profile](https://github.com/msgpack/msgpack/blob/master/spec.md#profile) sketched in the
     MessagePack specification, this library restricts map keys to `str` values. Maps with keys of any other type are
     rejected with a [`parse_error.113`](../../home/exceptions.md#jsonexceptionparse_error113) exception (or, with
-    `allow_exceptions` set to `false`, a discarded value). For most key types the message names the type that was
+    `allow_exceptions` set to `false`, a discarded value) naming the type of the key that was found, for instance:
-    found, for instance:
 
     ```
     [json.exception.parse_error.113] parse error at byte 2: syntax error while parsing MessagePack object key: only string keys are supported, but found nil; last byte: 0xC0
@@ -216,7 +189,7 @@ written as the reserved negative ext types (255 as -1), so `json::binary({1,2,3,
 !!! warning "Ill-formed UTF-8 in string values"
 
     The MessagePack specification explicitly allows a `str` value (`fixstr`, `str 8`, `str 16`, `str 32`) to contain
-    a byte sequence that is not valid UTF-8, and recommends that a deserializer provide a way to obtain the original bytes.
+    a byte sequence that is not valid UTF-8, and expects a deserializer to hand the original bytes back unchanged.
     This library follows that by default: with its
     [`error_handler`](../../api/basic_json/from_msgpack.md) parameter left at `keep` (the default),
     `from_msgpack()` reads `str` bytes (object keys included) as-is, without validating them, so such a value

docs/mkdocs/docs/features/binary_formats/ubjson.md

@@ -5,11 +5,11 @@ achieve the generality of JSON, combined with being much easier to process than
 
 !!! abstract "References"
 
-    - [UBJSON Website](https://ubjson.org)
+    - [UBJSON Website](http://ubjson.org)
 
 ## Byte layout
 
-UBJSON is built from just a one-byte, human-readable ASCII *type marker* (for example, `i` for int8, `S` for string, `[` for array) followed by the payload of that type. Strings and the like are prefixed with their length, which is itself a UBJSON integer value including its marker. Numbers are stored in big-endian byte order. Containers can be written in two ways: as an *unoptimized* container that is opened with `[` or `{` and closed with `]` or `}`, or as an *optimized* container that declares a count (`#`) after the opening marker, optionally preceded by an element type (`$`); an element type is only allowed together with a count. An optimized container saves the closing marker and, with a type, the per-element markers.
+UBJSON is built from just a one-byte, human-readable ASCII *type marker* (for example, `i` for int8, `S` for string, `[` for array) followed by the payload of that type. Strings and the like are prefixed with their length, which is itself a UBJSON integer value including its marker. Numbers are stored in big-endian byte order. Containers can be written in two ways: as an *unoptimized* container that is opened with `[` or `{` and closed with `]` or `}`, or as an *optimized* container that declares an element type (`$`) and/or a count (`#`) after the opening marker, which saves per-element markers and (for a count) the closing marker.
 
 Consider the following JSON value (shown formatted for readability):
 
@@ -44,29 +44,29 @@ Consider the following JSON value (shown formatted for readability):
 
 The library uses the following mapping from JSON values types to UBJSON types according to the UBJSON specification:
 
-| JSON value type | value/range                               | UBJSON type                                      | marker    |
+| JSON value type | value/range                               | UBJSON type    | marker |
-|-----------------|-------------------------------------------|--------------------------------------------------|-----------|
+|-----------------|-------------------------------------------|----------------|--------|
-| null            | `null`                                    | null                                             | `Z`       |
+| null            | `null`                                    | null           | `Z`    |
-| boolean         | `true`                                    | true                                             | `T`       |
+| boolean         | `true`                                    | true           | `T`    |
-| boolean         | `false`                                   | false                                            | `F`       |
+| boolean         | `false`                                   | false          | `F`    |
-| number_integer  | -9223372036854775808..-2147483649         | int64                                            | `L`       |
+| number_integer  | -9223372036854775808..-2147483649         | int64          | `L`    |
-| number_integer  | -2147483648..-32769                       | int32                                            | `l`       |
+| number_integer  | -2147483648..-32769                       | int32          | `l`    |
-| number_integer  | -32768..-129                              | int16                                            | `I`       |
+| number_integer  | -32768..-129                              | int16          | `I`    |
-| number_integer  | -128..127                                 | int8                                             | `i`       |
+| number_integer  | -128..127                                 | int8           | `i`    |
-| number_integer  | 128..255                                  | uint8                                            | `U`       |
+| number_integer  | 128..255                                  | uint8          | `U`    |
-| number_integer  | 256..32767                                | int16                                            | `I`       |
+| number_integer  | 256..32767                                | int16          | `I`    |
-| number_integer  | 32768..2147483647                         | int32                                            | `l`       |
+| number_integer  | 32768..2147483647                         | int32          | `l`    |
-| number_integer  | 2147483648..9223372036854775807           | int64                                            | `L`       |
+| number_integer  | 2147483648..9223372036854775807           | int64          | `L`    |
-| number_unsigned | 0..127                                    | int8                                             | `i`       |
+| number_unsigned | 0..127                                    | int8           | `i`    |
-| number_unsigned | 128..255                                  | uint8                                            | `U`       |
+| number_unsigned | 128..255                                  | uint8          | `U`    |
-| number_unsigned | 256..32767                                | int16                                            | `I`       |
+| number_unsigned | 256..32767                                | int16          | `I`    |
-| number_unsigned | 32768..2147483647                         | int32                                            | `l`       |
+| number_unsigned | 32768..2147483647                         | int32          | `l`    |
-| number_unsigned | 2147483648..9223372036854775807           | int64                                            | `L`       |
+| number_unsigned | 2147483648..9223372036854775807           | int64          | `L`    |
-| number_unsigned | 9223372036854775808..18446744073709551615 | high-precision                                   | `H`       |
+| number_unsigned | 9223372036854775808..18446744073709551615 | high-precision | `H`    |
-| number_float    | *any value*                               | float64 (float32 if `number_float_t` is `float`) | `D` (`d`) |
+| number_float    | *any value*                               | float64        | `D`    |
-| string          | *with shortest length indicator*          | string                                           | `S`       |
+| string          | *with shortest length indicator*          | string         | `S`    |
-| array           | *see notes on optimized format*           | array                                            | `[`       |
+| array           | *see notes on optimized format*           | array          | `[`    |
-| object          | *see notes on optimized format*           | object                                           | `{`       |
+| object          | *see notes on optimized format*           | map            | `{`    |
 
 !!! success "Complete mapping"
 
@@ -93,27 +93,20 @@ The library uses the following mapping from JSON values types to UBJSON types ac
 
     The following markers are not used in the conversion:
     
-    - `N`: no-op values are never written (they are skipped when reading).
+    - `Z`: no-op values are not created.
     - `C`: single-byte strings are serialized with `S` markers.
 
 !!! info "NaN/infinity handling"
 
-    NaN and infinity are written as IEEE 754 float64 values (`D`) and read back unchanged. This differs from
+    If NaN or Infinity are stored inside a JSON number, they are serialized properly. This behavior differs from the
-    [`dump()`](../../api/basic_json/dump.md), which serializes them to `null`, and from the UBJSON specification, which
+    [`dump()`](../../api/basic_json/dump.md) function which serializes NaN or Infinity to `null`.
-    encodes infinity as `null` (it does not mention NaN); other UBJSON readers may therefore not accept these values.
 
 !!! info "Optimized formats"
 
     The optimized formats for containers are supported: Parameter `use_size` adds size information to the beginning of a
     container and removes the closing marker. Parameter `use_type` further checks whether all elements of a container
     have the same type and adds the type marker to the beginning of the container. The `use_type` parameter must only be
-    used together with `use_size = true`: combining `use_type` with `use_size = false` throws
+    used together with `use_size = true`.
-    [`other_error.502`](../../home/exceptions.md#jsonexceptionother_error502) if the value contains a non-empty array,
-    object, or binary value.
-
-    Two elements have the same type if they are written with the same type marker. For example, `[1, 2]` is written with
-    the type `i`, but `[1, 200]` (`i`, `U`), `[true, false]` (`T`, `F`), and `[1, 2.5]` (`i`, `D`) are not; an empty
-    container is never given a `$` annotation of its own (an array of empty arrays is still typed `[`).
 
     Note that `use_size = true` alone may result in larger representations - the benefit of this parameter is that the
     receiving side is immediately informed on the number of elements of the container.
@@ -122,9 +115,8 @@ The library uses the following mapping from JSON values types to UBJSON types ac
     already is the value. Its declared count is therefore the only thing that decides how much memory the receiving side
     allocates, and a handful of bytes can describe billions of elements. `from_ubjson` rejects such an array with
     [`out_of_range.408`](../../home/exceptions.md#jsonexceptionout_of_range408) when the count exceeds 1,048,576
-    (`1 << 20`), and `to_ubjson` writes longer arrays of these types in the counted but untyped form: the `$` type marker is
+    (`1 << 20`), and `to_ubjson` writes longer arrays of these types without the annotation, so any value it produces
-    dropped, the `#` count is kept, and every element is written with its own marker (`[#l 1048577 Z Z ...`), so any value
+    can be read back.
-    it produces can be read back. Objects and untyped counted arrays are not subject to this limit.
 
 !!! info "Binary values"
 
@@ -148,54 +140,27 @@ The library uses the following mapping from JSON values types to UBJSON types ac
 
 The library maps UBJSON types to JSON value types as follows:
 
-| UBJSON type    | JSON value type                                  | marker |
+| UBJSON type | JSON value type                         | marker |
-|----------------|--------------------------------------------------|--------|
+|-------------|-----------------------------------------|--------|
-| no-op          | *no value, next value is read*                   | `N`    |
+| no-op       | *no value, next value is read*          | `N`    |
-| null           | `null`                                           | `Z`    |
+| null        | `null`                                  | `Z`    |
-| false          | `false`                                          | `F`    |
+| false       | `false`                                 | `F`    |
-| true           | `true`                                           | `T`    |
+| true        | `true`                                  | `T`    |
-| float32        | number_float                                     | `d`    |
+| float32     | number_float                            | `d`    |
-| float64        | number_float                                     | `D`    |
+| float64     | number_float                            | `D`    |
-| uint8          | number_unsigned                                  | `U`    |
+| uint8       | number_unsigned                         | `U`    |
-| int8           | number_integer                                   | `i`    |
+| int8        | number_integer                          | `i`    |
-| int16          | number_integer                                   | `I`    |
+| int16       | number_integer                          | `I`    |
-| int32          | number_integer                                   | `l`    |
+| int32       | number_integer                          | `l`    |
-| int64          | number_integer                                   | `L`    |
+| int64       | number_integer                          | `L`    |
-| string         | string                                           | `S`    |
+| string      | string                                  | `S`    |
-| char           | string                                           | `C`    |
+| char        | string                                  | `C`    |
-| high-precision | number_unsigned, number_integer, or number_float | `H`    |
+| array       | array (optimized values are supported)  | `[`    |
-| array          | array (optimized values are supported)           | `[`    |
+| object      | object (optimized values are supported) | `{`    |
-| object         | object (optimized values are supported)          | `{`    |
-
-!!! info "High-precision numbers"
-
-    The payload of `H` is a length-prefixed string that is parsed as a JSON number (surrounding whitespace is ignored).
-    Integer text in the range of `number_unsigned_t` (non-negative) or `number_integer_t` (negative) is stored as such;
-    any other valid number text (larger or smaller integers, fractions, and exponents such as `1e2`) is stored as
-    `number_float`, so precision may be lost. Text that is not a valid JSON number raises
-    [`parse_error.115`](../../home/exceptions.md#jsonexceptionparse_error115), a number outside the range of
-    `number_float_t` (`1e999`) raises [`out_of_range.406`](../../home/exceptions.md#jsonexceptionout_of_range406).
 
 !!! success "Complete mapping"
 
-    Every well-formed UBJSON value can be converted to a JSON value, with these exceptions: a high-precision number
+    The mapping is **complete** in the sense that any UBJSON value can be converted to a JSON value.
-    outside the range of `number_float_t` ([`out_of_range.406`](../../home/exceptions.md#jsonexceptionout_of_range406)),
-    an optimized array of `Z`, `T`, or `F` with more than 1,048,576 elements, and a count that exceeds the capacity of the
-    container ([`out_of_range.408`](../../home/exceptions.md#jsonexceptionout_of_range408)). High-precision numbers that
-    do not fit an integer type are stored as floating-point numbers and may lose precision. Ill-formed input is rejected
-    with a parse error.
-
-!!! info "Duplicate object keys"
-
-    If an object contains the same key more than once, the last value is kept (the UBJSON specification does not
-    address duplicate keys).
-
-!!! info "Type marker of optimized containers"
-
-    The type marker after `$` must be one of `Z`, `N`, `T`, `F`, `i`, `U`, `I`, `l`, `L`, `d`, `D`, `H`, `C`, `S`, `[`, or
-    `{`. It is checked even if the count is 0; any other marker raises
-    [`parse_error.112`](../../home/exceptions.md#jsonexceptionparse_error112). A counted object typed `N` (`{$N#i1 ...`)
-    is not supported.
 
 !!! warning "Ill-formed UTF-8 in string values and object keys"
 

docs/mkdocs/docs/features/binary_values.md

@@ -132,11 +132,8 @@ is an integer or `null`.
 
 ### BJData
 
-[BJData](binary_formats/bjdata.md) Draft 3 supports binary values as optimized arrays of `B` (byte) elements, but no
+[BJData](binary_formats/bjdata.md) neither supports binary values nor subtypes and proposes to serialize binary values
-subtypes. With `version = bjdata_version_t::draft3` and both `use_size` and `use_type` set, `to_bjdata` writes a binary
+as an array of uint8 values. The library implements this translation.
-value as `[$B#...`, and `from_bjdata` reads it back as a binary value (without subtype). In all other cases, including
-the default Draft 2 mode, the library follows the Draft 2 proposal and writes an array of integers (`U` in Draft 2, `B`
-in Draft 3), which is read back as an array.
 
 ??? example "Example: serialize a binary value to BJData"
 
@@ -174,7 +171,7 @@ in Draft 3), which is read back as an array.
 
     ```c
     0x7B                                // '{'
-        0x23 0x69 0x01                  // '#' 'i' 1 number of object members
+        0x23 0x69 0x01                  // '#' 'i' type of the array elements: unsigned integers
         0x69 0x06                       // i 6 (length of the key)
         0x62 0x69 0x6E 0x61 0x72 0x79   // "binary"
         0x5B                            // '[' array
@@ -183,7 +180,7 @@ in Draft 3), which is read back as an array.
             0xCA 0xFE 0xBA 0xBE         // content
     ```
 
-    Note that subtype (42) is **not** serialized and that, in Draft 2 mode, BJData has **no binary type**, and deserializing `v` would
+    Note that subtype (42) is **not** serialized and that BJData has **no binary type**, and deserializing `v` would
     yield the following value:
 
     ```json
@@ -216,7 +213,7 @@ array of integers.
     0x87                                     // object with 1 member
         0x62 0x69 0x6E 0x61 0x72 0x79        // "binary"
         0x84                                 // array with 4 elements
-            0xC3 0x22 0xC3 0x56 0xC3 0x12 0xC3 0x16  // content (each byte, here all above 39, as a 2-byte integer)
+            0xC3 0x22 0xC3 0x56 0xC3 0x12 0xC3 0x16  // content (each byte as a 2-byte integer)
     ```
 
     Note that the subtype is lost, and deserializing `v` would yield the following value:
@@ -230,10 +227,7 @@ array of integers.
 ### BSON
 
 [BSON](binary_formats/bson.md) supports binary values and subtypes. If a subtype is given, it is used and added as an
-unsigned 8-bit integer; a subtype above 255 throws
+unsigned 8-bit integer. If no subtype is given, the generic binary subtype 0x00 is used.
-[`out_of_range.415`](../home/exceptions.md#jsonexceptionout_of_range415). If no subtype is given, the generic binary
-subtype 0x00 is used. The payload of the "old binary" subtype 0x02 is preceded by a second length, which the library
-writes and removes again when reading; it is not part of the payload.
 
 ??? example "Example: serialize a binary value to BSON"
 
@@ -307,8 +301,6 @@ representation using the length of the byte array.
     [`json::from_cbor`](../api/basic_json/from_cbor.md) (see
     [`cbor_tag_handler_t`](../api/basic_json/cbor_tag_handler_t.md)).
 
-    With `ignore`, the subtype is dropped (`"subtype": null`); with `store`, the tag is kept (`"subtype": 42`):
-
     ```json
     {
       "binary": {
@@ -318,21 +310,11 @@ representation using the length of the byte array.
     }
     ```
 
-    ```json
-    {
-      "binary": {
-        "bytes": [202, 254, 186, 190],
-        "subtype": 42
-      }
-    }
-    ```
-
 ### MessagePack
 
 [MessagePack](binary_formats/messagepack.md) supports binary values and subtypes. If a subtype is given, the ext family
-is used. The library will choose the smallest representation among fixext1, fixext2, fixext4, fixext8, fixext16, ext8,
+is used. The library will choose the smallest representation among fixext1, fixext2, fixext4, fixext8, ext8, ext16, and
-ext16, and ext32. The subtype is then written as the signed 8-bit ext type: subtypes 128 to 255 map to the negative
+ext32. The subtype is then added as a signed 8-bit integer.
-(reserved) ext types, and on reading the ext type is exposed as an unsigned subtype from 0 to 255.
 
 If no subtype is given, the bin family (bin8, bin16, bin32) is used.
 

docs/mkdocs/docs/features/parsing/error_recovery.md

@@ -0,0 +1,122 @@
+# Error Recovery
+
+By default, parsing stops at the first error. With the [SAX interface](sax_interface.md), you can instead ask the
+parser to *recover*: to repair the error and continue, so that you get as much as possible out of malformed input, for
+instance a file that was cut off, JSON edited by hand, or the output of a language model.
+
+## Recovering from errors
+
+The SAX parser's [`parse_error`](../../api/json_sax/parse_error.md) function is called for every error. Its return value
+decides what happens next:
+
+- `#!cpp false` stops parsing. This is what the SAX parsers of the library do, so [`parse`](../../api/basic_json/parse.md)
+  and [`accept`](../../api/basic_json/accept.md) never recover.
+- `#!cpp true` repairs the error and continues parsing.
+
+When recovering, the SAX parser still receives well-formed events: every `start_object` or `start_array` is followed by
+the matching `end_object` or `end_array`, and every `key` is followed by exactly one value. A SAX parser that creates a
+JSON value, such as the one in the example below, therefore gets a complete value. Parsing always ends, and
+[`sax_parse`](../../api/basic_json/sax_parse.md) returns `#!cpp false` for input that is not valid JSON, even if every
+error was repaired. Each token is reported at most once, and the SAX parser can stop at any error by returning
+`#!cpp false`.
+
+!!! example
+
+    The example below derives a SAX parser from the library's parser for `json` values (`json_sax_dom_parser`),
+    and recovers from all errors.
+
+    ```cpp
+    --8<-- "examples/sax_parse__error_recovery.cpp"
+    ```
+    
+    Output:
+    
+    ```
+    --8<-- "examples/sax_parse__error_recovery.output"
+    ```
+
+## How errors are repaired
+
+Each error is repaired with the smallest local edit: a missing separator is inserted, a stray token is removed, what can
+be read of a broken string or number is kept, and a value that cannot be read at all becomes `#!json null`.
+
+| Mistake                   | Repair                                                                         | Example                                  | Result                     |
+|---------------------------|--------------------------------------------------------------------------------|------------------------------------------|----------------------------|
+| missing `,` or `:`        | inserted                                                                       | `#!json [1 2]`, `#!json {"a" 1}`         | `[1,2]`, `{"a":1}`         |
+| missing value             | `#!json null` for an object key or between commas in an array                  | `#!json {"a":}`, `#!json [1,,2]`         | `{"a":null}`, `[1,null,2]` |
+| trailing comma            | removed                                                                        | `#!json [1,2,]`                          | `[1,2]`                    |
+| broken string             | invalid escapes and bytes are replaced (see below); a line break ends the string | `#!json ["a\qb"]`                        | `["aqb"]`                  |
+| broken number             | the longest valid beginning is kept                                            | `#!json [1., 2e+]`                       | `[1,2]`                    |
+| unreadable value          | `#!json null`                                                                  | `#!json [1, NaN, tru]`                   | `[1,null,null]`            |
+| number too large          | passed as infinity, together with its text                                     | `#!json [1e999]`                         | infinity (see below)       |
+| stray `:`                 | removed                                                                        | `#!json ["a":1]`                         | `["a",1]`                  |
+| member without a key      | skipped up to the next `,` or `}`                                              | `#!json {1:2, "b":3}`                    | `{"b":3}`                  |
+| wrong closing bracket     | closes the innermost array or object                                           | `#!json {"a":[1,2}, "b":3}`              | `{"a":[1,2],"b":3}`        |
+| input ends too early      | all open arrays and objects are closed                                         | `#!json {"a":[1,2`                       | `{"a":[1,2]}`              |
+| text before the value     | skipped                                                                        | `#!json )]}'{"a":1}`                     | `{"a":1}`                  |
+
+In a string, an unknown escape like `\q` stands for the escaped character (`q`), as in JavaScript. An invalid `\u`
+escape, a lone surrogate, and ill-formed UTF-8 are each replaced by U+FFFD (REPLACEMENT CHARACTER), and control
+characters are kept. A string without its closing quote ends at the next line break or at the end of the input.
+
+The input after the top-level value is not repaired: as without recovery, it is reported as an error, and parsing stops.
+
+## Binary formats
+
+The binary formats ([BJData](../binary_formats/bjdata.md), [BON8](../binary_formats/bon8.md),
+[BSON](../binary_formats/bson.md), [CBOR](../binary_formats/cbor.md), [MessagePack](../binary_formats/messagepack.md),
+and [UBJSON](../binary_formats/ubjson.md)) have no delimiters to find the next value by. So what can be repaired depends
+on whether the end of the item with the error is known, a distinction that
+[RFC 8949, Section 5.3](https://www.rfc-editor.org/rfc/rfc8949.html#section-5.3) makes for CBOR, too.
+
+If the item is complete, but cannot be passed on as it is, it is replaced, and parsing continues after it:
+
+| Mistake                                                             | Formats                 | Repair                                                                  |
+|---------------------------------------------------------------------|-------------------------|-------------------------------------------------------------------------|
+| tag, if `tag_handler` is `cbor_tag_handler_t::error` (the default)  | CBOR                    | ignored                                                                 |
+| simple value other than `false`, `true`, and `null`, like undefined | CBOR                    | `#!json null`                                                           |
+| number too large for a custom `number_float_t`, like `float`        | all                     | infinity                                                                |
+| character (`C`) that is not ASCII                                   | BJData, UBJSON          | U+FFFD                                                                  |
+| invalid high-precision number (`H`)                                 | BJData, UBJSON          | the longest valid beginning is kept, as for JSON text, or `#!json null` |
+| high-precision number too large                                     | BJData, UBJSON          | passed as infinity, together with its text                              |
+| object key that is not a string                                     | BON8, CBOR, MessagePack | the member is skipped                                                   |
+| element of a type the library does not read, like ObjectId or date  | BSON                    | `#!json null`                                                           |
+| string without its terminator                                       | BSON                    | kept                                                                    |
+| document whose size does not match its content                      | BSON                    | kept                                                                    |
+
+CBOR tags and simple values are repaired as [RFC 8949, Section 6.1](https://www.rfc-editor.org/rfc/rfc8949.html#section-6.1)
+suggests for converting CBOR to JSON. By default, [`sax_parse`](../../api/basic_json/sax_parse.md) reports every tag as
+an error; when recovering, tags are then ignored like with
+[`cbor_tag_handler_t::ignore`](../../api/basic_json/cbor_tag_handler_t.md). Strings that are not valid UTF-8 are no
+error: like [`from_cbor`](../../api/basic_json/from_cbor.md) and the other functions by default, `sax_parse` passes
+them on as they are.
+
+After any other error, the end of the item is unknown: the input ended, a byte is not a valid type marker, or a size
+cannot be right. Parsing then stops, and the value read so far is completed: a key that waits for its value gets
+`#!json null`, and all open arrays and objects are closed. This keeps everything before the error of an input that was
+cut off. The exception is BSON, which stores the size of every document: an element whose end is unknown gets
+`#!json null`, the rest of its document is skipped, and parsing continues after the document.
+
+## Limitations
+
+- A repair is a guess. For example, `#!json {"a" "b": 1}` could be meant as `#!json {"a": "b"}` or as
+  `#!json {"a": null, "b": 1}`; it is repaired to the former. Treat recovered values as a best effort, and check the
+  reported errors.
+- A closing bracket always closes the innermost array or object. If a bracket is missing rather than wrong, the
+  repair differs from the intention: `#!json {"a": {"b": [1, 2}, "c": 3}` is repaired to
+  `#!json {"a": {"b": [1, 2], "c": 3}}`, although `#!json {"a": {"b": [1, 2]}, "c": 3}` may have been meant.
+- Keys without quotes, and strings in single quotes, are not supported; such members are skipped.
+- In the binary formats, a member that is skipped because its key is not a string is lost, and so are the elements of a
+  BSON document after one whose end is unknown.
+- A number that is too large for `number_float_t` is passed as positive or negative infinity. The SAX parser's
+  `number_float` also gets the number's text, but a JSON value cannot store it, and
+  [`dump`](../../api/basic_json/dump.md) serializes infinity as `#!json null`.
+- When parsing is not strict (see [`sax_parse`](../../api/basic_json/sax_parse.md)), a repair may read parts of the
+  input after the value, for instance of the next value in a stream of concatenated values.
+
+## See also
+
+- [SAX interface](sax_interface.md) - implement a custom SAX handler
+- [`parse_error`](../../api/json_sax/parse_error.md) - the SAX event for parse errors
+- [`sax_parse`](../../api/basic_json/sax_parse.md) - generate SAX events
+- [parsing and exceptions](parse_exceptions.md) - control error handling

docs/mkdocs/docs/features/parsing/index.md

@@ -139,7 +139,7 @@ See [Zero-copy JSON views](../json_view.md) for the concept and the trade-offs.
 When the input is not valid JSON, the `parse` function throws an exception by default. If exceptions are undesired or
 unavailable, the parser can instead return a discarded value, or [`accept`](../../api/basic_json/accept.md) can be used
 to only check whether an input is valid JSON. See [parsing and exceptions](parse_exceptions.md) for the available
-options.
+options. To get as much as possible out of malformed input, a SAX parser can [recover from errors](error_recovery.md).
 
 ## See also
 
@@ -153,5 +153,6 @@ options.
 - [SAX interface](sax_interface.md) - implement a custom SAX handler
 - [Zero-copy JSON views](../json_view.md) - parse into a read-only document and read it through views
 - [parsing and exceptions](parse_exceptions.md) - control error handling
+- [error recovery](error_recovery.md) - get as much as possible out of malformed input
 - [parsing untrusted input](untrusted_input.md) - what to consider when parsing input from untrusted sources
 - [Zero-copy JSON views](../json_view.md) - parse into a document and read it through a view

docs/mkdocs/docs/features/parsing/parse_exceptions.md

@@ -68,7 +68,8 @@ bool parse_error(std::size_t position,
                  const json::exception& ex);
 ```
 
-The return value indicates whether the parsing should continue, so the function should usually return `#!cpp false`.
+The return value decides whether to stop parsing (`#!cpp false`) or to repair the error and continue
+(`#!cpp true`); see [error recovery](error_recovery.md) for the latter.
 
 ??? example "Example: report parse errors without exceptions"
 

docs/mkdocs/docs/features/parsing/sax_interface.md

@@ -60,7 +60,8 @@ bool key(string_t& val);
 bool parse_error(std::size_t position, const std::string& last_token, const json::exception& ex);
 ```
 
-The return value of each function determines whether parsing should proceed.
+The return value of each function determines whether parsing should proceed. For `parse_error`, returning
+`#!cpp true` [recovers from the error](error_recovery.md).
 
 To implement your own SAX handler, proceed as follows:
 
@@ -68,7 +69,7 @@ To implement your own SAX handler, proceed as follows:
 2. Create an object of your SAX interface class, e.g. `my_sax`.
 3. Call `#!cpp bool json::sax_parse(input, &my_sax);` where the first parameter can be any input like a string or an input stream and the second parameter is a pointer to your SAX interface.
 
-Note the `sax_parse` function only returns a `#!cpp bool` indicating the result of the last executed SAX event. It does not return `json` value - it is up to you to decide what to do with the SAX events. Furthermore, no exceptions are thrown in case of a parse error - it is up to you what to do with the exception object passed to your `parse_error` implementation. Internally, the SAX interface is used for the DOM parser (class `json_sax_dom_parser`) as well as the acceptor (`json_sax_acceptor`), see file `json_sax.hpp`.
+Note the `sax_parse` function only returns a `#!cpp bool` indicating whether the input was parsed without errors and no SAX event returned `#!cpp false`. It does not return `json` value - it is up to you to decide what to do with the SAX events. Furthermore, no exceptions are thrown in case of a parse error - it is up to you what to do with the exception object passed to your `parse_error` implementation. Internally, the SAX interface is used for the DOM parser (class `json_sax_dom_parser`) as well as the acceptor (`json_sax_acceptor`), see file `json_sax.hpp`.
 
 ## See also
 

docs/mkdocs/docs/features/types/template_parameters.md

@@ -368,7 +368,8 @@ using array_t = ArrayType<basic_json, AllocatorType<basic_json>>;
   `#!cpp std::from_chars` is not available or declines the token, and `std::strtold` reads up to the null character. A type whose `data()`
   is not null-terminated does not fail to compile; with such a `NumberFloatType` it can silently misparse
   floating-point numbers.
-- `append(const char*, size_type)`, used by [`dump`](../../api/basic_json/dump.md) and by the binary readers. The library's internal string concatenation additionally has
+- `append(const char*, size_type)`, used by [`dump`](../../api/basic_json/dump.md), and `append(const StringType&)`,
+  used by the CBOR reader for indefinite-length strings. The library's internal string concatenation additionally has
   to append a `#!cpp char` and a `#!cpp const char*`; for each it selects between `append(arg)`, `#!cpp operator+=`,
   `append(first, last)`, and `append(data, size)`.
 - The comparison operator `==` against another `StringType`, and `<` for use as a key of the chosen
@@ -677,7 +678,8 @@ using binary_t = nlohmann::byte_container_with_subtype<BinaryType>;
   [`StringType`](#stringtype), whose non-`#!cpp const` `data()` is C++17 and later only.
 - Default-constructible, copy-constructible, and move-constructible.
 - Member functions `size()`, `empty()`, `data()`, `resize()`, `operator[]`, `back()`, `begin()`, `end()`, `cbegin()`,
-  and `cend()` with random-access iterators. `push_back()` is **not** required.
+  and `cend()` with random-access iterators, and `insert(pos, first, last)`, which the CBOR reader uses to join the
+  chunks of an indefinite-length byte string. `push_back()` is **not** required.
 - Comparison operators: `==` is used by
   [`byte_container_with_subtype`](../../api/byte_container_with_subtype/index.md), the relational operators by
   [`basic_json`'s comparison operators](../../api/basic_json/operator_le.md).

docs/mkdocs/docs/home/exceptions.md

@@ -330,7 +330,7 @@ where they cannot be resolved.
 ### json.exception.parse_error.110
 
 When parsing a [binary format](../features/binary_formats/index.md), the byte vector ends before the complete value has
-been read, or (with `strict = true`) further bytes follow the value.
+been read.
 
 !!! failure "Example messages"
 
@@ -346,7 +346,7 @@ been read, or (with `strict = true`) further bytes follow the value.
 
 ### json.exception.parse_error.112
 
-An unexpected byte was read in a [binary format](../features/binary_formats/index.md) or length information is invalid ([BSON](../features/binary_formats/bson.md)). In [BON8](../features/binary_formats/bon8.md), this exception is also thrown for a key that is not a string and for ill-formed UTF-8.
+An unexpected byte was read in a [binary format](../features/binary_formats/index.md) or length information is invalid ([BSON](../features/binary_formats/bson.md)).
 
 !!! failure "Example messages"
 
@@ -371,21 +371,15 @@ An unexpected byte was read in a [binary format](../features/binary_formats/inde
     ```
     [json.exception.parse_error.112] parse error at byte 5: syntax error while parsing BSON document: document size 6 does not match the number of bytes read (5)
     ```
-    ```
-    [json.exception.parse_error.112] parse error at byte 2: syntax error while parsing BON8 string: invalid UTF-8 byte: 0x80
-    ```
 
 ### json.exception.parse_error.113
 
 A string could not be read from a [binary format](../features/binary_formats/index.md): either a value that is not a
 string was read where one was required (for instance as a map key), the string's length specification is invalid, or
 the string's bytes are not valid UTF-8 and the `error_handler` parameter of the corresponding `from_*` function is
-set to `strict`. By default (`error_handler_t::keep`), the bytes of a string are not checked for valid UTF-8 on read.
+set to `strict`. By default (`error_handler_t::keep`), the bytes of a string are not checked for valid UTF-8 on read;
-This applies to the `from_*` functions that have an `error_handler` parameter; `from_bon8` does not have one.
+see the ill-formed UTF-8 notes on the individual [binary format](../features/binary_formats/index.md) pages for how
-See the ill-formed UTF-8 notes on the individual [binary format](../features/binary_formats/index.md) pages for how
 such a string is handled depending on `error_handler`.
-[`from_bon8()`](../api/basic_json/from_bon8.md) never throws this exception: BON8 non-string keys and ill-formed UTF-8
-are reported as [parse_error.112](#jsonexceptionparse_error112).
 
 CBOR and MessagePack allow map keys of any type, but JSON object keys are always strings. Maps with keys of any other
 type (for instance integers or `null`) are therefore not supported; see the notes on
@@ -424,16 +418,13 @@ The parsing of the corresponding BSON record type is not implemented (yet).
 
 ### json.exception.parse_error.115
 
-A UBJSON or BJData high-precision number could not be parsed.
+A UBJSON high-precision number could not be parsed.
 
-!!! failure "Example messages"
+!!! failure "Example message"
 
     ```
     [json.exception.parse_error.115] parse error at byte 5: syntax error while parsing UBJSON high-precision number: invalid number text: 1A
     ```
-    ```
-    [json.exception.parse_error.115] parse error at byte 5: syntax error while parsing BJData high-precision number: invalid number text: 1A
-    ```
 
 ### json.exception.parse_error.116
 
@@ -821,9 +812,6 @@ The binary writers [`to_cbor()`](../api/basic_json/to_cbor.md), [`to_ubjson()`](
 as well for a string value or object key that is not valid UTF-8 if their `error_handler` is `strict` (the default if
 [`JSON_STRICT_BINARY_UTF8`](../api/macros/json_strict_binary_utf8.md) is enabled). So does
 [`to_msgpack()`](../api/basic_json/to_msgpack.md) if `error_handler_t::strict` is passed.
-[`to_bon8()`](../api/basic_json/to_bon8.md) always throws this exception for such a string or key, regardless of
-[`JSON_STRICT_BINARY_UTF8`](../api/macros/json_strict_binary_utf8.md), because the end of a BON8 string is determined
-from its UTF-8 encoding.
 
 !!! failure "Example message"
 
@@ -1018,8 +1006,7 @@ double-precision number when `number_float_t` is `#!cpp float`.
 An integer number cannot be represented by the binary format it is serialized to:
 
 - [BON8](../features/binary_formats/bon8.md) only stores integers that fit into int64, so
-  [`to_bon8`](../api/basic_json/to_bon8.md) throws for unsigned integers greater than 9223372036854775807 and, with a
+  [`to_bon8`](../api/basic_json/to_bon8.md) throws for unsigned integers greater than 9223372036854775807.
-  number type wider than 64 bits, for any integer outside the int64 range.
 - [CBOR](../features/binary_formats/cbor.md), [MessagePack](../features/binary_formats/messagepack.md), and
   [BSON](../features/binary_formats/bson.md) store integers in at most 64 bits. With the default number types, every
   integer fits, but a [`number_integer_t`](../api/basic_json/number_integer_t.md) or
@@ -1038,7 +1025,7 @@ exception, because they serialize integers beyond 64 bits as high-precision numb
     - Since version 3.12.0, integer numbers beyond int64 are serialized as uint64 BSON numbers.
 
     Before version 3.13.0, CBOR, MessagePack, and BSON silently truncated integers wider than 64 bits, and BJData
-    truncated unsigned integers wider than 64 bits that were elements of ND-arrays with `"_ArrayType_": "uint64"`.
+    truncated unsigned integers wider than 64 bits.
 
 !!! failure "Example messages"
 
@@ -1058,8 +1045,8 @@ or the encoded length for [CBOR](../features/binary_formats/cbor.md).
 The exception is also thrown for a [UBJSON](../features/binary_formats/ubjson.md) array of a type that is encoded by its
 marker alone (`Z`, `T` or `F`) whose declared count exceeds 1,048,576 (`1 << 20`). Such an array has no payload, so its
 count alone decides how much memory is allocated, and a handful of bytes would otherwise describe billions of values.
-[`to_ubjson`](../api/basic_json/to_ubjson.md) writes longer arrays of these types without the `$` type annotation (the `#`
+[`to_ubjson`](../api/basic_json/to_ubjson.md) writes longer arrays of these types without the size and type annotation,
-count and one marker per element are kept), so any value it produces can still be read back.
+so any value it produces can still be read back.
 
 !!! failure "Example messages"
 
@@ -1166,18 +1153,14 @@ A JSON Patch `move` operation's `"from"` location is a proper prefix of its `"pa
 ### json.exception.out_of_range.415
 
 MessagePack's ext type and BSON's binary subtype are each stored in a single byte. This exception is thrown when serializing a
-[`byte_container_with_subtype`](../api/byte_container_with_subtype/index.md) whose subtype exceeds 255, the largest value the library can store in that byte.
+[`byte_container_with_subtype`](../api/byte_container_with_subtype/index.md) whose subtype exceeds 255.
 
-!!! failure "Example messages"
+!!! failure "Example message"
 
     ```
     [json.exception.out_of_range.415] subtype 70000 is too large for the MessagePack ext type (max 255)
     ```
 
-    ```
-    [json.exception.out_of_range.415] subtype 70000 is too large for the BSON binary subtype (max 255)
-    ```
-
 !!! note
 
     This exception was added in version 3.13.0. Before that, subtypes above 255 were silently truncated modulo 256 instead of raising an error.
@@ -1246,9 +1229,7 @@ A JSON Patch operation 'test' failed. The unsuccessful operation is also printed
 ### json.exception.other_error.502
 
 [`to_ubjson`](../api/basic_json/to_ubjson.md) and [`to_bjdata`](../api/basic_json/to_bjdata.md) were called with
-`use_type = true` but `use_size = false`, and the value contains a non-empty array or object (or, with BJData Draft 3,
+`use_type = true` but `use_size = false`. UBJSON requires a size marker (`#`) after a type marker (`$`).
-any binary value). UBJSON requires a size marker (`#`) after a type marker (`$`); scalars and empty arrays or objects
-do not throw.
 
 !!! failure "Example message"
 

docs/mkdocs/mkdocs.yml

@@ -136,6 +136,7 @@ nav:
       - features/performance.md
       - Parsing:
           - features/parsing/index.md
+          - features/parsing/error_recovery.md
           - features/parsing/json_lines.md
           - features/parsing/large_and_partial_input.md
           - features/parsing/parse_exceptions.md
@@ -173,7 +174,6 @@ nav:
           - 'begin': api/basic_json/begin.md
           - 'binary': api/basic_json/binary.md
           - 'binary_t': api/basic_json/binary_t.md
-          - 'bjdata_version_t': api/basic_json/bjdata_version_t.md
           - 'boolean_t': api/basic_json/boolean_t.md
           - 'cbegin': api/basic_json/cbegin.md
           - 'cbor_tag_handler_t': api/basic_json/cbor_tag_handler_t.md

include/nlohmann/detail/input/input_adapters.hpp

@@ -796,17 +796,22 @@ class iterator_input_adapter
         return get_consumed_count() + eof_reads;
     }
 
-    // number of newlines in the consumed range [0, last_index); @a line_start
+    // number of newlines in the consumed range [first_index, last_index); if
-    // is set to the index after the last of them (0 if there is none); only
+    // there is one, @a line_start is set to the index after the last of them,
-    // valid when supports_seek
+    // otherwise it is left unchanged; only valid when supports_seek
-    std::size_t count_consumed_lines(std::size_t last_index, std::size_t& line_start) const
+    std::size_t count_consumed_lines(std::size_t first_index, std::size_t last_index, std::size_t& line_start) const
     {
-        const auto to = std::next(begin, static_cast<typename std::iterator_traits<IteratorType>::difference_type>(last_index));
+        using difference_type = typename std::iterator_traits<IteratorType>::difference_type;
+        const auto from = std::next(begin, static_cast<difference_type>(first_index));
+        const auto to = std::next(from, static_cast<difference_type>(last_index - first_index));
         const auto newline = char_traits<char_type>::to_char_type('\n');
         using reverse_it = std::reverse_iterator<IteratorType>;
-        const auto last_newline = std::find(reverse_it(to), reverse_it(begin), newline);
+        const auto last_newline = std::find(reverse_it(to), reverse_it(from), newline);
-        line_start = static_cast<std::size_t>(std::distance(begin, last_newline.base()));
+        if (last_newline.base() != from)
-        return static_cast<std::size_t>(std::count(begin, last_newline.base(), newline));
+        {
+            line_start = static_cast<std::size_t>(std::distance(begin, last_newline.base()));
+        }
+        return static_cast<std::size_t>(std::count(from, last_newline.base(), newline));
     }
 
     // append the already-consumed characters in the half-open range

include/nlohmann/detail/input/json_sax.hpp

@@ -138,7 +138,9 @@ struct json_sax
     @param[in] position    the position in the input where the error occurs
     @param[in] last_token  the last read token
     @param[in] ex          an exception object describing the error
-    @return whether parsing should proceed (must return false)
+    @return whether to recover from the error: false stops parsing; true
+            repairs the error and continues, or, if that is not possible,
+            stops after completing the value read so far
     */
     virtual bool parse_error(std::size_t position,
                              const std::string& last_token,
@@ -469,12 +471,15 @@ constructor contains the parsed value. Without @a Collect, every value is
 stored in place as it arrives, so after a parse error the value holds what was
 read up to it.
 
-@tparam BasicJsonType  the JSON type
+@tparam BasicJsonType     the JSON type
-@tparam Collect  whether to collect the values of containers of unknown size on
+@tparam InputAdapterType  the input adapter of the lexer that can be passed to
-                 a stack (only for a caller that does not use the value after a
+                          the constructor to record diagnostic positions; it
-                 parse error)
+                          does not matter if no lexer is passed
+@tparam Collect           whether to collect the values of containers of
+                          unknown size on a stack (only for a caller that does
+                          not use the value after a parse error)
 */
-template<typename BasicJsonType, typename InputAdapterType, bool Collect = false>
+template<typename BasicJsonType, typename InputAdapterType = string_input_adapter_type, bool Collect = false>
 class json_sax_dom_parser : public json_sax_dom_error_state
 {
   public:
@@ -780,6 +785,8 @@ class json_sax_dom_parser : public json_sax_dom_error_state
         JSON_HEDLEY_NEVER_INLINE
         void grow()
         {
+            // the stack starts with local_capacity frames and only grows
+            JSON_ASSERT(capacity != 0);
             const std::size_t new_capacity = capacity * 2;
             std::unique_ptr<frame[]> new_heap(new frame[new_capacity]); // NOLINT(cppcoreguidelines-avoid-c-arrays,hicpp-avoid-c-arrays,modernize-avoid-c-arrays)
             for (std::size_t i = 0; i < count; ++i)
@@ -1595,7 +1602,7 @@ class json_sax_dom_binary_parser : public json_sax_dom_error_state
     lexer_t* m_lexer_ref = nullptr;
 };
 
-template<typename BasicJsonType, typename InputAdapterType>
+template<typename BasicJsonType, typename InputAdapterType = string_input_adapter_type>
 class json_sax_dom_callback_parser : public json_sax_dom_error_state
 {
   public:

include/nlohmann/detail/input/lexer.hpp

@@ -10,7 +10,7 @@
 
 #include <array> // array
 #include <cstddef> // size_t
-#include <cstdint> // uint32_t
+#include <cstdint> // uint8_t, uint32_t
 #include <cstdio> // snprintf
 #include <cstring> // memcmp
 #include <initializer_list> // initializer_list
@@ -381,6 +381,20 @@ class lexer : public lexer_base<BasicJsonType>
         return codepoint;
     }
 
+    /// the code point of the surrogate pair @a high (U+D800..U+DBFF) and @a low (U+DC00..U+DFFF)
+    static constexpr int combine_surrogates(const int high, const int low) noexcept
+    {
+        return static_cast<int>(
+                   // high surrogate occupies the most significant 22 bits
+                   (static_cast<unsigned int>(high) << 10u)
+                   // low surrogate occupies the least significant 15 bits
+                   + static_cast<unsigned int>(low)
+                   // there is still the 0xD800, 0xDC00, and 0x10000 noise
+                   // in the result, so we have to subtract with:
+                   // (0xD800 << 10) + DC00 - 0x10000 = 0x35FDC00
+                   - 0x35FDC00u);
+    }
+
     /*!
     @brief check if the next byte(s) are inside a given range
 
@@ -411,6 +425,7 @@ class lexer : public lexer_base<BasicJsonType>
             else
             {
                 error_message = "invalid string: ill-formed UTF-8 byte";
+                error_cause = error_kind::string_ill_formed_utf8;
                 return false;
             }
         }
@@ -526,6 +541,7 @@ class lexer : public lexer_base<BasicJsonType>
                 case char_traits<char_type>::eof():
                 {
                     error_message = "invalid string: missing closing quote";
+                    error_cause = error_kind::string;
                     return token_type::parse_error;
                 }
 
@@ -582,6 +598,7 @@ class lexer : public lexer_base<BasicJsonType>
                             if (JSON_HEDLEY_UNLIKELY(codepoint1 == -1))
                             {
                                 error_message = "invalid string: '\\u' must be followed by 4 hex digits";
+                                error_cause = error_kind::string_invalid_escape;
                                 return token_type::parse_error;
                             }
 
@@ -589,13 +606,23 @@ class lexer : public lexer_base<BasicJsonType>
                             if (0xD800 <= codepoint1 && codepoint1 <= 0xDBFF)
                             {
                                 // expect next \uxxxx entry
-                                if (JSON_HEDLEY_LIKELY(get() == '\\' && get() == 'u'))
+                                if (JSON_HEDLEY_LIKELY(get() == '\\'))
                                 {
+                                    if (JSON_HEDLEY_UNLIKELY(get() != 'u'))
+                                    {
+                                        // current is the character escaped by the backslash
+                                        error_message = "invalid string: surrogate U+D800..U+DBFF must be followed by U+DC00..U+DFFF";
+                                        error_cause = error_kind::string_invalid_escape;
+                                        string_error_resume = resume_kind::escaped_character;
+                                        return token_type::parse_error;
+                                    }
+
                                     const int codepoint2 = get_codepoint();
 
                                     if (JSON_HEDLEY_UNLIKELY(codepoint2 == -1))
                                     {
                                         error_message = "invalid string: '\\u' must be followed by 4 hex digits";
+                                        error_cause = error_kind::string_invalid_escape;
                                         return token_type::parse_error;
                                     }
 
@@ -603,25 +630,23 @@ class lexer : public lexer_base<BasicJsonType>
                                     if (JSON_HEDLEY_LIKELY(0xDC00 <= codepoint2 && codepoint2 <= 0xDFFF))
                                     {
                                         // overwrite codepoint
-                                        codepoint = static_cast<int>(
+                                        codepoint = combine_surrogates(codepoint1, codepoint2);
-                                                        // high surrogate occupies the most significant 22 bits
-                                                        (static_cast<unsigned int>(codepoint1) << 10u)
-                                                        // low surrogate occupies the least significant 15 bits
-                                                        + static_cast<unsigned int>(codepoint2)
-                                                        // there is still the 0xD800, 0xDC00, and 0x10000 noise
-                                                        // in the result, so we have to subtract with:
-                                                        // (0xD800 << 10) + DC00 - 0x10000 = 0x35FDC00
-                                                        - 0x35FDC00u);
                                     }
                                     else
                                     {
+                                        // the second escape was read completely and is a
+                                        // code point of its own
                                         error_message = "invalid string: surrogate U+D800..U+DBFF must be followed by U+DC00..U+DFFF";
+                                        error_cause = error_kind::string_invalid_escape;
+                                        string_error_resume = resume_kind::after_escape;
+                                        string_error_codepoint = codepoint2;
                                         return token_type::parse_error;
                                     }
                                 }
                                 else
                                 {
                                     error_message = "invalid string: surrogate U+D800..U+DBFF must be followed by U+DC00..U+DFFF";
+                                    error_cause = error_kind::string_invalid_escape;
                                     return token_type::parse_error;
                                 }
                             }
@@ -629,7 +654,10 @@ class lexer : public lexer_base<BasicJsonType>
                             {
                                 if (JSON_HEDLEY_UNLIKELY(0xDC00 <= codepoint1 && codepoint1 <= 0xDFFF))
                                 {
+                                    // the escape was read completely
                                     error_message = "invalid string: surrogate U+DC00..U+DFFF must follow U+D800..U+DBFF";
+                                    error_cause = error_kind::string_invalid_escape;
+                                    string_error_resume = resume_kind::after_escape;
                                     return token_type::parse_error;
                                 }
                             }
@@ -638,10 +666,7 @@ class lexer : public lexer_base<BasicJsonType>
                             JSON_ASSERT(0x00 <= codepoint && codepoint <= 0x10FFFF);
 
                             // translate codepoint into bytes
-                            encode_utf8(static_cast<std::uint32_t>(codepoint), [this](std::uint32_t byte)
+                            add_codepoint(codepoint);
-                            {
-                                add(static_cast<char_int_type>(byte));
-                            });
 
                             break;
                         }
@@ -649,6 +674,7 @@ class lexer : public lexer_base<BasicJsonType>
                         // other characters after escape
                         default:
                             error_message = "invalid string: forbidden character after backslash";
+                            error_cause = error_kind::string;
                             return token_type::parse_error;
                     }
 
@@ -725,6 +751,7 @@ class lexer : public lexer_base<BasicJsonType>
                         }
                     };
                     error_message = control_character_messages[static_cast<std::size_t>(current)];
+                    error_cause = error_kind::string;
                     return token_type::parse_error;
                 }
 
@@ -947,6 +974,7 @@ class lexer : public lexer_base<BasicJsonType>
                 default:
                 {
                     error_message = "invalid string: ill-formed UTF-8 byte";
+                    error_cause = error_kind::string_ill_formed_utf8;
                     return token_type::parse_error;
                 }
             }
@@ -1002,6 +1030,7 @@ class lexer : public lexer_base<BasicJsonType>
                         case char_traits<char_type>::eof():
                         {
                             error_message = "invalid comment; missing closing '*/'";
+                            error_cause = error_kind::unclosed_comment;
                             return false;
                         }
 
@@ -1032,6 +1061,7 @@ class lexer : public lexer_base<BasicJsonType>
             default:
             {
                 error_message = "invalid comment; expecting '/' or '*' after '/'";
+                error_cause = error_kind::other;
                 return false;
             }
         }
@@ -1157,6 +1187,7 @@ scan_number_minus:
             default:
             {
                 error_message = "invalid number; expected digit after '-'";
+                error_cause = error_kind::number;
                 return token_type::parse_error;
             }
         }
@@ -1243,6 +1274,7 @@ scan_number_decimal1:
             default:
             {
                 error_message = "invalid number; expected digit after '.'";
+                error_cause = error_kind::number;
                 return token_type::parse_error;
             }
         }
@@ -1311,6 +1343,7 @@ scan_number_exponent:
             {
                 error_message =
                     "invalid number; expected '+', '-', or digit after exponent";
+                error_cause = error_kind::number;
                 return token_type::parse_error;
             }
         }
@@ -1337,6 +1370,7 @@ scan_number_sign:
             default:
             {
                 error_message = "invalid number; expected digit after exponent sign";
+                error_cause = error_kind::number;
                 return token_type::parse_error;
             }
         }
@@ -1764,6 +1798,7 @@ scan_number_done:
             if (JSON_HEDLEY_UNLIKELY(char_traits<char_type>::to_char_type(get()) != static_cast<char_type>(rest[i])))
             {
                 error_message = "invalid literal";
+                error_cause = error_kind::other;
                 return token_type::parse_error;
             }
         }
@@ -2154,17 +2189,25 @@ scan_number_done:
         return position.chars_read_total;
     }
 
-    /// seekable adapter: count the lines in the consumed input; O(input read
+    /// seekable adapter: count the lines in the consumed input. Only the
-    /// so far), but only called on errors
+    /// input consumed since the previous call is scanned, so a parse that
+    /// reports many errors (a SAX parser recovering from them) stays linear
+    /// in the input instead of rescanning it for every error.
     position_t get_position_impl(std::true_type /*lazy*/) const
     {
         position_t result;
         result.chars_read_total = get_chars_read_total();
         // reads at EOF count as characters but are not part of the input
         const std::size_t consumed = (std::min)(result.chars_read_total, ia.get_consumed_count());
-        std::size_t line_start = 0;
+        if (JSON_HEDLEY_UNLIKELY(consumed < position_cache.consumed))
-        result.lines_read = ia.count_consumed_lines(consumed, line_start);
+        {
-        result.chars_read_current_line = result.chars_read_total - line_start;
+            // the consumed input never shrinks; recount from the start if it did
+            position_cache = {};
+        }
+        position_cache.lines += ia.count_consumed_lines(position_cache.consumed, consumed, position_cache.line_start);
+        position_cache.consumed = consumed;
+        result.lines_read = position_cache.lines;
+        result.chars_read_current_line = result.chars_read_total - position_cache.line_start;
         return result;
     }
 
@@ -2348,6 +2391,7 @@ scan_number_done:
         if (get_chars_read_total() == 0 && !skip_bom())
         {
             error_message = "invalid BOM; must be 0xEF 0xBB 0xBF if given";
+            error_cause = error_kind::other;
             return token_type::parse_error;
         }
 
@@ -2455,10 +2499,583 @@ scan_number_done:
             // error
             default:
                 error_message = "invalid literal";
+                error_cause = error_kind::other;
                 return token_type::parse_error;
         }
     }
 
+  public:
+    /////////////////////
+    // error recovery
+    /////////////////////
+
+    /*!
+    @brief make the best of the token that scan() rejected
+
+    Called by the parser after scan() returned token_type::parse_error and the
+    SAX parser asked to recover from the error (see #3989). Keeps what can be
+    read of the token and skips the rest:
+
+    - A string keeps its characters. An unknown escape stands for the escaped
+      character itself (as in JavaScript), an invalid Unicode escape and ill-formed
+      UTF-8 become U+FFFD, and a control character is kept. A line break or the
+      end of the input ends a string that lacks its closing quote.
+    - A number keeps its longest valid prefix, e.g. `1` for `1.` or `1e+`.
+    - A block comment that is not closed runs to the end of the input.
+    - Anything else is skipped.
+
+    The rest of an invalid token is skipped up to the next delimiter
+    (whitespace, a structural character, or a quote). A delimiter that the
+    invalid token consumed is returned to the input, so that the next scan()
+    reads it.
+
+    @return token_type::value_string or a number token type if a string or a
+            number could be read, token_type::end_of_input for a block comment
+            that is not closed, token_type::uninitialized otherwise
+    */
+    token_type recover_token()
+    {
+        const resume_kind resume = string_error_resume;
+        const int codepoint = string_error_codepoint;
+        string_error_resume = resume_kind::character;
+        string_error_codepoint = -1;
+
+        const error_kind cause = error_cause;
+        error_cause = error_kind::other;
+
+        switch (cause)
+        {
+            case error_kind::string:
+            case error_kind::string_invalid_escape:
+            case error_kind::string_ill_formed_utf8:
+                return recover_string(cause, resume, codepoint);
+
+            case error_kind::number:
+                return recover_number();
+
+            case error_kind::unclosed_comment:
+                // the comment runs to the end of the input
+                return token_type::end_of_input;
+
+            case error_kind::other:
+            default:
+                skip_to_delimiter();
+                return token_type::uninitialized;
+        }
+    }
+
+    /*!
+    @brief return the token that scan() read last to the input, so that the
+           next scan() reads it again
+
+    Called by the parser when recovering from an error. The token must be a
+    single character (',', ':', '[', ']', '{', or '}') or the end of the
+    input, and scan() must have read it last.
+    */
+    void unget_token()
+    {
+        JSON_ASSERT(!next_unget);
+        unget();
+    }
+
+    /*!
+    @brief let the token string for the next error begin at the current character
+
+    The token string of an error reaches back to the beginning of the last
+    string or number. After an error, the parser calls this function so that
+    the next error does not report (and, with many errors, copy) everything
+    read since then.
+    */
+    void restart_token_string()
+    {
+        restart_token_string_impl(std::integral_constant<bool, lazy_token_string> {});
+    }
+
+  private:
+    /// how recover_string() continues after the error scan_string() reported
+    enum class resume_kind : std::uint8_t
+    {
+        /// current is the next character of the string (or the end of input)
+        character,
+        /// current is the character escaped by the preceding backslash
+        escaped_character,
+        /// current is the last character of a complete escape
+        after_escape
+    };
+
+    /// what kind of token scan() rejected, which decides how recover_token() repairs it
+    enum class error_kind : std::uint8_t
+    {
+        /// anything not listed below; skipped up to the next delimiter
+        other,
+        /// a string
+        string,
+        /// a string with an invalid Unicode escape, which becomes U+FFFD
+        string_invalid_escape,
+        /// a string with ill-formed UTF-8, which becomes U+FFFD
+        string_ill_formed_utf8,
+        /// a number
+        number,
+        /// a block comment that is not closed
+        unclosed_comment
+    };
+
+    /// whether current ends an invalid token (see recover_token())
+    bool current_is_delimiter() const noexcept
+    {
+        switch (current)
+        {
+            case ' ':
+            case '\t':
+            case '\n':
+            case '\r':
+            case '[':
+            case ']':
+            case '{':
+            case '}':
+            case ',':
+            case ':':
+            case '\"':
+#if !JSON_STRICT_NUL_HANDLING
+            case '\0':
+#endif
+            case char_traits<char_type>::eof():
+                return true;
+
+            case '/':
+                return ignore_comments;
+
+            default:
+                return false;
+        }
+    }
+
+    /// skip the rest of an invalid token and return its delimiter to the input
+    void skip_to_delimiter()
+    {
+        while (!current_is_delimiter())
+        {
+            get();
+        }
+
+        if (current != char_traits<char_type>::eof())
+        {
+            unget();
+        }
+    }
+
+    /// append U+FFFD REPLACEMENT CHARACTER to token_buffer
+    void add_replacement_character()
+    {
+        add_codepoint(0xFFFD);
+    }
+
+    /// append the UTF-8 encoding of @a codepoint (not a surrogate) to token_buffer
+    void add_codepoint(const int codepoint)
+    {
+        JSON_ASSERT(0x00 <= codepoint && codepoint <= 0x10FFFF);
+        encode_utf8(static_cast<std::uint32_t>(codepoint), [this](std::uint32_t byte)
+        {
+            add(static_cast<char_int_type>(byte));
+        });
+    }
+
+    /// append a code point read from a Unicode escape; a surrogate becomes U+FFFD
+    void add_escaped_codepoint(const int codepoint)
+    {
+        if (0xD800 <= codepoint && codepoint <= 0xDFFF)
+        {
+            add_replacement_character();
+        }
+        else
+        {
+            add_codepoint(codepoint);
+        }
+    }
+
+    /*!
+    @brief remove an incomplete UTF-8 sequence from the end of token_buffer
+
+    next_byte_in_range() adds the bytes of a sequence as it checks them, so
+    when it rejects a byte, the beginning of the sequence is already in
+    token_buffer, which otherwise holds only complete sequences.
+
+    @return whether an incomplete sequence was removed
+    */
+    bool remove_incomplete_utf8_sequence()
+    {
+        std::size_t lead = token_buffer.size();
+        std::size_t continuation_bytes = 0;
+        while (lead > 0 && continuation_bytes < 3
+                && (static_cast<unsigned char>(token_buffer[lead - 1]) & 0xC0u) == 0x80u)
+        {
+            --lead;
+            ++continuation_bytes;
+        }
+        if (lead == 0)
+        {
+            return false;
+        }
+
+        const auto lead_byte = static_cast<unsigned char>(token_buffer[lead - 1]);
+        std::size_t expected = 0;
+        if (lead_byte >= 0xF0)
+        {
+            expected = 3;
+        }
+        else if (lead_byte >= 0xE0)
+        {
+            expected = 2;
+        }
+        else if (lead_byte >= 0xC0)
+        {
+            expected = 1;
+        }
+        if (continuation_bytes >= expected)
+        {
+            return false;
+        }
+
+        token_buffer.resize(lead - 1);
+        return true;
+    }
+
+    /*!
+    @brief read the UTF-8 sequence that begins with current, which is not ASCII
+    @return whether the next character must be read; false if current still
+            needs to be handled, because it does not belong to the sequence
+    */
+    bool recover_utf8_sequence()
+    {
+        // the number of continuation bytes and the range of the first one;
+        // see the ranges in scan_string()
+        std::size_t count = 0;
+        char_int_type low = 0x80;
+        char_int_type high = 0xBF;
+        if (current >= 0xC2 && current <= 0xDF)
+        {
+            count = 1;
+        }
+        else if (current >= 0xE0 && current <= 0xEF)
+        {
+            count = 2;
+            low = (current == 0xE0) ? 0xA0 : 0x80;
+            high = (current == 0xED) ? 0x9F : 0xBF;
+        }
+        else if (current >= 0xF0 && current <= 0xF4)
+        {
+            count = 3;
+            low = (current == 0xF0) ? 0x90 : 0x80;
+            high = (current == 0xF4) ? 0x8F : 0xBF;
+        }
+        else
+        {
+            // an ill-formed byte
+            add_replacement_character();
+            return true;
+        }
+
+        const std::size_t start = token_buffer.size();
+        add(current);
+        for (std::size_t i = 0; i < count; ++i)
+        {
+            get();
+            if (current < low || current > high)
+            {
+                token_buffer.resize(start);
+                add_replacement_character();
+                return false;
+            }
+            add(current);
+            low = 0x80;
+            high = 0xBF;
+        }
+        return true;
+    }
+
+    /*!
+    @brief read the low surrogate that must follow the high surrogate @a high
+    @return whether the next character must be read; false if current still
+            needs to be handled
+    */
+    bool recover_low_surrogate(int high)
+    {
+        while (true)
+        {
+            if (get() != '\\')
+            {
+                add_replacement_character();
+                return false;
+            }
+            if (get() != 'u')
+            {
+                add_replacement_character();
+                // not 'u', so this does not come back here
+                return recover_escape();
+            }
+
+            const int low = get_codepoint();
+            if (low == -1)
+            {
+                add_replacement_character();
+                return false;
+            }
+            if (0xDC00 <= low && low <= 0xDFFF)
+            {
+                add_codepoint(combine_surrogates(high, low));
+                return true;
+            }
+
+            // high has no low surrogate
+            add_replacement_character();
+            if (low < 0xD800 || low > 0xDBFF)
+            {
+                add_codepoint(low);
+                return true;
+            }
+            // another high surrogate
+            high = low;
+        }
+    }
+
+    /*!
+    @brief read the escape whose backslash was read; current is the escaped character
+    @return whether the next character must be read; false if current still
+            needs to be handled
+    */
+    bool recover_escape()
+    {
+        switch (current)
+        {
+            case '\"':
+                add('\"');
+                return true;
+            case '\\':
+                add('\\');
+                return true;
+            case '/':
+                add('/');
+                return true;
+            case 'b':
+                add('\b');
+                return true;
+            case 'f':
+                add('\f');
+                return true;
+            case 'n':
+                add('\n');
+                return true;
+            case 'r':
+                add('\r');
+                return true;
+            case 't':
+                add('\t');
+                return true;
+
+            case 'u':
+            {
+                const int codepoint = get_codepoint();
+                if (codepoint == -1)
+                {
+                    add_replacement_character();
+                    return false;
+                }
+                if (0xD800 <= codepoint && codepoint <= 0xDBFF)
+                {
+                    return recover_low_surrogate(codepoint);
+                }
+                add_escaped_codepoint(codepoint);
+                return true;
+            }
+
+            // an unknown escape stands for the escaped character
+            default:
+                return false;
+        }
+    }
+
+    /*!
+    @brief read the rest of a string after scan_string() rejected it
+
+    token_buffer holds what scan_string() read before the error. See
+    recover_token() for how errors are repaired.
+
+    @param[in] cause      the kind of error scan_string() reported
+    @param[in] resume     how to continue, see resume_kind
+    @param[in] codepoint  for a high surrogate followed by an escape of another
+                          code point: that code point; -1 otherwise
+    */
+    token_type recover_string(const error_kind cause, const resume_kind resume, const int codepoint)
+    {
+        // whether the next character must be read before it can be handled
+        bool fetch = false;
+
+        if (cause == error_kind::string_invalid_escape
+                || (cause == error_kind::string_ill_formed_utf8 && remove_incomplete_utf8_sequence()))
+        {
+            add_replacement_character();
+        }
+
+        switch (resume)
+        {
+            case resume_kind::escaped_character:
+                fetch = recover_escape();
+                break;
+            case resume_kind::after_escape:
+                if (0xD800 <= codepoint && codepoint <= 0xDBFF)
+                {
+                    fetch = recover_low_surrogate(codepoint);
+                }
+                else
+                {
+                    if (codepoint != -1)
+                    {
+                        add_escaped_codepoint(codepoint);
+                    }
+                    fetch = true;
+                }
+                break;
+            case resume_kind::character:
+            default:
+                break;
+        }
+
+        while (true)
+        {
+            if (fetch)
+            {
+                get();
+            }
+            fetch = true;
+
+            switch (current)
+            {
+                case '\"':
+                // a line break or the end of the input ends a string that
+                // lacks its closing quote
+                case '\n':
+                case '\r':
+                case char_traits<char_type>::eof():
+                    return token_type::value_string;
+
+#if !JSON_STRICT_NUL_HANDLING
+                case '\0':
+                    // the end of the input, see scan()
+                    unget();
+                    return token_type::value_string;
+#endif
+
+                case '\\':
+                    get();
+                    fetch = recover_escape();
+                    break;
+
+                default:
+                    if (current < 0x80)
+                    {
+                        // including control characters
+                        add(current);
+                    }
+                    else
+                    {
+                        fetch = recover_utf8_sequence();
+                    }
+                    break;
+            }
+        }
+    }
+
+    /*!
+    @brief keep the longest valid prefix of a number that scan_number() rejected
+
+    token_buffer holds the characters scan_number() accepted before the error,
+    so the prefix ends at its last digit.
+    */
+    token_type recover_number()
+    {
+        // only size(), operator[], and resize() are used, which every string
+        // type the library supports provides
+        std::size_t length = token_buffer.size();
+        while (length != 0 && (token_buffer[length - 1] < '0' || token_buffer[length - 1] > '9'))
+        {
+            --length;
+        }
+        token_buffer.resize(length);
+
+        if (length == 0)
+        {
+            skip_to_delimiter();
+            return token_type::uninitialized;
+        }
+
+        if (decimal_point_position >= length)
+        {
+            decimal_point_position = std::string::npos;
+        }
+
+        std::size_t exponent = std::string::npos;
+        for (std::size_t i = 0; i < length; ++i)
+        {
+            if (token_buffer[i] == 'e' || token_buffer[i] == 'E')
+            {
+                exponent = i;
+                break;
+            }
+        }
+        const std::size_t mantissa_end = (exponent == std::string::npos) ? length : exponent;
+        token_type number_type = token_type::value_unsigned;
+        if (decimal_point_position != std::string::npos || exponent != std::string::npos)
+        {
+            number_type = token_type::value_float;
+        }
+        else if (token_buffer[0] == '-')
+        {
+            number_type = token_type::value_integer;
+        }
+
+        const token_type result = convert_number(number_type, mantissa_end);
+        skip_to_delimiter();
+        return result;
+    }
+
+    /// seekable or token-tracking adapter: the token string begins at current
+    void restart_token_string_impl(std::true_type /*lazy*/)
+    {
+        restart_token_string_lazy(std::integral_constant<bool, adapter_token> {});
+    }
+
+    /// seekable adapter: the token string begins at current, which was consumed
+    void restart_token_string_lazy(std::false_type /*adapter_token*/) noexcept
+    {
+        const std::size_t consumed = ia.get_consumed_count();
+        token_string_start = (consumed > 0 && current != char_traits<char_type>::eof()) ? consumed - 1 : consumed;
+    }
+
+    /// token-tracking adapter: the token begins with current, or with the next
+    /// character if current was put back or is the end of input
+    void restart_token_string_lazy(std::true_type /*adapter_token*/)
+    {
+        if (!next_unget && current != char_traits<char_type>::eof())
+        {
+            ia.mark_token_start(current);
+        }
+        else
+        {
+            ia.begin_token();
+        }
+    }
+
+    /// streaming adapter: the token string begins at current; a character
+    /// that was put back is copied again when it is read again
+    void restart_token_string_impl(std::false_type /*lazy*/)
+    {
+        token_string.clear();
+        if (!next_unget && current != char_traits<char_type>::eof())
+        {
+            token_string.push_back(char_traits<char_type>::to_char_type(current));
+        }
+    }
+
     /// input adapter
     InputAdapterType ia;
 
@@ -2483,6 +3100,19 @@ scan_number_done:
     /// that unget() can restore the column instead of leaving it at 0
     std::size_t chars_read_before_newline = 0;
 
+    /// seekable adapter: what get_position() counted last, so that the next
+    /// call only scans the input consumed since
+    struct position_cache_t
+    {
+        /// consumed characters scanned so far
+        std::size_t consumed = 0;
+        /// newlines among them
+        std::size_t lines = 0;
+        /// index after the last of these newlines
+        std::size_t line_start = 0;
+    };
+    mutable position_cache_t position_cache {};
+
     /// raw input token string for error messages; only populated for streaming
     /// adapters (seekable adapters reconstruct it lazily via token_string_start)
     std::vector<char_type> token_string {};
@@ -2503,6 +3133,15 @@ scan_number_done:
     /// a description of occurred lexer errors
     const char* error_message = "";
 
+    /// what kind of token scan() rejected; set together with error_message
+    error_kind error_cause = error_kind::other;
+    /// how recover_token() continues a string that scan_string() rejected;
+    /// set only on the error paths that need more than error_message
+    resume_kind string_error_resume = resume_kind::character;
+    /// the code point of the second escape when a high surrogate is followed
+    /// by an escape that is not a low surrogate; -1 otherwise
+    int string_error_codepoint = -1;
+
     // number values
     number_integer_t value_integer = 0;
     number_unsigned_t value_unsigned = 0;

include/nlohmann/detail/input/parser.hpp

@@ -153,25 +153,72 @@ class parser
     bool accept(const bool strict = true)
     {
         json_sax_acceptor<BasicJsonType> sax_acceptor;
-        return sax_parse(&sax_acceptor, strict);
+        return sax_parse_impl<false>(&sax_acceptor, strict);
     }
 
+    /*!
+    @brief public SAX interface
+
+    If the SAX parser's parse_error() returns true, the parser recovers from
+    the error: it repairs the input and continues (see #3989).
+
+    @param[in] sax     the SAX parser
+    @param[in] strict  whether to expect the last token to be EOF
+    @return whether the input was parsed without errors and no SAX event
+            returned false
+    */
     template<typename SAX>
     JSON_HEDLEY_NON_NULL(2)
     bool sax_parse(SAX* sax, const bool strict = true)
     {
-        (void)detail::is_sax_static_asserts<SAX, BasicJsonType> {};
+        return sax_parse_impl<true>(sax, strict);
-        const bool result = sax_parse_internal(sax);
-
-        if (result)
-        {
-            return finish_input(*sax, strict);
-        }
-
-        return false;
     }
 
   private:
+    /// what sax_parse_internal() does after an object key was expected
+    enum class next_step : std::uint8_t
+    {
+        /// stop parsing
+        stop,
+        /// parse a value that begins with last_token
+        parse_value,
+        /// evaluate the state of the innermost container, which reads
+        /// last_token again
+        evaluate_state
+    };
+
+    template<bool AllowRecovery, typename SAX>
+    JSON_HEDLEY_NON_NULL(2)
+    bool sax_parse_impl(SAX* sax, const bool strict)
+    {
+        (void)detail::is_sax_static_asserts<SAX, BasicJsonType> {};
+        const bool result = sax_parse_internal<AllowRecovery>(sax);
+
+        if (result)
+        {
+            if (strict)
+            {
+                // strict mode: next byte must be EOF; after recovering from an
+                // error, the end of the input may already have been read
+                if (last_token != token_type::end_of_input && get_token() != token_type::end_of_input)
+                {
+                    // the value is complete, so there is nothing to recover
+                    static_cast<void>(report_error(sax, parse_error::create(exception_id::syntax_error, m_lexer.get_position(), exception_message(token_type::end_of_input, "value"), nullptr),
+                                                   std::integral_constant<bool, AllowRecovery> {}));
+                    return false;
+                }
+            }
+            else
+            {
+                // the caller keeps using the input: position it right after
+                // the value by leaving the character that terminated it
+                m_lexer.release_lookahead();
+            }
+        }
+
+        return result && !error_reported;
+    }
+
     /// the text of the current float token for @a sax (see sax_ignores_number_text)
     template<typename SAX>
     const string_t& number_float_text(SAX* /*sax*/)
@@ -239,17 +286,26 @@ class parser
     template<typename DomSax>
     bool parse_dom(DomSax& sdp, const bool strict)
     {
-        sax_parse_internal(&sdp);
+        sax_parse_internal<false>(&sdp);
 
         static_cast<void>(finish_input(sdp, strict));
 
         return !sdp.is_errored();
     }
 
-    template<typename SAX>
+    /*!
+    @brief parse a JSON value and pass it to a SAX parser
+
+    @tparam AllowRecovery  whether to recover from an error if the SAX parser's
+                           parse_error() returns true; false for the SAX parsers
+                           of parse() and accept(), which never do, so that no
+                           code for recovering is generated for them
+    */
+    template<bool AllowRecovery, typename SAX>
     JSON_HEDLEY_NON_NULL(2)
     bool sax_parse_internal(SAX* sax)
     {
+        const std::integral_constant<bool, AllowRecovery> allow_recovery{};
         // value to avoid a goto (see comment where set to true)
         bool skip_to_state_evaluation = false;
 
@@ -288,10 +344,18 @@ class parser
                             break;
                         }
 
-                        // parse key
+                        // remember we are now inside an object
+                        states.push_back(0);
+
+                        // parse key (the steps of parse_key(), which are
+                        // repeated here and below for speed)
                         if (JSON_HEDLEY_UNLIKELY(last_token != token_type::value_string))
                         {
-                            return syntax_error(*sax, exception_message(token_type::value_string, "object key"));
+                            if (!continue_after(key_error(sax, allow_recovery, false), skip_to_state_evaluation))
+                            {
+                                return false;
+                            }
+                            continue;
                         }
                         if (JSON_HEDLEY_UNLIKELY(!sax->key(m_lexer.get_string_token())))
                         {
@@ -301,12 +365,13 @@ class parser
                         // parse separator (:)
                         if (JSON_HEDLEY_UNLIKELY(!get_token_expecting(token_type::name_separator)))
                         {
-                            return syntax_error(*sax, exception_message(token_type::name_separator, "object separator"));
+                            if (!continue_after(key_error(sax, allow_recovery, true), skip_to_state_evaluation))
+                            {
+                                return false;
+                            }
+                            continue;
                         }
 
-                        // remember we are now inside an object
-                        states.push_back(0);
-
                         // parse values
                         get_token();
                         continue;
@@ -342,9 +407,11 @@ class parser
 
                         if (JSON_HEDLEY_UNLIKELY(!std::isfinite(res)))
                         {
-                            return sax->parse_error(m_lexer.get_position(),
+                            if (!overflow_error(sax, res, allow_recovery))
-                                                    m_lexer.get_token_string(),
+                            {
-                                                    out_of_range::create(exception_id::number_overflow, concat("number overflow parsing '", m_lexer.get_token_string(), '\''), nullptr));
+                                return false;
+                            }
+                            break;
                         }
 
                         if (JSON_HEDLEY_UNLIKELY(!sax->number_float(res, number_float_text(sax))))
@@ -412,16 +479,63 @@ class parser
                     case token_type::parse_error:
                     {
                         // using "uninitialized" to avoid an "expected" message
-                        return syntax_error(*sax, exception_message(token_type::uninitialized, "value"));
+                        if (!report_error(sax, parse_error::create(exception_id::syntax_error, m_lexer.get_position(), exception_message(token_type::uninitialized, "value"), nullptr), allow_recovery))
+                        {
+                            return false;
+                        }
+
+                        // recover: keep what can be read of the token
+                        recover_token(allow_recovery);
+                        if (last_token != token_type::uninitialized)
+                        {
+                            // a string or a number
+                            continue;
+                        }
+                        if (states.empty())
+                        {
+                            // look for the value after the garbage
+                            if (!skip_to_value(allow_recovery))
+                            {
+                                return false;
+                            }
+                            continue;
+                        }
+                        // nothing could be read
+                        if (JSON_HEDLEY_UNLIKELY(!sax->null()))
+                        {
+                            return false;
+                        }
+                        break;
                     }
                     case token_type::end_of_input:
                     {
                         if (JSON_HEDLEY_UNLIKELY(m_lexer.get_chars_read_total() == 1))
                         {
-                            return syntax_error(*sax, empty_input_message());
+                            // there is nothing to recover
+                            static_cast<void>(report_error(sax, parse_error::create(exception_id::syntax_error, m_lexer.get_position(),
+                                                           empty_input_message(), nullptr), allow_recovery));
+                            return false;
                         }
 
-                        return syntax_error(*sax, exception_message(token_type::literal_or_value, "value"));
+                        if (!report_error(sax, parse_error::create(exception_id::syntax_error, m_lexer.get_position(), exception_message(token_type::literal_or_value, "value"), nullptr), allow_recovery))
+                        {
+                            return false;
+                        }
+
+                        // recover: the input ends where a value is missing
+                        if (states.empty())
+                        {
+                            // there is no value
+                            return false;
+                        }
+                        if (!recover_missing_value(sax, states, allow_recovery))
+                        {
+                            return false;
+                        }
+                        // the state evaluation reads the token again
+                        unget_token(allow_recovery);
+                        skip_to_state_evaluation = true;
+                        continue;
                     }
                     case token_type::uninitialized:
                     case token_type::end_array:
@@ -431,7 +545,35 @@ class parser
                     case token_type::literal_or_value:
                     default: // the last token was unexpected
                     {
-                        return syntax_error(*sax, exception_message(token_type::literal_or_value, "value"));
+                        if (!report_error(sax, parse_error::create(exception_id::syntax_error, m_lexer.get_position(), exception_message(token_type::literal_or_value, "value"), nullptr), allow_recovery))
+                        {
+                            return false;
+                        }
+
+                        // recover
+                        if (states.empty())
+                        {
+                            // look for the value after the garbage
+                            if (!skip_to_value(allow_recovery))
+                            {
+                                return false;
+                            }
+                            continue;
+                        }
+                        if (last_token == token_type::name_separator)
+                        {
+                            // a stray ':'; the value may follow
+                            get_token();
+                            continue;
+                        }
+                        if (!recover_missing_value(sax, states, allow_recovery))
+                        {
+                            return false;
+                        }
+                        // the state evaluation reads the token again
+                        unget_token(allow_recovery);
+                        skip_to_state_evaluation = true;
+                        continue;
                     }
                 }
             }
@@ -482,7 +624,30 @@ class parser
                     continue;
                 }
 
-                return syntax_error(*sax, exception_message(token_type::end_array, "array"));
+                if (!report_error(sax, parse_error::create(exception_id::syntax_error, m_lexer.get_position(), exception_message(token_type::end_array, "array"), nullptr), allow_recovery))
+                {
+                    return false;
+                }
+
+                // recover
+                if (last_token == token_type::end_of_input)
+                {
+                    // the input ends inside the array
+                    return close_containers(sax, states, allow_recovery);
+                }
+                if (last_token == token_type::end_object)
+                {
+                    // a wrong closing bracket closes the innermost container
+                    if (JSON_HEDLEY_UNLIKELY(!sax->end_array()))
+                    {
+                        return false;
+                    }
+                    states.pop_back();
+                    skip_to_state_evaluation = true;
+                }
+                // otherwise, a missing ',' (or a stray ':', which value
+                // parsing drops): the next value begins here
+                continue;
             }
 
             // states.back() is false -> object
@@ -499,9 +664,12 @@ class parser
                     // parse key
                     if (JSON_HEDLEY_UNLIKELY(last_token != token_type::value_string))
                     {
-                        return syntax_error(*sax, exception_message(token_type::value_string, "object key"));
+                        if (!continue_after(key_error(sax, allow_recovery, false), skip_to_state_evaluation))
+                        {
+                            return false;
+                        }
+                        continue;
                     }
-
                     if (JSON_HEDLEY_UNLIKELY(!sax->key(m_lexer.get_string_token())))
                     {
                         return false;
@@ -510,7 +678,11 @@ class parser
                     // parse separator (:)
                     if (JSON_HEDLEY_UNLIKELY(!get_token_expecting(token_type::name_separator)))
                     {
-                        return syntax_error(*sax, exception_message(token_type::name_separator, "object separator"));
+                        if (!continue_after(key_error(sax, allow_recovery, true), skip_to_state_evaluation))
+                        {
+                            return false;
+                        }
+                        continue;
                     }
 
                     // parse values
@@ -538,10 +710,546 @@ class parser
                 continue;
             }
 
-            return syntax_error(*sax, exception_message(token_type::end_object, "object"));
+            if (!report_error(sax, parse_error::create(exception_id::syntax_error, m_lexer.get_position(), exception_message(token_type::end_object, "object"), nullptr), allow_recovery))
+            {
+                return false;
+            }
+
+            // recover
+            if (last_token == token_type::end_of_input)
+            {
+                // the input ends inside the object
+                return close_containers(sax, states, allow_recovery);
+            }
+            if (last_token == token_type::end_array)
+            {
+                // a wrong closing bracket closes the innermost container
+                if (JSON_HEDLEY_UNLIKELY(!sax->end_object()))
+                {
+                    return false;
+                }
+                states.pop_back();
+                skip_to_state_evaluation = true;
+                continue;
+            }
+            if (!continue_after(recover_member(sax, allow_recovery), skip_to_state_evaluation))
+            {
+                return false;
+            }
         }
     }
 
+    /*!
+    @brief continue sax_parse_internal() after a recovery
+    @return whether to continue parsing
+    */
+    bool continue_after(const next_step step, bool& skip_to_state_evaluation)
+    {
+        if (step == next_step::evaluate_state)
+        {
+            // the state evaluation reads the token again
+            m_lexer.unget_token();
+            skip_to_state_evaluation = true;
+        }
+        return step != next_step::stop;
+    }
+
+    /// the parser for parse() and accept() never recovers: stop parsing
+    JSON_INTERNAL_ALWAYS_INLINE
+    static std::false_type continue_after(std::false_type /*step*/, bool& /*skip_to_state_evaluation*/) noexcept
+    {
+        return {};
+    }
+
+    /*!
+    @brief parse an object key and the name separator (:) after it
+
+    last_token is the token where the key is expected. sax_parse_internal()
+    repeats these steps rather than calling this function, which is used
+    when recovering from an error.
+
+    @return next_step::parse_value if the value follows, with last_token its
+            first token; next_step::evaluate_state if the object's state is
+            to be evaluated after recovering from an error; next_step::stop
+            to stop parsing
+    */
+    template<typename SAX>
+    next_step parse_key(SAX* sax)
+    {
+        const std::true_type allow_recovery{};
+
+        if (JSON_HEDLEY_UNLIKELY(last_token != token_type::value_string))
+        {
+            return key_error(sax, allow_recovery, false);
+        }
+
+        if (JSON_HEDLEY_UNLIKELY(!sax->key(m_lexer.get_string_token())))
+        {
+            return next_step::stop;
+        }
+
+        // parse separator (:)
+        if (JSON_HEDLEY_UNLIKELY(get_token() != token_type::name_separator))
+        {
+            return key_error(sax, allow_recovery, true);
+        }
+
+        // the value begins with the next token
+        get_token();
+        return next_step::parse_value;
+    }
+
+    /*!
+    @brief report a number that is too large for number_float_t, and recover
+           from the error by passing the value on; the SAX parser gets the
+           number's text as well
+
+    This is a separate function, as reading other numbers is measurably
+    slower if the error is handled where they are read.
+
+    @param[in] sax    the SAX parser
+    @param[in] value  the value that is not finite
+    @return whether to continue parsing
+    */
+    template<typename SAX>
+    bool overflow_error(SAX* sax, const number_float_t value, std::true_type allow_recovery)
+    {
+        if (!report_error(sax, out_of_range::create(exception_id::number_overflow, concat("number overflow parsing '", m_lexer.get_token_string(), '\''), nullptr), allow_recovery))
+        {
+            return false;
+        }
+        return sax->number_float(value, number_float_text(sax));
+    }
+
+    /// @copydoc overflow_error
+    template<typename SAX>
+    JSON_INTERNAL_ALWAYS_INLINE
+    std::false_type overflow_error(SAX* sax, const number_float_t /*value*/, std::false_type allow_recovery)
+    {
+        return report_error(sax, out_of_range::create(exception_id::number_overflow, concat("number overflow parsing '", m_lexer.get_token_string(), '\''), nullptr), allow_recovery);
+    }
+
+    /*!
+    @brief report a missing key, or a missing name separator (:) after the
+           key; the parser for parse() and accept() never recovers
+
+    @param[in] key_read  whether the key was read, so that the name separator
+                         is missing
+    @return std::false_type, see report_error()
+    */
+    template<typename SAX>
+    JSON_INTERNAL_ALWAYS_INLINE
+    std::false_type key_error(SAX* sax, std::false_type allow_recovery, const bool key_read)
+    {
+        return report_error(sax, parse_error::create(exception_id::syntax_error, m_lexer.get_position(), key_read
+                            ? exception_message(token_type::name_separator, "object separator")
+                            : exception_message(token_type::value_string, "object key"), nullptr), allow_recovery);
+    }
+
+    /*!
+    @brief report a missing key, or a missing name separator (:) after the
+           key, and recover from it
+
+    @param[in] key_read  whether the key was read, so that the name separator
+                         is missing
+    */
+    template<typename SAX>
+    next_step key_error(SAX* sax, std::true_type allow_recovery, const bool key_read)
+    {
+        if (!key_read)
+        {
+            if (!report_error(sax, parse_error::create(exception_id::syntax_error, m_lexer.get_position(), exception_message(token_type::value_string, "object key"), nullptr), allow_recovery))
+            {
+                return next_step::stop;
+            }
+            return recover_key(sax);
+        }
+
+        if (!report_error(sax, parse_error::create(exception_id::syntax_error, m_lexer.get_position(), exception_message(token_type::name_separator, "object separator"), nullptr), allow_recovery))
+        {
+            return next_step::stop;
+        }
+        return recover_name_separator(sax);
+    }
+
+    /////////////////////
+    // error recovery
+    /////////////////////
+
+    /*
+    The functions below repair an error after the SAX parser's parse_error()
+    returned true (see #3989). Each mistake is repaired by the smallest local
+    edit: a missing ',' or ':' is inserted, a stray token is removed, what can
+    be read of an invalid string or number is kept (see
+    lexer::recover_token()), a missing value becomes null, a wrong closing
+    bracket closes the innermost container, and the end of the input closes
+    all of them. The events stay balanced, and every key() is followed by
+    exactly one value.
+
+    A repair hands a token to the state evaluation, by returning it to the
+    lexer (lexer::unget_token()) so that the state evaluation reads it again,
+    only if it is ',', ']', '}', or the end of the input. The state evaluation
+    hands a token to value or key parsing only if it is none of them, so a
+    token is never handed back and forth. Every other step reads a token or
+    closes a container, so parsing always ends.
+    */
+
+    /*!
+    @brief report an error to the SAX parser; the parser for parse() and
+           accept() never recovers
+
+    @return std::false_type rather than false: its value is known where the
+            function is called even if the call is not inlined, so the code
+            for recovering is not generated
+    */
+    template<typename SAX, typename Exception>
+    JSON_INTERNAL_ALWAYS_INLINE
+    std::false_type report_error(SAX* sax, const Exception& ex, std::false_type /*allow_recovery*/)
+    {
+        static_cast<void>(sax); // MSVC 2015 does not count calling a static parse_error() as using it
+        error_reported = true;
+        static_cast<void>(sax->parse_error(m_lexer.get_position(), m_lexer.get_token_string(), ex));
+        return {};
+    }
+
+    /*!
+    @brief report an error to the SAX parser
+    @return whether to recover from the error
+    */
+    template<typename SAX, typename Exception>
+    bool report_error(SAX* sax, const Exception& ex, std::true_type /*allow_recovery*/)
+    {
+        static_cast<void>(sax); // MSVC 2015 does not count calling a static parse_error() as using it
+        const std::size_t position = m_lexer.get_position().chars_read_total;
+        if (error_reported && position == last_error_position && last_token == last_error_token)
+        {
+            // a repair handed on the token of the error it repaired; the
+            // token was reported already, and the SAX parser asked to recover
+            return true;
+        }
+
+        error_reported = true;
+        last_error_position = position;
+        last_error_token = last_token;
+
+        if (!sax->parse_error(m_lexer.get_position(), m_lexer.get_token_string(), ex))
+        {
+            return false;
+        }
+
+        // the token string of the next error begins here
+        m_lexer.restart_token_string();
+        return true;
+    }
+
+    /*!
+    @brief keep what can be read of the token that the lexer rejected
+
+    The error was reported for the rejected token, so it is not reported again
+    for the token it is repaired to (see lexer::recover_token()).
+    */
+    token_type recover_token()
+    {
+        last_token = m_lexer.recover_token();
+        last_error_position = m_lexer.get_position().chars_read_total;
+        last_error_token = last_token;
+        return last_token;
+    }
+
+    // The functions below are called from sax_parse_internal() after an error
+    // was reported. The parser for parse() and accept() stopped there, so for
+    // it they are stubs: the code for recovering is then not even referenced,
+    // and unoptimized builds do not emit it either.
+
+    /// @copydoc recover_token()
+    JSON_INTERNAL_ALWAYS_INLINE
+    token_type recover_token(std::true_type /*allow_recovery*/)
+    {
+        return recover_token();
+    }
+
+    /// @copydoc recover_token()
+    JSON_INTERNAL_ALWAYS_INLINE
+    static std::false_type recover_token(std::false_type /*allow_recovery*/) noexcept
+    {
+        return {};
+    }
+
+    /// return the token that was read last to the lexer (see lexer::unget_token())
+    JSON_INTERNAL_ALWAYS_INLINE
+    void unget_token(std::true_type /*allow_recovery*/)
+    {
+        m_lexer.unget_token();
+    }
+
+    /// @copydoc unget_token(std::true_type)
+    JSON_INTERNAL_ALWAYS_INLINE
+    static void unget_token(std::false_type /*allow_recovery*/) noexcept {}
+
+    /// @copydoc skip_to_value
+    JSON_INTERNAL_ALWAYS_INLINE
+    static std::false_type skip_to_value(std::false_type /*allow_recovery*/) noexcept
+    {
+        return {};
+    }
+
+    /// @copydoc recover_missing_value
+    template<typename SAX>
+    JSON_INTERNAL_ALWAYS_INLINE
+    static std::false_type recover_missing_value(SAX* /*sax*/, const std::vector<std::uint8_t>& /*states*/, std::false_type /*allow_recovery*/) noexcept
+    {
+        return {};
+    }
+
+    /// pass the end events of all open containers
+    template<typename SAX>
+    bool close_containers(SAX* sax, std::vector<std::uint8_t>& states, std::true_type /*allow_recovery*/)
+    {
+        while (!states.empty())
+        {
+            const bool is_array = states.back() != 0;
+            states.pop_back();
+            if (JSON_HEDLEY_UNLIKELY(is_array ? !sax->end_array() : !sax->end_object()))
+            {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /// @copydoc close_containers
+    template<typename SAX>
+    JSON_INTERNAL_ALWAYS_INLINE
+    static std::false_type close_containers(SAX* /*sax*/, std::vector<std::uint8_t>& /*states*/, std::false_type /*allow_recovery*/) noexcept
+    {
+        return {};
+    }
+
+    /*!
+    @brief read tokens until one begins a value, skipping everything before
+           the top-level value
+    @return whether a value begins with last_token
+    */
+    bool skip_to_value(std::true_type /*allow_recovery*/)
+    {
+        while (true)
+        {
+            switch (get_token())
+            {
+                case token_type::begin_array:
+                case token_type::begin_object:
+                case token_type::literal_false:
+                case token_type::literal_null:
+                case token_type::literal_true:
+                case token_type::value_float:
+                case token_type::value_integer:
+                case token_type::value_string:
+                case token_type::value_unsigned:
+                    return true;
+
+                case token_type::end_of_input:
+                    return false;
+
+                case token_type::parse_error:
+                    recover_token();
+                    if (last_token != token_type::uninitialized)
+                    {
+                        return true;
+                    }
+                    break;
+
+                case token_type::uninitialized:
+                case token_type::end_array:
+                case token_type::end_object:
+                case token_type::name_separator:
+                case token_type::value_separator:
+                case token_type::literal_or_value:
+                default:
+                    break;
+            }
+        }
+    }
+
+    /*!
+    @brief skip the rest of an object member that cannot be read
+
+    Reads tokens, beginning with last_token, until a ',', '}', or ']' that is
+    not inside a container that begins in the skipped tokens, or the end of
+    the input.
+    */
+    void skip_member()
+    {
+        std::size_t depth = 0;
+        while (true)
+        {
+            switch (last_token)
+            {
+                case token_type::begin_array:
+                case token_type::begin_object:
+                    ++depth;
+                    break;
+
+                case token_type::end_array:
+                case token_type::end_object:
+                    if (depth == 0)
+                    {
+                        return;
+                    }
+                    --depth;
+                    break;
+
+                case token_type::value_separator:
+                    if (depth == 0)
+                    {
+                        return;
+                    }
+                    break;
+
+                case token_type::end_of_input:
+                    return;
+
+                case token_type::parse_error:
+                    recover_token();
+                    break;
+
+                case token_type::uninitialized:
+                case token_type::literal_true:
+                case token_type::literal_false:
+                case token_type::literal_null:
+                case token_type::value_string:
+                case token_type::value_unsigned:
+                case token_type::value_integer:
+                case token_type::value_float:
+                case token_type::name_separator:
+                case token_type::literal_or_value:
+                default:
+                    break;
+            }
+            get_token();
+        }
+    }
+
+    /*!
+    @brief pass a value where it is missing
+
+    last_token is ',', ']', '}', or the end of the input, where a value was
+    expected. In an object, the key gets null; in an array, a ',' where a
+    value is missing stands for null (as in JavaScript), while an array that
+    ends there just ends.
+    */
+    template<typename SAX>
+    bool recover_missing_value(SAX* sax, const std::vector<std::uint8_t>& states, std::true_type /*allow_recovery*/)
+    {
+        JSON_ASSERT(!states.empty());
+        if (states.back() == 0 || last_token == token_type::value_separator)
+        {
+            return sax->null();
+        }
+        return true;
+    }
+
+    /// recover from a missing key; last_token is where it was expected
+    template<typename SAX>
+    next_step recover_key(SAX* sax)
+    {
+        switch (last_token)
+        {
+            case token_type::value_separator:
+            case token_type::end_object:
+            case token_type::end_array:
+            case token_type::end_of_input:
+                // no member: the object's state handles the token
+                return next_step::evaluate_state;
+
+            case token_type::parse_error:
+                recover_token();
+                if (last_token == token_type::value_string)
+                {
+                    // a key that could be repaired
+                    return parse_key(sax);
+                }
+                skip_member();
+                return next_step::evaluate_state;
+
+            case token_type::uninitialized:
+            case token_type::literal_true:
+            case token_type::literal_false:
+            case token_type::literal_null:
+            case token_type::value_string:
+            case token_type::value_unsigned:
+            case token_type::value_integer:
+            case token_type::value_float:
+            case token_type::begin_array:
+            case token_type::begin_object:
+            case token_type::name_separator:
+            case token_type::literal_or_value:
+            default:
+                // a member without a key
+                skip_member();
+                return next_step::evaluate_state;
+        }
+    }
+
+    /// recover from a missing name separator (:) after the key; last_token
+    /// is where it was expected
+    template<typename SAX>
+    next_step recover_name_separator(SAX* sax)
+    {
+        switch (last_token)
+        {
+            case token_type::value_separator:
+            case token_type::end_object:
+            case token_type::end_array:
+            case token_type::end_of_input:
+                // the value is missing as well
+                return sax->null() ? next_step::evaluate_state : next_step::stop;
+
+            case token_type::uninitialized:
+            case token_type::literal_true:
+            case token_type::literal_false:
+            case token_type::literal_null:
+            case token_type::value_string:
+            case token_type::value_unsigned:
+            case token_type::value_integer:
+            case token_type::value_float:
+            case token_type::begin_array:
+            case token_type::begin_object:
+            case token_type::name_separator:
+            case token_type::parse_error:
+            case token_type::literal_or_value:
+            default:
+                // a missing ':'; the value begins here
+                return next_step::parse_value;
+        }
+    }
+
+    /// recover from a token after an object member that is neither ',' nor
+    /// '}' (nor ']' or the end of the input, which the caller handles)
+    template<typename SAX>
+    next_step recover_member(SAX* sax, std::true_type /*allow_recovery*/)
+    {
+        if (last_token == token_type::parse_error)
+        {
+            recover_token();
+        }
+        if (last_token == token_type::value_string)
+        {
+            // a missing ','; the next key begins here
+            return parse_key(sax);
+        }
+        skip_member();
+        return next_step::evaluate_state;
+    }
+
+    /// the parser for parse() and accept() never recovers (and does not come
+    /// here, as report_error() returned false)
+    template<typename SAX>
+    JSON_INTERNAL_ALWAYS_INLINE
+    std::false_type recover_member(SAX* /*sax*/, std::false_type /*allow_recovery*/) const noexcept
+    {
+        return {};
+    }
+
     /// get next token from lexer
     token_type get_token()
     {
@@ -612,6 +1320,12 @@ class parser
     const bool allow_exceptions = true;
     /// whether trailing commas in objects and arrays should be ignored (true) or signaled as errors (false)
     const bool ignore_trailing_commas = false;
+    /// whether an error was reported to the SAX parser
+    bool error_reported = false;
+    /// the position of the last reported error
+    std::size_t last_error_position = 0;
+    /// the token of the last reported error
+    token_type last_error_token = token_type::uninitialized;
 };
 
 }  // namespace detail

include/nlohmann/detail/macro_scope.hpp

@@ -215,6 +215,17 @@
     #define JSON_NO_UNIQUE_ADDRESS
 #endif
 
+// Inlines small functions even in unoptimized builds, so that they are not
+// emitted. The parsers for parse(), accept(), and from_*() use it for the
+// functions that stand in for the code recovering from errors (see #3989).
+// MSVC is left to decide, as it warns (C4714) where it does not inline a
+// __forceinline function.
+#if defined(_MSC_VER) && !defined(__clang__)
+    #define JSON_INTERNAL_ALWAYS_INLINE
+#else
+    #define JSON_INTERNAL_ALWAYS_INLINE JSON_HEDLEY_ALWAYS_INLINE
+#endif
+
 // Clang targeting MinGW does not survive the thread_local storage the copy
 // constructor uses to bound its descent: every test that copies a value
 // segfaults with clang 11.0.1 and clang 18.1.8, while the same tests pass with

include/nlohmann/detail/macro_unscope.hpp

@@ -19,6 +19,7 @@
 #undef NLOHMANN_CAN_CALL_STD_FUNC_IMPL
 #undef JSON_INLINE_VARIABLE
 #undef JSON_NO_UNIQUE_ADDRESS
+#undef JSON_INTERNAL_ALWAYS_INLINE
 #undef JSON_DISABLE_ENUM_SERIALIZATION
 #undef JSON_DISABLE_TUPLE_REFERENCE_CONVERSION
 #undef JSON_UNLOCKED_FILE_IO

include/nlohmann/detail/output/binary_writer.hpp

@@ -1684,15 +1684,7 @@ class binary_writer
             throw_subtype_out_of_range(value.subtype(), "the BSON binary subtype", j);
         }
 
-        // the "old binary" subtype 0x02 repeats the payload size in an inner
+        return sizeof(std::int32_t) + value.size() + 1ul;
-        // int32 in front of the payload
-        return sizeof(std::int32_t) + (is_bson_old_binary(value) ? sizeof(std::int32_t) : 0ul) + value.size() + 1ul;
-    }
-
-    /// @return whether @a value has the BSON subtype 0x02 ("binary (old)")
-    static bool is_bson_old_binary(const binary_t& value) noexcept
-    {
-        return value.has_subtype() && value.subtype() == 0x02;
     }
 
     /*!
@@ -1705,18 +1697,10 @@ class binary_writer
     {
         write_bson_entry_header(name, 0x05);
 
-        const bool old_binary = is_bson_old_binary(value);
+        write_number<std::int32_t>(to_bson_length(value.size()), true);
-
-        // the length field counts the inner int32 of the old binary subtype
-        write_number<std::int32_t>(to_bson_length(value.size() + (old_binary ? sizeof(std::int32_t) : 0ul)), true);
 
         write_number(value.has_subtype() ? static_cast<std::uint8_t>(value.subtype()) : static_cast<std::uint8_t>(0x00));
 
-        if (old_binary)
-        {
-            write_number<std::int32_t>(to_bson_length(value.size()), true);
-        }
-
         write_bytes(value.data(), value.size());
     }
 
@@ -1876,8 +1860,7 @@ class binary_writer
            (or the header of a string or binary value) in one reservation
     @return whether the entry was written; false for a discarded value, a
             string or binary value whose length does not fit the length
-            field, or a binary value with subtype 0x02, in which case nothing
+            field, in which case nothing was written
-            was written
     @pre    @a name is at most bson_scalar_max_name_size characters long and is
             not changed by the error handler
     */
@@ -1938,9 +1921,7 @@ class binary_writer
         if (j.is_binary())
         {
             const binary_t& value = *j.m_data.m_value.binary;
-            // the old binary subtype 0x02 has an inner length that the single
+            if (JSON_HEDLEY_UNLIKELY(!value_in_range_of<std::int32_t>(value.size())))
-            // reservation has no room for; write_bson_binary writes it
-            if (JSON_HEDLEY_UNLIKELY(!value_in_range_of<std::int32_t>(value.size()) || is_bson_old_binary(value)))
             {
                 return false;
             }
@@ -3848,7 +3829,7 @@ class binary_writer
     A C++11 `constexpr` function cannot contain a `switch`, so this is a plain
     comparison chain instead; it is only reached once per ND-array candidate
     object. Keep in sync with binary_reader's `bjd_type_name()`, which maps
-    the other way (it also reads "half", which is never written).
+    the other way.
     */
     static CharType bjdata_ndarray_type_marker(const string_t& name)
     {
@@ -4056,13 +4037,10 @@ class binary_writer
             switch (dtype)
             {
                 case 'U':
+                case 'C':
                 case 'B':
                     ok = write_bjdata_ndarray_element<std::uint8_t>(el, dry_run);
                     break;
-                case 'C':
-                    // BJData limits a char to 0..127 (the intersection of the int8 and uint8 ranges)
-                    ok = bjdata_ndarray_value_in_range<std::int8_t>(el) && bjdata_ndarray_value_in_range<std::uint8_t>(el);
-                    break;
                 case 'i':
                     ok = write_bjdata_ndarray_element<std::int8_t>(el, dry_run);
                     break;

include/nlohmann/detail/string_utils.hpp

@@ -13,6 +13,7 @@
 #include <cstddef> // size_t
 #include <cstdint> // uint8_t, uint32_t
 #include <string> // string, to_string
+#include <utility> // move
 
 #include <nlohmann/detail/abi_macros.hpp>
 #include <nlohmann/detail/macro_scope.hpp>

include/nlohmann/detail/view/errors.hpp

@@ -144,11 +144,21 @@ struct throwing_sax
 
     /// (a template, as in json_sax_dom_parser: the parser passes the concrete
     /// exception type, which is thrown as is)
+    ///
+    /// It is not [[noreturn]]: sax_parse() recovers from an error if
+    /// parse_error() returns true, and MSVC reports that code as unreachable
+    /// (C4702) for a handler that never returns. The flag hides that from it.
     template<class Exception>
-    [[noreturn]] bool parse_error(std::size_t /*unused*/, const std::string& /*unused*/, const Exception& ex)
+    bool parse_error(std::size_t /*unused*/, const std::string& /*unused*/, const Exception& ex)
     {
-        NLOHMANN_VIEW_THROW(ex);
+        if (throwing)
+        {
+            NLOHMANN_VIEW_THROW(ex);
+        }
+        return false; // LCOV_EXCL_LINE
     }
+
+    bool throwing = true;
 };
 
 /*!

include/nlohmann/json.hpp

@@ -157,7 +157,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
     friend class ::nlohmann::detail::iter_impl;
     template<typename BasicJsonType, typename CharType, typename OutputSinkType>
     friend class ::nlohmann::detail::binary_writer;
-    template<typename BasicJsonType, typename InputType, typename SAX>
+    template<typename BasicJsonType, typename InputType, typename SAX, bool AllowRecovery>
     friend class ::nlohmann::detail::binary_reader;
     template<typename BasicJsonType, typename InputAdapterType, bool Collect>
     friend class ::nlohmann::detail::json_sax_dom_parser;
@@ -3133,7 +3133,8 @@ public:
         {
             return parser(std::move(ia), nullptr, true, ignore_comments, ignore_trailing_commas).sax_parse(sax, strict);
         }
-        return detail::binary_reader<basic_json, InputAdapterType, SAX>(std::move(ia), format).sax_parse(sax, strict, tag_handler);
+        // the SAX parser may recover from errors (see parse_error())
+        return detail::binary_reader<basic_json, InputAdapterType, SAX, true>(std::move(ia), format).sax_parse(sax, strict, tag_handler);
     }
 
     /// serialize @a j into a new vector; @a write receives the vector-backed writer

single_include/nlohmann/json_view.hpp

@@ -2938,11 +2938,21 @@ struct throwing_sax
 
     /// (a template, as in json_sax_dom_parser: the parser passes the concrete
     /// exception type, which is thrown as is)
+    ///
+    /// It is not [[noreturn]]: sax_parse() recovers from an error if
+    /// parse_error() returns true, and MSVC reports that code as unreachable
+    /// (C4702) for a handler that never returns. The flag hides that from it.
     template<class Exception>
-    [[noreturn]] bool parse_error(std::size_t /*unused*/, const std::string& /*unused*/, const Exception& ex)
+    bool parse_error(std::size_t /*unused*/, const std::string& /*unused*/, const Exception& ex)
     {
-        NLOHMANN_VIEW_THROW(ex);
+        if (throwing)
+        {
+            NLOHMANN_VIEW_THROW(ex);
+        }
+        return false; // LCOV_EXCL_LINE
     }
+
+    bool throwing = true;
 };
 
 /*!

tests/src/fuzzer-parse_bjdata.cpp

@@ -47,6 +47,10 @@ dumps is stable under exactly the same values that break operator==.
 The unit tests run the same checks on a fixed corpus (see the "BJData round-trip
 invariants" test case), so keep both in sync.
 
+Furthermore, it reads data with a SAX parser that recovers from every error
+and checks that the events are balanced, that reading ends, and that it
+reports an error exactly when from_bjdata() fails (see #3989).
+
 Finally, it reads the data from a stream, a non-contiguous iterator range, and
 a FILE*, which read byte by byte, and checks that each gives the same value or
 error (id, message, byte position) as the pointer range, which takes the bulk
@@ -57,6 +61,7 @@ drivers.
 */
 
 #include "fuzzer_common.hpp"
+#include "fuzzer-recovering_checker.hpp"
 
 namespace
 {
@@ -81,6 +86,9 @@ static bool is_value_stable(const json& lhs, const json& rhs)
 // see http://llvm.org/docs/LibFuzzer.html
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 {
+    // recover from all errors, reading from memory and from a stream
+    const bool recovered_without_errors = check_recovering_parse(data, size, json::input_format_t::bjdata).errors == 0;
+
     std::vector<uint8_t> const vec1(data, data + size);
 
     // step 0: parse input without exceptions
@@ -99,6 +107,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
         // without exceptions, the same input must give the same value
         assert(!noexcept_threw && !j_noexcept.is_discarded() && same_value(j_noexcept, j1));
 
+        // the recovering parser must not have reported an error either
+        assert(recovered_without_errors);
+
         try
         {
             // step 2.1: round trip without adding size annotations to container types
@@ -132,6 +143,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // parse errors are ok, because input may be random bytes
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
     catch (const json::type_error&)
     {
@@ -142,6 +154,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // out of range errors may happen if provided sizes are excessive
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
 
     // step 3: the other input adapters must read the data alike

tests/src/fuzzer-parse_bon8.cpp

@@ -17,6 +17,10 @@ array data, it performs the following steps:
 - j2 = from_bon8(vec)
 - assert(to_bon8(j2) == vec)
 
+Furthermore, it reads data with a SAX parser that recovers from every error
+and checks that the events are balanced, that reading ends, and that it
+reports an error exactly when from_bon8() fails (see #3989).
+
 Finally, it reads the data from a stream, a non-contiguous iterator range, and
 a FILE*, which read byte by byte, and checks that each gives the same value or
 error (id, message, byte position) as the pointer range, which takes the bulk
@@ -27,6 +31,7 @@ drivers.
 */
 
 #include "fuzzer_common.hpp"
+#include "fuzzer-recovering_checker.hpp"
 
 namespace
 {
@@ -44,6 +49,9 @@ struct read_bon8
 // see http://llvm.org/docs/LibFuzzer.html
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 {
+    // recover from all errors, reading from memory and from a stream
+    const bool recovered_without_errors = check_recovering_parse(data, size, json::input_format_t::bon8).errors == 0;
+
     std::vector<uint8_t> const vec1(data, data + size);
 
     // step 0: parse input without exceptions
@@ -62,6 +70,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
         // without exceptions, the same input must give the same value
         assert(!noexcept_threw && !j_noexcept.is_discarded() && same_value(j_noexcept, j1));
 
+        // the recovering parser must not have reported an error either
+        assert(recovered_without_errors);
+
         try
         {
             // step 2: round trip
@@ -83,6 +94,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // parse errors are ok, because input may be random bytes
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
     catch (const json::type_error&)
     {
@@ -93,6 +105,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // out of range errors may happen if provided sizes are excessive
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
 
     // step 3: the other input adapters must read the data alike

tests/src/fuzzer-parse_bson.cpp

@@ -17,6 +17,10 @@ array data, it performs the following steps:
 - j2 = from_bson(vec)
 - assert(to_bson(j2) == vec)
 
+Furthermore, it reads data with a SAX parser that recovers from every error
+and checks that the events are balanced, that reading ends, and that it
+reports an error exactly when from_bson() fails (see #3989).
+
 Finally, it reads the data from a stream, a non-contiguous iterator range, and
 a FILE*, which read byte by byte, and checks that each gives the same value or
 error (id, message, byte position) as the pointer range, which takes the bulk
@@ -27,6 +31,7 @@ drivers.
 */
 
 #include "fuzzer_common.hpp"
+#include "fuzzer-recovering_checker.hpp"
 
 namespace
 {
@@ -44,6 +49,9 @@ struct read_bson
 // see http://llvm.org/docs/LibFuzzer.html
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 {
+    // recover from all errors, reading from memory and from a stream
+    const bool recovered_without_errors = check_recovering_parse(data, size, json::input_format_t::bson).errors == 0;
+
     std::vector<uint8_t> const vec1(data, data + size);
 
     // step 0: parse input without exceptions
@@ -62,6 +70,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
         // without exceptions, the same input must give the same value
         assert(!noexcept_threw && !j_noexcept.is_discarded() && same_value(j_noexcept, j1));
 
+        // the recovering parser must not have reported an error either
+        assert(recovered_without_errors);
+
         try
         {
             // step 2: round trip
@@ -83,6 +94,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // parse errors are ok, because input may be random bytes
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
     catch (const json::type_error&)
     {
@@ -93,6 +105,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // out of range errors can occur during parsing, too
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
 
     // step 3: the other input adapters must read the data alike

tests/src/fuzzer-parse_cbor.cpp

@@ -17,6 +17,10 @@ array data, it performs the following steps:
 - j2 = from_cbor(vec)
 - assert(to_cbor(j2) == vec)
 
+Furthermore, it reads data with a SAX parser that recovers from every error
+and checks that the events are balanced, that reading ends, and that it
+reports an error exactly when from_cbor() fails (see #3989).
+
 Finally, it reads the data from a stream, a non-contiguous iterator range, and
 a FILE*, which read byte by byte, and checks that each gives the same value or
 error (id, message, byte position) as the pointer range, which takes the bulk
@@ -27,6 +31,7 @@ drivers.
 */
 
 #include "fuzzer_common.hpp"
+#include "fuzzer-recovering_checker.hpp"
 
 namespace
 {
@@ -44,6 +49,9 @@ struct read_cbor
 // see http://llvm.org/docs/LibFuzzer.html
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 {
+    // recover from all errors, reading from memory and from a stream
+    const bool recovered_without_errors = check_recovering_parse(data, size, json::input_format_t::cbor).errors == 0;
+
     std::vector<uint8_t> const vec1(data, data + size);
 
     // step 0: parse input without exceptions
@@ -62,6 +70,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
         // without exceptions, the same input must give the same value
         assert(!noexcept_threw && !j_noexcept.is_discarded() && same_value(j_noexcept, j1));
 
+        // the recovering parser must not have reported an error either
+        assert(recovered_without_errors);
+
         try
         {
             // step 2: round trip
@@ -83,6 +94,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // parse errors are ok, because input may be random bytes
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
     catch (const json::type_error&)
     {
@@ -93,6 +105,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // out of range errors can occur during parsing, too
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
 
     // step 3: the other input adapters must read the data alike

tests/src/fuzzer-parse_json.cpp

@@ -24,11 +24,16 @@ array data, it performs the following steps:
 The pointer range takes the bulk fast paths, the other input adapters read byte
 by byte; see check_input_adapters().
 
+Furthermore, it parses data with a SAX parser that recovers from every error
+and checks that the events are balanced, that parsing ends, and that valid
+input is parsed without errors (see #3989).
+
 The provided function `LLVMFuzzerTestOneInput` can be used in different fuzzer
 drivers.
 */
 
 #include "fuzzer_common.hpp"
+#include "fuzzer-recovering_checker.hpp"
 
 namespace
 {
@@ -59,6 +64,13 @@ struct accept_json
 // see http://llvm.org/docs/LibFuzzer.html
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 {
+    // recover from all errors, reading from memory and from a stream
+    {
+        const auto checker = check_recovering_parse(data, size, json::input_format_t::json);
+        assert(checker.events <= (4 * size) + 4);
+        assert((checker.errors == 0) == json::accept(data, data + size));
+    }
+
     // step 0: parse input without exceptions
     bool noexcept_threw = false;
     json const j_noexcept = parse_without_exceptions([&] { return json::parse(data, data + size, nullptr, false); }, noexcept_threw);

tests/src/fuzzer-parse_msgpack.cpp

@@ -17,6 +17,10 @@ array data, it performs the following steps:
 - j2 = from_msgpack(vec)
 - assert(to_msgpack(j2) == vec)
 
+Furthermore, it reads data with a SAX parser that recovers from every error
+and checks that the events are balanced, that reading ends, and that it
+reports an error exactly when from_msgpack() fails (see #3989).
+
 Finally, it reads the data from a stream, a non-contiguous iterator range, and
 a FILE*, which read byte by byte, and checks that each gives the same value or
 error (id, message, byte position) as the pointer range, which takes the bulk
@@ -27,6 +31,7 @@ drivers.
 */
 
 #include "fuzzer_common.hpp"
+#include "fuzzer-recovering_checker.hpp"
 
 namespace
 {
@@ -44,6 +49,9 @@ struct read_msgpack
 // see http://llvm.org/docs/LibFuzzer.html
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 {
+    // recover from all errors, reading from memory and from a stream
+    const bool recovered_without_errors = check_recovering_parse(data, size, json::input_format_t::msgpack).errors == 0;
+
     std::vector<uint8_t> const vec1(data, data + size);
 
     // step 0: parse input without exceptions
@@ -62,6 +70,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
         // without exceptions, the same input must give the same value
         assert(!noexcept_threw && !j_noexcept.is_discarded() && same_value(j_noexcept, j1));
 
+        // the recovering parser must not have reported an error either
+        assert(recovered_without_errors);
+
         try
         {
             // step 2: round trip
@@ -83,6 +94,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // parse errors are ok, because input may be random bytes
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
     catch (const json::type_error&)
     {
@@ -93,6 +105,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // out of range errors may happen if provided sizes are excessive
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
 
     // step 3: the other input adapters must read the data alike

tests/src/fuzzer-parse_ubjson.cpp

@@ -26,6 +26,10 @@ array data, it performs the following steps:
 The unit tests run the same checks on a fixed corpus (see the "UBJSON round-trip
 invariants" test case), so keep both in sync.
 
+Furthermore, it reads data with a SAX parser that recovers from every error
+and checks that the events are balanced, that reading ends, and that it
+reports an error exactly when from_ubjson() fails (see #3989).
+
 Finally, it reads the data from a stream, a non-contiguous iterator range, and
 a FILE*, which read byte by byte, and checks that each gives the same value or
 error (id, message, byte position) as the pointer range, which takes the bulk
@@ -36,6 +40,7 @@ drivers.
 */
 
 #include "fuzzer_common.hpp"
+#include "fuzzer-recovering_checker.hpp"
 
 namespace
 {
@@ -53,6 +58,9 @@ struct read_ubjson
 // see http://llvm.org/docs/LibFuzzer.html
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
 {
+    // recover from all errors, reading from memory and from a stream
+    const bool recovered_without_errors = check_recovering_parse(data, size, json::input_format_t::ubjson).errors == 0;
+
     std::vector<uint8_t> const vec1(data, data + size);
 
     // step 0: parse input without exceptions
@@ -71,6 +79,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
         // without exceptions, the same input must give the same value
         assert(!noexcept_threw && !j_noexcept.is_discarded() && same_value(j_noexcept, j1));
 
+        // the recovering parser must not have reported an error either
+        assert(recovered_without_errors);
+
         try
         {
             // step 2.1: round trip without adding size annotations to container types
@@ -102,6 +113,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // parse errors are ok, because input may be random bytes
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
     catch (const json::type_error&)
     {
@@ -112,6 +124,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     {
         // out of range errors may happen if provided sizes are excessive
         assert(parsed || noexcept_threw || j_noexcept.is_discarded());
+        assert(parsed || !recovered_without_errors);
     }
 
     // step 3: the other input adapters must read the data alike

tests/src/fuzzer-recovering_checker.hpp

@@ -0,0 +1,154 @@
+//     __ _____ _____ _____
+//  __|  |   __|     |   | |  JSON for Modern C++ (supporting code)
+// |  |  |__   |  |  | | | |  version 3.12.0
+// |_____|_____|_____|_|___|  https://github.com/nlohmann/json
+//
+// SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
+// SPDX-License-Identifier: MIT
+
+#pragma once
+
+#include <cassert>
+#include <cstddef>
+#include <cstdint>
+#include <sstream>
+#include <string>
+#include <vector>
+#include <nlohmann/json.hpp>
+
+namespace
+{
+// a SAX parser that recovers from every error and checks that the events are
+// balanced and that every key is followed by exactly one value
+class recovering_checker : public nlohmann::json_sax<nlohmann::json>
+{
+  public:
+    bool null() override
+    {
+        return value();
+    }
+
+    bool boolean(bool /*val*/) override
+    {
+        return value();
+    }
+
+    bool number_integer(number_integer_t /*val*/) override
+    {
+        return value();
+    }
+
+    bool number_unsigned(number_unsigned_t /*val*/) override
+    {
+        return value();
+    }
+
+    bool number_float(number_float_t /*val*/, const string_t& /*s*/) override
+    {
+        return value();
+    }
+
+    bool string(string_t& /*val*/) override
+    {
+        return value();
+    }
+
+    bool binary(binary_t& /*val*/) override
+    {
+        return value();
+    }
+
+    bool start_object(std::size_t /*elements*/) override
+    {
+        value();
+        stack.push_back('o');
+        return true;
+    }
+
+    bool key(string_t& /*val*/) override
+    {
+        ++events;
+        assert(!stack.empty() && stack.back() == 'o');
+        stack.back() = 'v';
+        return true;
+    }
+
+    bool end_object() override
+    {
+        ++events;
+        assert(!stack.empty() && stack.back() == 'o');
+        stack.pop_back();
+        return true;
+    }
+
+    bool start_array(std::size_t /*elements*/) override
+    {
+        value();
+        stack.push_back('a');
+        return true;
+    }
+
+    bool end_array() override
+    {
+        ++events;
+        assert(!stack.empty() && stack.back() == 'a');
+        stack.pop_back();
+        return true;
+    }
+
+    bool parse_error(std::size_t /*position*/, const std::string& /*last_token*/, const nlohmann::detail::exception& /*ex*/) override
+    {
+        ++errors;
+        return true;
+    }
+
+    bool complete() const
+    {
+        return stack.empty();
+    }
+
+    std::size_t events = 0;
+    std::size_t errors = 0;
+
+  private:
+    bool value()
+    {
+        ++events;
+        if (!stack.empty())
+        {
+            // an array element, or the value of a key
+            assert(stack.back() != 'o');
+            if (stack.back() == 'v')
+            {
+                stack.back() = 'o';
+            }
+        }
+        return true;
+    }
+
+    // 'a' for an array, 'o' for an object that expects a key, 'v' for an
+    // object that expects the value of a key
+    std::vector<char> stack {}; // NOLINT(readability-redundant-member-init)
+};
+
+/// parses @a data with a recovering_checker from memory and from a stream,
+/// checks that both see the same, that the events are balanced, and that the
+/// number of errors is bounded, and returns the checker (see #3989)
+inline recovering_checker check_recovering_parse(const std::uint8_t* data, const std::size_t size, const nlohmann::json::input_format_t format)
+{
+    recovering_checker checker;
+    const bool ok = nlohmann::json::sax_parse(data, data + size, &checker, format);
+    assert(checker.complete());
+    assert(checker.errors <= size + 1);
+    assert(ok == (checker.errors == 0));
+
+    std::istringstream stream(std::string(reinterpret_cast<const char*>(data), size));
+    recovering_checker stream_checker;
+    assert(nlohmann::json::sax_parse(stream, &stream_checker, format) == ok);
+    assert(stream_checker.complete());
+    assert(stream_checker.events == checker.events);
+    assert(stream_checker.errors == checker.errors);
+
+    return checker;
+}
+} // namespace

tests/src/sax_event_loggers.hpp

@@ -131,11 +131,13 @@ struct SaxEventLogger : public nlohmann::json_sax<nlohmann::json>
     {
         errored = true;
         events.push_back("parse_error(" + std::to_string(position) + ")");
-        return false;
+        return recover;
     }
 
     std::vector<std::string> events {}; // NOLINT(readability-redundant-member-init)
     bool errored = false;
+    /// whether parse_error() asks the parser to recover from the error (see #3989)
+    bool recover = false;
 };
 
 struct SaxEventLoggerExitAfterStartObject : public SaxEventLogger

tests/src/unit-alt-string.cpp

@@ -415,6 +415,46 @@ TEST_CASE("alternative string type")
         CHECK(j2.dump() == R"({"/foo/0":"bar","/foo/1":"baz"})");
     }
 
+    SECTION("error recovery")
+    {
+        // a SAX parser that recovers from every error (see #3989)
+        struct recovering_parser : nlohmann::detail::json_sax_dom_parser<alt_json>
+        {
+            explicit recovering_parser(alt_json& j)
+                : nlohmann::detail::json_sax_dom_parser<alt_json>(j, false)
+            {}
+
+            // sax_parse() calls the SAX parser's own parse_error(), so hiding
+            // the one of the base class is what recovering takes
+            // NOLINTNEXTLINE(bugprone-derived-method-shadowing-base-method)
+            bool parse_error(std::size_t /*unused*/, const std::string& /*unused*/, const nlohmann::detail::exception& /*unused*/)
+            {
+                ++errors;
+                return true;
+            }
+
+            std::size_t errors = 0;
+        };
+
+        alt_json j;
+        recovering_parser sax(j);
+        // not inside CHECK(): MSVC reads the escape in a stringized raw string
+        const std::string input = R"([1., "a\qb", tru, {"k" 2}])";
+        CHECK(!alt_json::sax_parse(input, &sax));
+        CHECK(sax.errors == 4);
+        CHECK(j.dump() == R"([1,"aqb",null,{"k":2}])");
+
+        // a UBJSON high-precision number, a CBOR key that is not a string
+        alt_json u;
+        recovering_parser ubjson_sax(u);
+        CHECK(!alt_json::sax_parse(std::vector<std::uint8_t> {'[', 'H', 'i', 2, '1', '.', ']'}, &ubjson_sax, alt_json::input_format_t::ubjson));
+        CHECK(u.dump() == "[1]");
+        alt_json c;
+        recovering_parser cbor_sax(c);
+        CHECK(!alt_json::sax_parse(std::vector<std::uint8_t> {0xA2, 0x01, 0x02, 0x61, 'a', 0x03}, &cbor_sax, alt_json::input_format_t::cbor));
+        CHECK(c.dump() == R"({"a":3})");
+    }
+
     SECTION("conversion between basic_json specializations (#2649)")
     {
         // explicit conversions are always possible

tests/src/unit-bjdata.cpp

@@ -2916,35 +2916,6 @@ TEST_CASE("BJData")
                 CHECK(json::from_bjdata(out_single_ok) == json({{"_ArrayType_", "single"}, {"_ArraySize_", {2, 1}}, {"_ArrayData_", {1.5f, -1.5f}}}));
             }
 
-            SECTION("ndarray with _ArrayType_ \"char\" is limited to 0..127")
-            {
-                // both BJData drafts limit a char to 0..127; larger values must not
-                // be written as 'C' elements (the reader rejects them), so such an
-                // object stays a plain object that round-trips
-                for (const auto version :
-                        {
-                            json::bjdata_version_t::draft2, json::bjdata_version_t::draft3
-                        })
-                {
-                    json const j_ok = json({{"_ArrayType_", "char"}, {"_ArraySize_", {2, 2}}, {"_ArrayData_", {0, 97, 98, 127}}});
-                    const auto out_ok = json::to_bjdata(j_ok, true, true, version);
-                    CHECK(out_ok == std::vector<uint8_t>({'[', '$', 'C', '#', '[', '$', 'i', '#', 'i', 2, 2, 2, 0, 97, 98, 127}));
-                    CHECK(json::from_bjdata(out_ok) == j_ok);
-
-                    for (const int bad :
-                            {
-                                128, 200, 255, 256, -1
-                            })
-                    {
-                        CAPTURE(bad)
-                        json const j_bad = json({{"_ArrayType_", "char"}, {"_ArraySize_", {2, 2}}, {"_ArrayData_", {97, 98, 99, bad}}});
-                        const auto out_bad = json::to_bjdata(j_bad, true, true, version);
-                        CHECK(out_bad.at(0) == '{');
-                        CHECK(json::from_bjdata(out_bad) == j_bad);
-                    }
-                }
-            }
-
             SECTION("ndarray annotation keys are read back in the documented order")
             {
                 // from_bjdata() must emit the annotation object's keys in the order
@@ -3163,7 +3134,7 @@ TEST_CASE("BJData")
                 std::vector<uint8_t> const v1 = {'[', '#', 'i', 0xF1};
                 std::vector<uint8_t> const v2 = {'[', '$', 'I', '#', 'i', 0xF2};
                 std::vector<uint8_t> const v3 = {'[', '$', 'I', '#', '[', 'i', 0xF4, 'i', 0x02, ']'};
-                std::vector<uint8_t> const v4 = {'[', '$', 'l', '#', 'i', 0xF7};
+                std::vector<uint8_t> const v4 = {'[', '$', 0xF6, '#', 'i', 0xF7};
                 std::vector<uint8_t> const v5 = {'[', '$', 'I', '#', '[', 'i', 0xF5, 'i', 0xF1, ']'};
                 std::vector<uint8_t> const v6 = {'[', '#', '[', 'i', 0xF3, 'i', 0x02, ']'};
 
@@ -3353,44 +3324,6 @@ TEST_CASE("BJData")
                 }
             }
 
-            SECTION("ndarray of half-precision floats can be read")
-            {
-                // the 'h' element type is read as _ArrayType_ "half"
-                json _;
-                const std::vector<uint8_t> half = {'[', '$', 'h', '#', '[', '$', 'U', '#', 'U', 2, 2, 2, 0x00, 0x3C, 0x00, 0x40, 0x00, 0x42, 0x00, 0x44};
-                const json j_half = json::parse(R"({"_ArrayType_":"half","_ArraySize_":[2,2],"_ArrayData_":[1.0,2.0,3.0,4.0]})");
-                CHECK(json::from_bjdata(half) == j_half);
-
-                // the writer does not pack "half": it writes a plain object that reads back equal
-                CHECK(json::from_bjdata(json::to_bjdata(j_half)) == j_half);
-                CHECK(json::from_bjdata(json::to_bjdata(j_half, true, true, json::bjdata_version_t::draft3)) == j_half);
-
-                // truncated half data
-                CHECK_THROWS_AS(_ = json::from_bjdata(std::vector<uint8_t>(half.begin(), half.end() - 1)), json::parse_error&);
-            }
-
-            SECTION("ndarray of char rejects values above 127")
-            {
-                json _;
-                const std::vector<uint8_t> ok = {'[', '$', 'C', '#', '[', '$', 'U', '#', 'U', 2, 2, 2, 'a', 'b', 'c', 0x7F};
-                CHECK(json::from_bjdata(ok) == json::parse(R"({"_ArrayType_":"char","_ArraySize_":[2,2],"_ArrayData_":[97,98,99,127]})"));
-
-                std::vector<uint8_t> bad = ok;
-                bad.back() = 0xC8;
-                CHECK_THROWS_AS(_ = json::from_bjdata(bad), json::parse_error&);
-                CHECK(json::from_bjdata(bad, true, false).is_discarded());
-
-                // the same restriction holds for 1-D arrays
-                CHECK_THROWS_AS(_ = json::from_bjdata(std::vector<uint8_t>({'[', '$', 'C', '#', 'i', 1, 0xC8})), json::parse_error&);
-
-                // truncated input
-                CHECK_THROWS_AS(_ = json::from_bjdata(std::vector<uint8_t>(ok.begin(), ok.end() - 1)), json::parse_error&);
-
-                // 'B' (byte) elements may use the full range
-                const std::vector<uint8_t> byte_nd = {'[', '$', 'B', '#', '[', '$', 'U', '#', 'U', 2, 2, 2, 1, 2, 3, 0xC8};
-                CHECK(json::from_bjdata(byte_nd) == json::parse(R"({"_ArrayType_":"byte","_ArraySize_":[2,2],"_ArrayData_":[1,2,3,200]})"));
-            }
-
             SECTION("do not accept NTFZ markers in ndarray optimized type (with count)")
             {
                 json _;
@@ -3522,7 +3455,7 @@ TEST_CASE("BJData")
             CHECK(json::from_bjdata(v0, true, false).is_discarded());
 
             std::vector<uint8_t> const vi = {'[', '$', '#'};
-            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vi), "[json.exception.parse_error.112] parse error at byte 3: syntax error while parsing BJData type: marker 0x23 is not a permitted optimized array type", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vi), "[json.exception.parse_error.110] parse error at byte 4: syntax error while parsing BJData value: unexpected end of input", json::parse_error&);
             CHECK(json::from_bjdata(vi, true, false).is_discarded());
 
             std::vector<uint8_t> const vU = {'[', '$', 'U'};
@@ -4689,60 +4622,3 @@ TEST_CASE("BJData large strings and binaries (chunked reader)")
         }
     }
 }
-
-TEST_CASE("BJData optimized container type marker is validated for count 0")
-{
-    // the '$' type marker must be a legal marker even if no element follows
-    SECTION("invalid marker")
-    {
-        // 'Z', 'T', 'F', 'N', 'S', 'H', '[' and '{' are excluded in BJData
-        for (const char marker :
-                {'x', 'E', 'Z', 'T', 'F', 'N', 'S', 'H', '[', '{'
-                })
-        {
-            for (const char open :
-                    {'[', '{'
-                    })
-            {
-                for (const int count :
-                        {
-                            0, 1
-                        })
-                {
-                    CAPTURE(marker)
-                    CAPTURE(open)
-                    CAPTURE(count)
-                    const std::vector<std::uint8_t> v = {static_cast<std::uint8_t>(open), '$', static_cast<std::uint8_t>(marker), '#', 'i', static_cast<std::uint8_t>(count)};
-                    json _;
-                    CHECK_THROWS_AS(_ = json::from_bjdata(v), json::parse_error&);
-                    CHECK(json::from_bjdata(v, true, false).is_discarded());
-                }
-            }
-        }
-    }
-
-    SECTION("error message")
-    {
-        const std::vector<std::uint8_t> v = {'[', '$', 'x', '#', 'i', 0};
-        json _;
-        CHECK_THROWS_WITH_AS(_ = json::from_bjdata(v), "[json.exception.parse_error.112] parse error at byte 3: syntax error while parsing BJData type: marker 0x78 is not a permitted optimized array type", json::parse_error&);
-    }
-
-    SECTION("valid marker")
-    {
-        for (const char marker :
-                {'i', 'U', 'I', 'u', 'l', 'm', 'L', 'M', 'h', 'd', 'D', 'C'
-                })
-        {
-            CAPTURE(marker)
-            const std::vector<std::uint8_t> va = {'[', '$', static_cast<std::uint8_t>(marker), '#', 'i', 0};
-            const std::vector<std::uint8_t> vo = {'{', '$', static_cast<std::uint8_t>(marker), '#', 'i', 0};
-            CHECK(json::from_bjdata(va) == json::array());
-            CHECK(json::from_bjdata(vo) == json::object());
-        }
-
-        // an optimized array of bytes is read as a binary value
-        const std::vector<std::uint8_t> vb = {'[', '$', 'B', '#', 'i', 0};
-        CHECK(json::from_bjdata(vb) == json::binary({}));
-    }
-}

tests/src/unit-bson.cpp

@@ -802,11 +802,12 @@ TEST_CASE("BSON")
             CHECK(json::from_bson(result, true, false) == j);
         }
 
-        SECTION("binary member with subtype 0x02 (old binary) carries an inner length")
+        SECTION("binary member with subtype 0x02 (old binary) keeps its inner length prefix (lenient parsing)")
         {
-            // the payload of binary subtype 0x02 ("old binary") starts with an
+            // documented lenient behavior (see gh-5333): the payload for
-            // int32 that repeats the payload size; the bytes below are what
+            // binary subtype 0x02 ("old binary") is returned as-is,
-            // pymongo and the bson-corpus (binary.json) use
+            // including its own inner 4-byte length prefix; it is not
+            // stripped or reinterpreted
             std::vector<std::uint8_t> const input =
             {
                 0x17, 0x00, 0x00, 0x00, // size (little endian)
@@ -814,87 +815,16 @@ TEST_CASE("BSON")
 
                 0x06, 0x00, 0x00, 0x00, // size of binary (little endian)
                 0x02, // "old binary" subtype
-                0x02, 0x00, 0x00, 0x00, // inner length
+                0x02, 0x00, 0x00, 0x00, // inner length prefix (part of the old-binary payload)
                 0x68, 0x69, // payload ('h', 'i')
 
                 0x00 // end marker
             };
 
-            // the inner length is not part of the payload
+            // the inner length prefix is part of the (unmodified) payload
-            const json expected = { { "entry", json::binary({0x68, 0x69}, 0x02) } };
+            const std::vector<std::uint8_t> expected_payload = {0x02, 0x00, 0x00, 0x00, 0x68, 0x69};
+            const json expected = { { "entry", json::binary(expected_payload, 0x02) } };
             CHECK(json::from_bson(input) == expected);
-            CHECK(json::to_bson(expected) == input);
-            CHECK(json::from_bson(json::to_bson(expected)) == expected);
-        }
-
-        SECTION("binary member with subtype 0x02 (old binary) and empty payload")
-        {
-            std::vector<std::uint8_t> const input =
-            {
-                0x15, 0x00, 0x00, 0x00, // size (little endian)
-                0x05, 'e', 'n', 't', 'r', 'y', '\x00', // entry: binary
-                0x04, 0x00, 0x00, 0x00, // size of binary (little endian)
-                0x02, // "old binary" subtype
-                0x00, 0x00, 0x00, 0x00, // inner length
-                0x00 // end marker
-            };
-
-            const json expected = { { "entry", json::binary({}, 0x02) } };
-            CHECK(json::from_bson(input) == expected);
-            CHECK(json::to_bson(expected) == input);
-        }
-
-        SECTION("binary member with subtype 0x02 (old binary) with an invalid inner length")
-        {
-            std::vector<std::uint8_t> input =
-            {
-                0x17, 0x00, 0x00, 0x00, // size (little endian)
-                0x05, 'e', 'n', 't', 'r', 'y', '\x00', // entry: binary
-                0x06, 0x00, 0x00, 0x00, // size of binary (little endian)
-                0x02, // "old binary" subtype
-                0x02, 0x00, 0x00, 0x00, // inner length
-                0x68, 0x69, // payload ('h', 'i')
-                0x00 // end marker
-            };
-
-            SECTION("inner length too long")
-            {
-                input[19] = 0x03;
-            }
-
-            SECTION("inner length too short")
-            {
-                input[19] = 0x01;
-            }
-
-            SECTION("inner length negative")
-            {
-                input[19] = 0xFF;
-                input[20] = 0xFF;
-                input[21] = 0xFF;
-                input[22] = 0xFF;
-            }
-
-            CAPTURE(input)
-            json _;
-            CHECK_THROWS_AS(_ = json::from_bson(input), json::parse_error&);
-        }
-
-        SECTION("binary member with subtype 0x02 (old binary) without an inner length")
-        {
-            // the payload is shorter than the inner length field
-            std::vector<std::uint8_t> const input =
-            {
-                0x14, 0x00, 0x00, 0x00, // size (little endian)
-                0x05, 'e', 'n', 't', 'r', 'y', '\x00', // entry: binary
-                0x03, 0x00, 0x00, 0x00, // size of binary (little endian)
-                0x02, // "old binary" subtype
-                0x01, 0x02, 0x03, // payload without an inner length
-                0x00 // end marker
-            };
-
-            json _;
-            CHECK_THROWS_AS(_ = json::from_bson(input), json::parse_error&);
         }
 
         SECTION("Some more complex document")
@@ -1248,7 +1178,7 @@ TEST_CASE("BSON document size mismatch")
     SECTION("top-level document with a negative size")
     {
         std::vector<std::uint8_t> const input = {0xFF, 0xFF, 0xFF, 0xFF, 0x00};
-        CHECK_THROWS_WITH_AS(_ = json::from_bson(input), "[json.exception.parse_error.112] parse error at byte 4: syntax error while parsing BSON document: document size -1 is less than 5", json::parse_error&);
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(input), "[json.exception.parse_error.112] parse error at byte 5: syntax error while parsing BSON document: document size -1 does not match the number of bytes read (5)", json::parse_error&);
         CHECK(json::from_bson(input, true, false).is_discarded());
     }
 
@@ -1260,7 +1190,7 @@ TEST_CASE("BSON document size mismatch")
         // enclosing document instead of "d"
         std::vector<std::uint8_t> const input =
         {
-            0x14, 0x00, 0x00, 0x00, // outer size
+            0x00, 0x00, 0x00, 0x00, // outer size
             0x03, 'd', 0x00,        // entry: embedded document "d"
             0xFF, 0xFF, 0xFF, 0x7F, //   embedded size 0x7FFFFFFF
             0x0A, 'a', 0x00,        //   entry: null "a"
@@ -1268,24 +1198,7 @@ TEST_CASE("BSON document size mismatch")
             0x08, 'h', 0x00, 0x01,  // entry: bool "h" = true
             0x00                    // outer end marker
         };
-        CHECK_THROWS_WITH_AS(_ = json::from_bson(input), "[json.exception.parse_error.112] parse error at byte 11: syntax error while parsing BSON document: document size 2147483647 exceeds the size of the enclosing document", json::parse_error&);
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(input), "[json.exception.parse_error.112] parse error at byte 15: syntax error while parsing BSON document: document size 2147483647 does not match the number of bytes read (8)", json::parse_error&);
-        CHECK(json::from_bson(input, true, false).is_discarded());
-    }
-
-    SECTION("embedded document whose size is smaller than its content")
-    {
-        // {"a":null} is 8 bytes, but the length prefix claims 7
-        std::vector<std::uint8_t> const input =
-        {
-            0x14, 0x00, 0x00, 0x00, // outer size
-            0x03, 'd', 0x00,        // entry: embedded document "d"
-            0x07, 0x00, 0x00, 0x00, //   embedded size 7 (real is 8)
-            0x0A, 'a', 0x00,        //   entry: null "a"
-            0x00,                   //   embedded end marker
-            0x08, 'h', 0x00, 0x01,  // entry: bool "h" = true
-            0x00                    // outer end marker
-        };
-        CHECK_THROWS_WITH_AS(_ = json::from_bson(input), "[json.exception.parse_error.112] parse error at byte 15: syntax error while parsing BSON document: document size 7 does not match the number of bytes read (8)", json::parse_error&);
         CHECK(json::from_bson(input, true, false).is_discarded());
     }
 
@@ -1294,163 +1207,18 @@ TEST_CASE("BSON document size mismatch")
         // array [42] is 12 bytes, but the length prefix claims 13
         std::vector<std::uint8_t> const input =
         {
-            0x14, 0x00, 0x00, 0x00, // outer size
+            0x00, 0x00, 0x00, 0x00, // outer size
             0x04, 'a', 0x00,        // entry: array "a"
             0x0D, 0x00, 0x00, 0x00, //   array size 13 (real is 12)
             0x10, '0', 0x00, 0x2A, 0x00, 0x00, 0x00, //   entry: int32 "0" = 42
             0x00,                   //   array end marker
             0x00                    // outer end marker
         };
-        CHECK_THROWS_WITH_AS(_ = json::from_bson(input), "[json.exception.parse_error.112] parse error at byte 11: syntax error while parsing BSON document: document size 13 exceeds the size of the enclosing document", json::parse_error&);
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(input), "[json.exception.parse_error.112] parse error at byte 19: syntax error while parsing BSON document: document size 13 does not match the number of bytes read (12)", json::parse_error&);
         CHECK(json::from_bson(input, true, false).is_discarded());
     }
 }
 
-TEST_CASE("BSON declared document size bounds the content")
-{
-    // records the events that a SAX parser receives
-    struct recorder : nlohmann::json_sax<json>
-    {
-        std::string events {};
-
-        bool null() override
-        {
-            events += "null ";
-            return true;
-        }
-        bool boolean(bool /*val*/) override
-        {
-            events += "boolean ";
-            return true;
-        }
-        bool number_integer(json::number_integer_t /*val*/) override
-        {
-            events += "integer ";
-            return true;
-        }
-        bool number_unsigned(json::number_unsigned_t /*val*/) override
-        {
-            events += "unsigned ";
-            return true;
-        }
-        bool number_float(json::number_float_t /*val*/, const std::string& /*s*/) override
-        {
-            events += "float ";
-            return true;
-        }
-        bool string(std::string& /*val*/) override
-        {
-            events += "string ";
-            return true;
-        }
-        bool binary(json::binary_t& /*val*/) override
-        {
-            events += "binary ";
-            return true;
-        }
-        bool start_object(std::size_t /*elements*/) override
-        {
-            events += "{ ";
-            return true;
-        }
-        bool key(std::string& /*val*/) override
-        {
-            events += "key ";
-            return true;
-        }
-        bool end_object() override
-        {
-            events += "} ";
-            return true;
-        }
-        bool start_array(std::size_t /*elements*/) override
-        {
-            events += "[ ";
-            return true;
-        }
-        bool end_array() override
-        {
-            events += "] ";
-            return true;
-        }
-        bool parse_error(std::size_t /*position*/, const std::string& /*last_token*/, const json::exception& /*ex*/) override
-        {
-            events += "error ";
-            return false;
-        }
-    };
-
-    SECTION("the content of a too small document is not reported")
-    {
-        // {"a":1} is 12 bytes; the length prefix claims 5, so the element
-        // does not fit
-        std::vector<std::uint8_t> const input =
-        {
-            0x05, 0x00, 0x00, 0x00,
-            0x10, 'a', 0x00, 0x01, 0x00, 0x00, 0x00,
-            0x00
-        };
-        recorder rec;
-        CHECK(!json::sax_parse(input, &rec, json::input_format_t::bson));
-        CHECK(rec.events == "{ error ");
-
-        // also without strict mode
-        recorder rec2;
-        CHECK(!json::sax_parse(input, &rec2, json::input_format_t::bson, false));
-        CHECK(rec2.events == "{ error ");
-    }
-
-    SECTION("an embedded document that does not fit its parent is not opened")
-    {
-        // the embedded document ends where the enclosing one does, so there
-        // is no room for the terminator of the enclosing document
-        std::vector<std::uint8_t> const input =
-        {
-            0x0C, 0x00, 0x00, 0x00,
-            0x03, 'd', 0x00,
-            0x05, 0x00, 0x00, 0x00, 0x00,
-            0x00
-        };
-        recorder rec;
-        CHECK(!json::sax_parse(input, &rec, json::input_format_t::bson));
-        CHECK(rec.events == "{ key error ");
-    }
-
-    SECTION("an embedded document that fits exactly")
-    {
-        std::vector<std::uint8_t> const input =
-        {
-            0x0D, 0x00, 0x00, 0x00,
-            0x03, 'd', 0x00,
-            0x05, 0x00, 0x00, 0x00, 0x00,
-            0x00
-        };
-        CHECK(json::from_bson(input) == json({{"d", json::object()}}));
-    }
-
-    SECTION("a document size that is less than 5")
-    {
-        for (const std::int32_t size :
-                {
-                    0, 1, 4, -1, (std::numeric_limits<std::int32_t>::min)()
-                })
-        {
-            CAPTURE(size)
-            std::vector<std::uint8_t> input =
-            {
-                0x00, 0x00, 0x00, 0x00, 0x00
-            };
-            input[0] = static_cast<std::uint8_t>(size & 0xFF);
-            input[1] = static_cast<std::uint8_t>((size >> 8) & 0xFF);
-            input[2] = static_cast<std::uint8_t>((size >> 16) & 0xFF);
-            input[3] = static_cast<std::uint8_t>((size >> 24) & 0xFF);
-            json _;
-            CHECK_THROWS_AS(_ = json::from_bson(input), json::parse_error&);
-            CHECK(json::from_bson(input, true, false).is_discarded());
-        }
-    }
-}
-
 TEST_CASE("BSON nesting does not consume the call stack")
 {
     // An embedded document or array used to be read by calling back into the
@@ -2155,7 +1923,7 @@ TEST_CASE("Invalid document size handling")
     {
         std::vector<std::uint8_t> const v = {0x04, 0x00, 0x00, 0x00, 0x00};
         json _;
-        CHECK_THROWS_WITH_AS(_ = json::from_bson(v), "[json.exception.parse_error.112] parse error at byte 4: syntax error while parsing BSON document: document size 4 is less than 5", json::parse_error&);
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(v), "[json.exception.parse_error.112] parse error at byte 5: syntax error while parsing BSON document: document size 4 does not match the number of bytes read (5)", json::parse_error&);
         CHECK(json::from_bson(v, true, false).is_discarded());
     }
 
@@ -2170,7 +1938,7 @@ TEST_CASE("Invalid document size handling")
             0x00
         };
         json _;
-        CHECK_THROWS_WITH_AS(_ = json::from_bson(v), "[json.exception.parse_error.112] parse error at byte 5: syntax error while parsing BSON document: document size 5 is too small for its content", json::parse_error&);
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(v), "[json.exception.parse_error.112] parse error at byte 16: syntax error while parsing BSON document: document size 5 does not match the number of bytes read (16)", json::parse_error&);
         CHECK(json::from_bson(v, true, false).is_discarded());
     }
 
@@ -2201,7 +1969,7 @@ TEST_CASE("Invalid document size handling")
             0x00                                            // object terminator
         };
         json _;
-        CHECK_THROWS_WITH_AS(_ = json::from_bson(v), "[json.exception.parse_error.112] parse error at byte 12: syntax error while parsing BSON document: document size 5 is too small for its content", json::parse_error&);
+        CHECK_THROWS_WITH_AS(_ = json::from_bson(v), "[json.exception.parse_error.112] parse error at byte 19: syntax error while parsing BSON document: document size 5 does not match the number of bytes read (12)", json::parse_error&);
         CHECK(json::from_bson(v, true, false).is_discarded());
     }
 

tests/src/unit-cbor.cpp

@@ -1807,93 +1807,6 @@ TEST_CASE("CBOR")
             CHECK(json::from_cbor(std::vector<uint8_t>({0xa1, 0xff, 0x01}), true, false).is_discarded());
         }
 
-        SECTION("tag in front of a key")
-        {
-            const auto ignore = json::cbor_tag_handler_t::ignore;
-            const auto store = json::cbor_tag_handler_t::store;
-            const json expected = {{"a", 10}};
-
-            // the tags are skipped in front of a text string key, like in
-            // front of a value
-            const std::vector<std::vector<std::uint8_t>> tagged =
-            {
-                {0xA1, 0xC0, 0x61, 0x61, 0x0A},                         // tag in the head
-                {0xA1, 0xD8, 0x05, 0x61, 0x61, 0x0A},                   // 1-byte tag number
-                {0xA1, 0xD9, 0x01, 0x2C, 0x61, 0x61, 0x0A},             // 2-byte tag number
-                {0xA1, 0xDA, 0x00, 0x01, 0x00, 0x00, 0x61, 0x61, 0x0A}, // 4-byte tag number
-                {0xA1, 0xDB, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x61, 0x61, 0x0A}, // 8-byte tag number
-                {0xA1, 0xC0, 0xD8, 0x05, 0xC1, 0x61, 0x61, 0x0A},       // chained tags
-                {0xBF, 0xC0, 0x61, 0x61, 0x0A, 0xFF},                   // indefinite-length map
-                {0xBF, 0x61, 0x62, 0x01, 0xC0, 0x61, 0x61, 0x0A, 0xFF}, // second key tagged
-                {0xA1, 0xC0, 0x7F, 0x61, 0x61, 0xFF, 0x0A},             // indefinite-length text key
-                {0xA1, 0xC0, 0x61, 0x61, 0xC0, 0x0A},                   // tagged key and value
-            };
-
-            for (const auto& input : tagged)
-            {
-                CAPTURE(input)
-                json const j_ignore = json::from_cbor(input, true, true, ignore);
-                json const j_store = json::from_cbor(input, true, true, store);
-                CHECK(j_ignore.at("a") == 10);
-                CHECK(j_store.at("a") == 10);
-                CHECK(j_ignore == j_store);
-            }
-            CHECK(json::from_cbor(tagged[0], true, true, ignore) == expected);
-            CHECK(json::from_cbor(tagged[1], true, true, store) == expected);
-
-            // nested maps
-            CHECK(json::from_cbor(std::vector<std::uint8_t>({0xA1, 0xC0, 0x61, 0x61, 0xA1, 0xD8, 0x05, 0x61, 0x62, 0x01}), true, true, ignore) == json{{"a", {{"b", 1}}}});
-
-            // the tag handler error still rejects every tag
-            for (const auto& input : tagged)
-            {
-                CAPTURE(input)
-                json _;
-                CHECK_THROWS_AS(_ = json::from_cbor(input), json::parse_error&);
-            }
-            {
-                json _;
-                CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<std::uint8_t>({0xA1, 0xD8, 0x05, 0x61, 0x61, 0x0A})), "[json.exception.parse_error.113] parse error at byte 2: syntax error while parsing CBOR object key: only string keys are supported, but found a tag; last byte: 0xD8", json::parse_error&);
-            }
-
-            // a tag does not turn a key of another type into a text string
-            {
-                json _;
-                CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<std::uint8_t>({0xA1, 0xC0, 0x01, 0x01}), true, true, ignore), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing CBOR object key: only string keys are supported, but found an unsigned integer; last byte: 0x01", json::parse_error&);
-                CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<std::uint8_t>({0xA1, 0xD8, 0x05, 0x41, 0x61, 0x01}), true, true, store), "[json.exception.parse_error.113] parse error at byte 4: syntax error while parsing CBOR object key: only string keys are supported, but found a byte string; last byte: 0x41", json::parse_error&);
-                CHECK(json::from_cbor(std::vector<std::uint8_t>({0xA1, 0xC0, 0x01, 0x01}), true, false, ignore).is_discarded());
-            }
-
-            // end of input after the tag, or inside the tag number
-            {
-                json _;
-                CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<std::uint8_t>({0xA1, 0xC0}), true, true, ignore), "[json.exception.parse_error.110] parse error at byte 3: syntax error while parsing CBOR string: unexpected end of input", json::parse_error&);
-                CHECK_THROWS_AS(_ = json::from_cbor(std::vector<std::uint8_t>({0xA1, 0xD8}), true, true, ignore), json::parse_error&);
-                CHECK_THROWS_AS(_ = json::from_cbor(std::vector<std::uint8_t>({0xA1, 0xDB, 0x00, 0x00}), true, true, store), json::parse_error&);
-                CHECK_THROWS_AS(_ = json::from_cbor(std::vector<std::uint8_t>({0xBF, 0xC0}), true, true, store), json::parse_error&);
-            }
-
-            // SAX: the key event is reported without the tag (start_object,
-            // key, number_unsigned, end_object are four events)
-            {
-                const std::vector<std::uint8_t> input = {0xA1, 0xC0, 0x61, 0x61, 0x0A};
-                SaxCountdown four(4);
-                CHECK(json::sax_parse(input, &four, json::input_format_t::cbor, true, false, false, ignore));
-                SaxCountdown three(3);
-                CHECK(!json::sax_parse(input, &three, json::input_format_t::cbor, true, false, false, ignore));
-                SaxCountdown error_handler(4);
-                CHECK(!json::sax_parse(input, &error_handler, json::input_format_t::cbor));
-            }
-
-            // a long chain of tags needs no recursion
-            {
-                std::vector<std::uint8_t> input = {0xA1};
-                input.insert(input.end(), 100000, 0xC0);
-                input.insert(input.end(), {0x61, 0x61, 0x0A});
-                CHECK(json::from_cbor(input, true, true, ignore) == expected);
-            }
-        }
-
         SECTION("non-string key (see #2766 and #3381)")
         {
             // only text strings map to JSON object keys; any other key is
@@ -2002,10 +1915,9 @@ TEST_CASE("CBOR")
         {
             json _;
 
-            // with the default error handler keep, the chunks are concatenated
+            // the chunks are concatenated as is, without checking that each
-            // as is, without checking that each chunk is valid UTF-8 on its
+            // chunk is valid UTF-8 on its own (RFC 8949, Section 3.2.3), so
-            // own (RFC 8949, Section 3.2.3), so a code point split across two
+            // a code point split across two chunks yields a valid string
-            // chunks yields a valid string
             CHECK_NOTHROW(_ = json::from_cbor(std::vector<uint8_t>({0x7f, 0x61, 0xc3, 0x61, 0xa9, 0xff})));
             CHECK(_ == "\xc3\xa9");
             CHECK(_.dump() == "\"\xc3\xa9\"");
@@ -2025,63 +1937,6 @@ TEST_CASE("CBOR")
             CHECK(json::from_cbor(std::vector<uint8_t>({0x7f, 0x62, 0xc3, 0xa9, 0x62, 0xc3, 0xb6, 0xff})) == "\xc3\xa9\xc3\xb6");
         }
 
-        SECTION("ill-formed UTF-8 in a chunk of an indefinite-length string (RFC 8949, Section 3.2.3)")
-        {
-            const auto strict = json::error_handler_t::strict;
-            const auto replace = json::error_handler_t::replace;
-            const auto ignore = json::error_handler_t::ignore;
-            const auto keep = json::error_handler_t::keep;
-            const auto tags = json::cbor_tag_handler_t::error;
-
-            // a code point split over two chunks
-            const std::vector<std::uint8_t> split = {0x7f, 0x61, 0xc3, 0x61, 0xa9, 0xff};
-            // a 4-byte code point split over two chunks
-            const std::vector<std::uint8_t> split_emoji = {0x7f, 0x62, 0xf0, 0x9f, 0x62, 0x98, 0x80, 0xff};
-            // the same in an object key
-            const std::vector<std::uint8_t> split_key = {0xa1, 0x7f, 0x61, 0xc3, 0x61, 0xa9, 0xff, 0x01};
-            // a valid chunk followed by one with a truncated code point
-            const std::vector<std::uint8_t> truncated = {0x7f, 0x62, 0x41, 0xc3, 0x61, 0xa9, 0xff};
-
-            // strict: the string is invalid
-            for (const auto& input :
-                    {
-                        split, split_emoji, split_key, truncated
-                    })
-            {
-                CAPTURE(input)
-                json _;
-                CHECK_THROWS_AS(_ = json::from_cbor(input, true, true, tags, strict), json::parse_error&);
-                CHECK(json::from_cbor(input, true, false, tags, strict).is_discarded());
-            }
-            {
-                json _;
-                CHECK_THROWS_WITH_AS(_ = json::from_cbor(split, true, true, tags, strict), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing CBOR string: invalid string: ill-formed UTF-8 byte", json::parse_error&);
-                CHECK_THROWS_WITH_AS(_ = json::from_cbor(split_key, true, true, tags, strict), "[json.exception.parse_error.113] parse error at byte 4: syntax error while parsing CBOR key: invalid string: ill-formed UTF-8 byte", json::parse_error&);
-            }
-
-            // replace and ignore: every chunk is sanitized on its own
-            CHECK(json::from_cbor(split, true, true, tags, replace) == "\xEF\xBF\xBD\xEF\xBF\xBD");
-            CHECK(json::from_cbor(split, true, true, tags, ignore) == "");
-            CHECK(json::from_cbor(truncated, true, true, tags, replace) == "A\xEF\xBF\xBD\xEF\xBF\xBD");
-            CHECK(json::from_cbor(truncated, true, true, tags, ignore) == "A");
-            CHECK(json::from_cbor(split_key, true, true, tags, replace) == json{{"\xEF\xBF\xBD\xEF\xBF\xBD", 1}});
-
-            // keep: unchanged, the chunks are concatenated as is
-            CHECK(json::from_cbor(split, true, true, tags, keep) == "\xc3\xa9");
-            CHECK(json::from_cbor(split_emoji, true, true, tags, keep) == "\xf0\x9f\x98\x80");
-
-            // conforming input is unaffected by the error handler
-            const std::vector<std::uint8_t> valid = {0x7f, 0x62, 0xc3, 0xa9, 0x64, 0xf0, 0x9f, 0x98, 0x80, 0x60, 0xff};
-            for (const auto handler :
-                    {
-                        strict, replace, ignore, keep
-                    })
-            {
-                CHECK(json::from_cbor(valid, true, true, tags, handler) == "\xc3\xa9\xf0\x9f\x98\x80");
-                CHECK(json::from_cbor(std::vector<std::uint8_t>({0x7f, 0xff}), true, true, tags, handler) == "");
-            }
-        }
-
         SECTION("many chunks in indefinite-length string")
         {
             constexpr std::size_t chunks = 100000;

tests/src/unit-class_parser.cpp

@@ -2953,6 +2953,651 @@ TEST_CASE("diagnostic positions: value lifetime, input adapters, and SAX")
 }
 #endif
 
+namespace
+{
+/// builds a value like json::parse(), but asks the parser to recover from
+/// errors (see #3989), and checks that the events it receives are balanced
+class RecoveringDomParser
+{
+  public:
+    explicit RecoveringDomParser(json& j, std::size_t max_errors_ = static_cast<std::size_t>(-1))
+        : dom(j, false)
+        , max_errors(max_errors_)
+    {}
+
+    bool null()
+    {
+        value();
+        return dom.null();
+    }
+
+    bool boolean(bool val)
+    {
+        value();
+        return dom.boolean(val);
+    }
+
+    bool number_integer(json::number_integer_t val)
+    {
+        value();
+        return dom.number_integer(val);
+    }
+
+    bool number_unsigned(json::number_unsigned_t val)
+    {
+        value();
+        return dom.number_unsigned(val);
+    }
+
+    bool number_float(json::number_float_t val, const std::string& s)
+    {
+        value();
+        return dom.number_float(val, s);
+    }
+
+    bool string(std::string& val)
+    {
+        value();
+        return dom.string(val);
+    }
+
+    bool binary(json::binary_t& val)
+    {
+        value();
+        return dom.binary(val);
+    }
+
+    bool start_object(std::size_t elements)
+    {
+        value();
+        stack.push_back('o');
+        return dom.start_object(elements);
+    }
+
+    bool key(std::string& val)
+    {
+        ++events;
+        if (stack.empty() || stack.back() != 'o')
+        {
+            well_formed = false;
+            return false;
+        }
+        stack.back() = 'v';
+        return dom.key(val);
+    }
+
+    bool end_object()
+    {
+        ++events;
+        if (stack.empty() || stack.back() != 'o')
+        {
+            well_formed = false;
+            return false;
+        }
+        stack.pop_back();
+        return dom.end_object();
+    }
+
+    bool start_array(std::size_t elements)
+    {
+        value();
+        stack.push_back('a');
+        return dom.start_array(elements);
+    }
+
+    bool end_array()
+    {
+        ++events;
+        if (stack.empty() || stack.back() != 'a')
+        {
+            well_formed = false;
+            return false;
+        }
+        stack.pop_back();
+        return dom.end_array();
+    }
+
+    bool parse_error(std::size_t /*unused*/, const std::string& /*unused*/, const json::exception& ex)
+    {
+        errors.emplace_back(ex.what());
+        return errors.size() < max_errors;
+    }
+
+    /// whether the events were balanced and every key was followed by a value
+    bool balanced() const
+    {
+        return well_formed && stack.empty();
+    }
+
+    /// builds the value
+    nlohmann::detail::json_sax_dom_parser<json> dom;
+    std::vector<std::string> errors {}; // NOLINT(readability-redundant-member-init)
+    std::size_t events = 0;
+    /// the open containers: 'a' for an array, 'o' for an object that expects
+    /// a key, 'v' for an object that expects the value of a key
+    std::vector<char> stack {}; // NOLINT(readability-redundant-member-init)
+    bool well_formed = true;
+    std::size_t max_errors;
+
+  private:
+    /// a value is passed: it is an array element, or the value of a key
+    void value()
+    {
+        ++events;
+        if (!stack.empty())
+        {
+            if (stack.back() == 'v')
+            {
+                stack.back() = 'o';
+            }
+            else if (stack.back() == 'o')
+            {
+                // a value without a key
+                well_formed = false;
+            }
+        }
+    }
+
+};
+
+struct RecoveryResult
+{
+    json value;
+    std::vector<std::string> errors;
+    std::size_t events;
+    bool ok;
+    bool balanced;
+};
+
+template<typename InputType>
+RecoveryResult parse_recovering(InputType&& input, const bool strict = true,
+                                const bool ignore_comments = false, const bool ignore_trailing_commas = false)
+{
+    json j;
+    RecoveringDomParser sax(j);
+    const bool ok = json::sax_parse(std::forward<InputType>(input), &sax, json::input_format_t::json,
+                                    strict, ignore_comments, ignore_trailing_commas);
+    return {j, sax.errors, sax.events, ok, sax.balanced()};
+}
+
+/// stops after a number of events, but recovers from errors
+class RecoveringCountdown
+{
+  public:
+    explicit RecoveringCountdown(const int count)
+        : countdown(count)
+    {}
+
+    bool null()
+    {
+        return countdown.null();
+    }
+
+    bool boolean(bool val)
+    {
+        return countdown.boolean(val);
+    }
+
+    bool number_integer(json::number_integer_t val)
+    {
+        return countdown.number_integer(val);
+    }
+
+    bool number_unsigned(json::number_unsigned_t val)
+    {
+        return countdown.number_unsigned(val);
+    }
+
+    bool number_float(json::number_float_t val, const std::string& s)
+    {
+        return countdown.number_float(val, s);
+    }
+
+    bool string(std::string& val)
+    {
+        return countdown.string(val);
+    }
+
+    bool binary(json::binary_t& val)
+    {
+        return countdown.binary(val);
+    }
+
+    bool start_object(std::size_t elements)
+    {
+        return countdown.start_object(elements);
+    }
+
+    bool key(std::string& val)
+    {
+        return countdown.key(val);
+    }
+
+    bool end_object()
+    {
+        return countdown.end_object();
+    }
+
+    bool start_array(std::size_t elements)
+    {
+        return countdown.start_array(elements);
+    }
+
+    bool end_array()
+    {
+        return countdown.end_array();
+    }
+
+    bool parse_error(std::size_t /*position*/, const std::string& /*last_token*/, const json::exception& /*ex*/) // NOLINT(readability-convert-member-functions-to-static)
+    {
+        return true;
+    }
+
+  private:
+    SaxCountdown countdown;
+};
+
+/// a repaired input: the value it is repaired to, and the number of errors
+struct Repair
+{
+    const char* input;
+    const char* expected;
+    std::size_t errors;
+};
+} // namespace
+
+TEST_CASE("parser error recovery (#3989)")
+{
+    SECTION("repairs")
+    {
+        const std::vector<Repair> repairs =
+        {
+            // a missing separator is inserted
+            {"[1 2]", "[1,2]", 1},
+            {R"({"a":1 "b":2})", R"({"a":1,"b":2})", 1},
+            {R"({"a" 1})", R"({"a":1})", 1},
+            {"[1 tru 2]", "[1,null,2]", 2},
+            {R"({"a" "b": 1})", R"({"a":"b"})", 2},
+
+            // a missing value is null in an object; in an array, a ',' stands
+            // for null, while an array that ends there just ends
+            {R"({"a":})", R"({"a":null})", 1},
+            {R"({"a"})", R"({"a":null})", 1},
+            {R"({"a","b":1})", R"({"a":null,"b":1})", 1},
+            {"[1,,2]", "[1,null,2]", 1},
+            {"[,1]", "[null,1]", 1},
+            {"[1,]", "[1]", 1},
+            {"[1,2,3,]", "[1,2,3]", 1},
+            {R"({"a":1,})", R"({"a":1})", 1},
+
+            // a broken string keeps what can be read
+            {R"(["a\qb"])", R"(["aqb"])", 1},
+            {R"({"na\me":1})", R"({"name":1})", 1},
+            {"[\"\xFF\"]", R"(["\uFFFD"])", 1},
+            {"[\"a\xC3(\"]", R"(["a\uFFFD("])", 1},
+            {"[\"\xE2\x82\"]", R"(["\uFFFD"])", 1},
+            {"[\"\xC3\\\\\", 1]", R"(["\uFFFD\\",1])", 1},
+            {R"(["\u12"])", R"(["\uFFFD"])", 1},
+            {R"(["\u12G4"])", R"(["\uFFFDG4"])", 1},
+            {R"(["\uDC00x"])", R"(["\uFFFDx"])", 1},
+            {R"(["\uD800x"])", R"(["\uFFFDx"])", 1},
+            {R"(["\uD800\u0041"])", R"(["\uFFFDA"])", 1},
+            {R"(["\uD800\uD800\uDC00"])", R"(["\uFFFD\uD800\uDC00"])", 1},
+            {R"(["\uD800\uD800\uD800x"])", R"(["\uFFFD\uFFFD\uFFFDx"])", 1},
+            {
+                R"(["\uD800\"x", 1])", R"(["\uFFFD\"x",1])", 1
+            },
+            {R"(["\uD800\q"])", R"(["\uFFFDq"])", 1},
+            {"[\"a\tb\"]", R"(["a\tb"])", 1},
+            {R"(["a\qb\u0041\x"])", R"(["aqbAx"])", 1},
+
+            // a broken number keeps its longest valid prefix
+            {"[1.]", "[1]", 1},
+            {"[-2.]", "[-2]", 1},
+            {"[1.5e]", "[1.5]", 1},
+            {"[1e+]", "[1]", 1},
+            {"[1.x2, 3]", "[1,3]", 1},
+
+            // what cannot be read at all is null
+            {"[1,NaN,3]", "[1,null,3]", 1},
+            {"[tru]", "[null]", 1},
+            {"[-]", "[null]", 1},
+            {R"({"a":Infinity})", R"({"a":null})", 1},
+
+            // a stray token is dropped
+            {"[:1]", "[1]", 1},
+            {R"(["a":1])", R"(["a",1])", 1},
+            {R"({"a"::1})", R"({"a":1})", 1},
+
+            // a member that cannot be read is skipped
+            {R"({1:2,"b":3})", R"({"b":3})", 1},
+            {R"({"a":1 2})", R"({"a":1})", 1},
+            {R"({,"a":1})", R"({"a":1})", 1},
+            {R"({"a":1,,"b":2})", R"({"a":1,"b":2})", 1},
+            {"{a:1}", "{}", 1},
+            {R"({"a":1 [1,{"b":2}], "c":3})", R"({"a":1,"c":3})", 1},
+            {R"([{1}, "a"])", R"([{},"a"])", 1},
+
+            // a wrong closing bracket closes the innermost container
+            {R"({"a":[1,2}, "b":3})", R"({"a":[1,2],"b":3})", 1},
+            {R"([{"a":1], 2])", R"([{"a":1},2])", 1},
+            {"{]", "{}", 1},
+            {"[}", "[]", 1},
+
+            // the end of the input closes all containers
+            {R"({"a":[1,2)", R"({"a":[1,2]})", 1},
+            {"[", "[]", 1},
+            {"{", "{}", 1},
+            {R"({"a")", R"({"a":null})", 1},
+            {R"({"a":)", R"({"a":null})", 1},
+            {"[1,", "[1]", 1},
+            {"[[[1", "[[[1]]]", 1},
+            {
+                R"(["abc)", R"(["abc"])", 2
+            },
+            {"[1,tr", "[1,null]", 2},
+            {"\"abc", "\"abc\"", 1},
+            {"[\"ab\ncd\"]", R"(["ab",null,"]"])", 4},
+
+            // what comes before the top-level value is skipped
+            {")]}'\n{\"a\":1}", R"({"a":1})", 1},
+            {R"(data: {"a":1})", R"({"a":1})", 1},
+            {"\xEF\xBB[1]", "[1]", 1},
+
+            // what comes after it is an error that ends parsing
+            {R"({"a":1}})", R"({"a":1})", 1},
+            {"[1}]", "[1]", 2},
+            {"[1] [2]", "[1]", 1},
+        };
+
+        for (const auto& repair : repairs)
+        {
+            CAPTURE(repair.input)
+            const auto result = parse_recovering(std::string(repair.input));
+            CHECK(!result.ok);
+            CHECK(result.balanced);
+            CHECK(result.value == json::parse(repair.expected));
+            CHECK(result.errors.size() == repair.errors);
+        }
+    }
+
+    SECTION("number overflow")
+    {
+        const auto result = parse_recovering(std::string("[1e999,-1e999]"));
+        CHECK(!result.ok);
+        CHECK(result.balanced);
+        CHECK(result.errors.size() == 2);
+        CHECK(result.errors[0] == "[json.exception.out_of_range.406] number overflow parsing '1e999'");
+        REQUIRE(result.value.size() == 2);
+        CHECK(result.value[0].is_number_float());
+        CHECK(result.value[0].get<double>() == std::numeric_limits<double>::infinity());
+        CHECK(result.value[1].get<double>() == -std::numeric_limits<double>::infinity());
+
+        // the SAX parser gets the number's text
+        SaxEventLogger logger;
+        logger.recover = true;
+        CHECK(!json::sax_parse("1e999", &logger));
+        CHECK(logger.events == std::vector<std::string>({"parse_error(5)", "number_float(1e999)"}));
+    }
+
+    SECTION("nothing to recover")
+    {
+        for (const std::string s :
+                {
+                    "", "   ", "]", "tru", "NaN", ",:", "/* comment"
+                })
+        {
+            CAPTURE(s)
+            const auto result = parse_recovering(s, true, true);
+            CHECK(!result.ok);
+            CHECK(result.balanced);
+            CHECK(result.events == 0);
+            CHECK(result.value == nullptr);
+            CHECK(result.errors.size() == 1);
+        }
+    }
+
+    SECTION("error messages")
+    {
+        // the first error is reported as without recovery
+        for (const std::string s :
+                {
+                    "[1 2]", R"({"a":1 "b":2})", R"({"a" 1})", R"({"a":})", "[1,]", "[1.]",
+                    R"(["a\qb"])", "[1e999]", "{1:2}", R"({"a":[1,2}})", "[1,", "[1] [2]", "{a:1}"
+                })
+        {
+            CAPTURE(s)
+            const auto result = parse_recovering(s);
+            REQUIRE(!result.errors.empty());
+            json _;
+            CHECK_THROWS_WITH_STD_STR(_ = json::parse(s), result.errors.front());
+        }
+
+        // the token of an error begins where the previous error was
+        const auto result = parse_recovering(std::string("[tru, fals, nul]"));
+        CHECK(result.errors == std::vector<std::string>(
+        {
+            "[json.exception.parse_error.101] parse error at line 1, column 5: syntax error while parsing value - invalid literal; last read: '[tru,'",
+            "[json.exception.parse_error.101] parse error at line 1, column 11: syntax error while parsing value - invalid literal; last read: ', fals,'",
+            "[json.exception.parse_error.101] parse error at line 1, column 16: syntax error while parsing value - invalid literal; last read: ', nul]'"
+        }));
+        CHECK(result.value == json::parse("[null,null,null]"));
+    }
+
+    SECTION("events")
+    {
+        // see #4522
+        SaxEventLogger logger;
+        logger.recover = true;
+        CHECK(!json::sax_parse(R"([{1}, "a"])", &logger));
+        CHECK(logger.events == std::vector<std::string>(
+        {
+            "start_array()", "start_object()", "parse_error(3)", "end_object()", "string(a)", "end_array()"
+        }));
+    }
+
+    SECTION("options")
+    {
+        SECTION("strict")
+        {
+            const auto result = parse_recovering(std::string("[1 2] [3]"), false);
+            CHECK(!result.ok);
+            CHECK(result.value == json::parse("[1,2]"));
+            CHECK(result.errors.size() == 1);
+        }
+
+        SECTION("ignore_trailing_commas")
+        {
+            for (const std::string s :
+                    {
+                        "[1,]", R"({"a":1,})", "[[1,],]"
+                    })
+            {
+                CAPTURE(s)
+                const auto result = parse_recovering(s, true, false, true);
+                CHECK(result.ok);
+                CHECK(result.errors.empty());
+            }
+
+            auto result = parse_recovering(std::string("[1,,]"), true, false, true);
+            CHECK(result.value == json::parse("[1,null]"));
+            CHECK(result.errors.size() == 1);
+
+            result = parse_recovering(std::string(R"({"a":1,,})"), true, false, true);
+            CHECK(result.value == json::parse(R"({"a":1})"));
+            CHECK(result.errors.size() == 1);
+        }
+
+        SECTION("ignore_comments")
+        {
+            auto result = parse_recovering(std::string("[1 /* one */ 2]"), true, true);
+            CHECK(result.value == json::parse("[1,2]"));
+            CHECK(result.errors.size() == 1);
+
+            // a comment that is not closed runs to the end of the input, which
+            // is not reported again
+            result = parse_recovering(std::string("[1, 2 /* unterminated"), true, true);
+            CHECK(result.balanced);
+            CHECK(result.value == json::parse("[1,2]"));
+            CHECK(result.errors.size() == 1);
+
+            // a '/' that does not begin a comment is garbage
+            result = parse_recovering(std::string("[1, /x, 2]"), true, true);
+            CHECK(result.balanced);
+            CHECK(result.value == json::parse("[1,null,2]"));
+            CHECK(result.errors.size() == 1);
+        }
+    }
+
+    SECTION("null bytes")
+    {
+        // a null byte ends the input, unless JSON_STRICT_NUL_HANDLING is set
+        const auto result = parse_recovering(std::string("[1,\0x", 5));
+        CHECK(result.balanced);
+        CHECK(!result.ok);
+#ifdef JSON_TEST_STRICT_NUL_HANDLING_ENABLED
+        CHECK(result.value == json::parse("[1,null]"));
+#else
+        CHECK(result.value == json::parse("[1]"));
+        CHECK(result.errors.size() == 1);
+#endif
+
+        const auto in_string = parse_recovering(std::string("[\"a\0b\"]", 7));
+        CHECK(in_string.balanced);
+#ifdef JSON_TEST_STRICT_NUL_HANDLING_ENABLED
+        CHECK(in_string.value == json::array({std::string("a\0b", 3)}));
+#else
+        CHECK(in_string.value == json::parse(R"(["a"])"));
+#endif
+    }
+
+    SECTION("the SAX parser stops recovering")
+    {
+        json j;
+        RecoveringDomParser sax(j, 2);
+        CHECK(!json::sax_parse("[1 2 3 4 5]", &sax));
+        CHECK(sax.errors.size() == 2);
+
+        // an error at a delimiter that an invalid token consumed is reported
+        // to the SAX parser, too
+        json j2;
+        RecoveringDomParser sax2(j2, 2);
+        CHECK(!json::sax_parse("[tru}, 1]", &sax2));
+        CHECK(sax2.errors.size() == 2);
+    }
+
+    SECTION("an event stops parsing during a repair")
+    {
+        // start_object() and key() are passed, then null() for the missing
+        // value returns false
+        RecoveringCountdown countdown(2);
+        CHECK(!json::sax_parse(R"({"a":})", &countdown));
+
+        // the end of the input: end_array() for the second array returns false
+        RecoveringCountdown countdown2(4);
+        CHECK(!json::sax_parse("[[1", &countdown2));
+    }
+
+    SECTION("input adapters")
+    {
+        // the lexer reads contiguous and streaming input differently, and it
+        // puts back a character that ended an invalid token
+        for (const std::string s :
+                {
+                    "[1 2]", "[tru}, 1]", R"({"a" "b\q", "c":[1.x, 2}})", "[\"\xFF\xC3(\", -, 1e+]", "{a:1,\"b\":2", ")]}' [1]"
+                })
+        {
+            CAPTURE(s)
+            const auto reference = parse_recovering(s);
+            CHECK(reference.balanced);
+
+            const auto from_c_string = parse_recovering(s.c_str());
+            CHECK(from_c_string.value == reference.value);
+            CHECK(from_c_string.errors == reference.errors);
+
+            const std::list<char> l(s.begin(), s.end());
+            json j;
+            RecoveringDomParser sax(j);
+            CHECK(!json::sax_parse(l.begin(), l.end(), &sax));
+            CHECK(j == reference.value);
+            CHECK(sax.errors == reference.errors);
+
+            std::istringstream ss(s);
+            const auto from_stream = parse_recovering(ss);
+            CHECK(from_stream.value == reference.value);
+            CHECK(from_stream.errors == reference.errors);
+        }
+    }
+
+    SECTION("long runs of errors")
+    {
+        // no error may copy all the input read before it
+        const auto closing = parse_recovering("[" + std::string(100000, '}'));
+        CHECK(closing.balanced);
+        CHECK(closing.value == json::array());
+
+        const auto garbage = parse_recovering("[" + std::string(100000, 'x') + "]");
+        CHECK(garbage.balanced);
+        CHECK(garbage.errors.size() == 1);
+
+        const auto commas = parse_recovering("{" + std::string(100000, ',') + "}");
+        CHECK(commas.balanced);
+        CHECK(commas.value == json::object());
+    }
+
+    SECTION("mutations of valid input")
+    {
+        // whatever the input, the events are balanced, every error is reported
+        // at most once, and valid input is parsed as usual
+        const std::vector<std::string> documents =
+        {
+            R"({"name": "value", "list": [1, -2.5, true, null, {"x": [[]]}], "e": "\u00e9"})",
+            R"([{"a": [1, 2, {"b": "c"}]}, [], {}, "\ud83d\ude00", 1e10])",
+            "{\"\xC3\xA9\": \"\xF0\x9F\x98\x80\"}",
+            R"(  {"k" : [ "v" , 0 ] }  )",
+        };
+        // each character that can be inserted, including a null byte
+        const std::string insertions("[]{},:\"x\\\0\xFF", 11);
+
+        std::vector<std::string> inputs;
+        for (const auto& doc : documents)
+        {
+            for (std::size_t i = 0; i <= doc.size(); ++i)
+            {
+                inputs.push_back(doc.substr(0, i));
+                if (i < doc.size())
+                {
+                    inputs.push_back(doc.substr(0, i) + doc.substr(i + 1));
+                }
+                for (const char c : insertions)
+                {
+                    inputs.push_back(doc.substr(0, i) + c + doc.substr(i));
+                }
+            }
+        }
+
+        for (const auto& s : inputs)
+        {
+            CAPTURE(s)
+            const auto result = parse_recovering(s);
+            CHECK(result.balanced);
+            CHECK(result.errors.size() <= s.size() + 1);
+            CHECK(result.events <= (4 * s.size()) + 4);
+            if (json::accept(s))
+            {
+                CHECK(result.ok);
+                CHECK(result.errors.empty());
+                CHECK(result.value == json::parse(s));
+            }
+            else
+            {
+                CHECK(!result.ok);
+                CHECK(!result.errors.empty());
+            }
+        }
+    }
+}
+
 TEST_CASE("accept() agrees with parse() on floats around the overflow limit")
 {
     // accept() does not convert a float that cannot overflow; the tokens

tests/src/unit-msgpack.cpp

@@ -31,8 +31,6 @@ using nlohmann::json;
 #include "make_test_data_available.hpp"
 #include "round_trip_corpus.hpp"
 #include "test_utils.hpp"
-#include "sax_countdown.hpp"
-using utils::SaxCountdown;
 
 
 TEST_CASE("MessagePack")
@@ -1645,30 +1643,6 @@ TEST_CASE("MessagePack")
             }
         }
     }
-
-    SECTION("SAX aborts")
-    {
-        SECTION("start_array(len)")
-        {
-            std::vector<uint8_t> const v = {0x93, 0x01, 0x02, 0x03};
-            SaxCountdown scp(0);
-            CHECK(!json::sax_parse(v, &scp, json::input_format_t::msgpack));
-        }
-
-        SECTION("start_object(len)")
-        {
-            std::vector<uint8_t> const v = {0x81, 0xa3, 0x66, 0x6F, 0x6F, 0xc2};
-            SaxCountdown scp(0);
-            CHECK(!json::sax_parse(v, &scp, json::input_format_t::msgpack));
-        }
-
-        SECTION("key()")
-        {
-            std::vector<uint8_t> const v = {0x81, 0xa3, 0x66, 0x6F, 0x6F, 0xc2};
-            SaxCountdown scp(1);
-            CHECK(!json::sax_parse(v, &scp, json::input_format_t::msgpack));
-        }
-    }
 }
 
 TEST_CASE("issue #5405 - array reserve for definite-length MessagePack arrays")
@@ -1739,21 +1713,6 @@ TEST_CASE("issue #5405 - array reserve for definite-length MessagePack arrays")
             CHECK(json::from_msgpack(packed) == j);
         }
     }
-
-    SECTION("a user-defined SAX consumer is unaffected by the internal DOM reserve optimization")
-    {
-        // the reserve() call is local to json_sax_dom_parser / json_sax_dom_callback_parser;
-        // a custom SAX consumer that does not touch a DOM array sees identical events
-        json j = json::array();
-        for (int i = 0; i < 100; ++i)
-        {
-            j.push_back(i);
-        }
-        const auto packed = json::to_msgpack(j);
-
-        SaxCountdown scp(1000000); // large enough to never trigger an abort
-        CHECK(json::sax_parse(packed, &scp, json::input_format_t::msgpack));
-    }
 }
 
 TEST_CASE("regression test - MessagePack ext type rejects a subtype that doesn't fit a single byte")
@@ -1792,15 +1751,6 @@ TEST_CASE("MessagePack nesting does not consume the call stack")
         CHECK(json::from_msgpack(input, true, false).is_discarded());
     }
 
-    SECTION("a well-formed deep value is read through the SAX interface")
-    {
-        std::vector<uint8_t> input(300000, 0x91);
-        input.push_back(0x01); // innermost value
-
-        SaxCountdown accept_all(600001);
-        CHECK(json::sax_parse(input, &accept_all, json::input_format_t::msgpack));
-    }
-
     SECTION("a well-formed deep value is read into a value")
     {
         const std::size_t depth = 10000;
@@ -1848,31 +1798,6 @@ TEST_CASE("MessagePack input that cannot be read is discarded by every overload"
 #endif
 }
 
-TEST_CASE("MessagePack SAX parsing stops at every event")
-{
-    // Containers are opened and closed by the loop that reads them; a SAX
-    // handler that rejects any event - including the end of a nested
-    // container - must stop the parse right there.
-    const auto count_events = [](const std::vector<std::uint8_t>& input)
-    {
-        int events = 0;
-        while (true)
-        {
-            SaxCountdown scp(events);
-            if (json::sax_parse(input, &scp, json::input_format_t::msgpack))
-            {
-                return events;
-            }
-            ++events;
-            REQUIRE(events < 1000);
-        }
-    };
-
-    // 20 events: every container kind closes inside another one
-    const json j = json::parse(R"({"a": [1, {"b": []}], "c": {"d": [[2]]}})");
-    CHECK(count_events(json::to_msgpack(j)) == 20);
-}
-
 TEST_CASE("single MessagePack roundtrip")
 {
     SECTION("sample.json")

tests/src/unit-regression3.cpp

@@ -22,14 +22,6 @@
 // scoped enum, so get<std::byte>() (needed below to get<std::vector<std::byte>>()
 // from a plain JSON array, not just from an already-binary value) relies on
 // enum serialization being enabled
-// capture whether JSON_DELETE_DEPRECATED_FUNCTIONS was enabled on the command
-// line *before* including json.hpp, since the library #undefs it once the header
-// has been fully processed (see include/nlohmann/detail/macro_unscope.hpp); the
-// tests of deprecated functions are skipped if these functions are deleted
-#if defined(JSON_DELETE_DEPRECATED_FUNCTIONS) && (JSON_DELETE_DEPRECATED_FUNCTIONS == 1)
-    #define JSON_TEST_DEPRECATED_FUNCTIONS_DELETED
-#endif
-
 #if defined(JSON_DISABLE_ENUM_SERIALIZATION) && (JSON_DISABLE_ENUM_SERIALIZATION == 1)
     #define SKIP_TESTS_FOR_ENUM_SERIALIZATION
 #endif
@@ -810,50 +802,6 @@ TEST_CASE("issue #5338 - truncated CBOR tagged binary subtype is rejected")
     }
 }
 
-TEST_CASE("issue #5676 - SAX parsing of CBOR tags")
-{
-    const json expected = json::binary({1, 2, 3}, 42);
-    const auto cbor = json::to_cbor(expected);
-
-    nlohmann::detail::json_sax_acceptor<json> acceptor;
-    CHECK_FALSE(json::sax_parse(cbor, &acceptor, json::input_format_t::cbor));
-    CHECK_FALSE(json::sax_parse(cbor, &acceptor, json::input_format_t::cbor,
-                                true, false, false, json::cbor_tag_handler_t::error));
-
-    CHECK(json::sax_parse(cbor, &acceptor, json::input_format_t::cbor,
-                          true, false, false, json::cbor_tag_handler_t::ignore));
-
-    json parsed;
-    nlohmann::detail::json_sax_dom_parser<json, nlohmann::detail::string_input_adapter_type> sax(parsed);
-    CHECK(json::sax_parse(cbor, &sax, json::input_format_t::cbor,
-                          true, false, false, json::cbor_tag_handler_t::store));
-    CHECK(parsed == expected);
-
-    json iterator_parsed;
-    nlohmann::detail::json_sax_dom_parser<json, nlohmann::detail::string_input_adapter_type> iterator_sax(iterator_parsed);
-    CHECK(json::sax_parse(cbor.begin(), cbor.end(), &iterator_sax, json::input_format_t::cbor,
-                          true, false, false, json::cbor_tag_handler_t::store));
-    CHECK(iterator_parsed == expected);
-
-#ifndef JSON_TEST_DEPRECATED_FUNCTIONS_DELETED
-    json span_parsed;
-    nlohmann::detail::json_sax_dom_parser<json, nlohmann::detail::string_input_adapter_type> span_sax(span_parsed);
-    CHECK(json::sax_parse(nlohmann::detail::span_input_adapter(cbor.data(), cbor.size()), &span_sax,
-                          json::input_format_t::cbor, true, false, false, json::cbor_tag_handler_t::store));
-    CHECK(span_parsed == expected);
-#endif
-
-    const std::string text = "null";
-    CHECK(json::sax_parse(text, &acceptor, json::input_format_t::json,
-                          true, false, false, json::cbor_tag_handler_t::store));
-    CHECK(json::sax_parse(text.begin(), text.end(), &acceptor, json::input_format_t::json,
-                          true, false, false, json::cbor_tag_handler_t::store));
-#ifndef JSON_TEST_DEPRECATED_FUNCTIONS_DELETED
-    CHECK(json::sax_parse(nlohmann::detail::span_input_adapter(text.data(), text.size()), &acceptor,
-                          json::input_format_t::json, true, false, false, json::cbor_tag_handler_t::store));
-#endif
-}
-
 TEST_CASE("issue #5402 - update(merge_objects=true) overwrites a primitive with an object")
 {
     json t = {{"k", 1}};

tests/src/unit-sax_parse.cpp

@@ -0,0 +1,768 @@
+//     __ _____ _____ _____
+//  __|  |   __|     |   | |  JSON for Modern C++ (supporting code)
+// |  |  |__   |  |  | | | |  version 3.12.0
+// |_____|_____|_____|_|___|  https://github.com/nlohmann/json
+//
+// SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
+// SPDX-License-Identifier: MIT
+
+/////////////////////////////////////////////////////////////////////
+// Tests that call basic_json::sax_parse have a file of their own: every
+// sax_parse call instantiates the parser and binary reader that recover from
+// errors (see #3989), and in unit-regression2.cpp, unit-regression3.cpp, and
+// unit-msgpack.cpp this made the objects too large for the MinGW linker to
+// relocate (see #5511).
+/////////////////////////////////////////////////////////////////////
+
+#include "doctest_compatibility.h"
+
+// capture whether JSON_DELETE_DEPRECATED_FUNCTIONS was enabled on the command
+// line *before* including json.hpp, since the library #undefs it once the header
+// has been fully processed (see include/nlohmann/detail/macro_unscope.hpp); the
+// tests of deprecated functions are skipped if these functions are deleted
+#if defined(JSON_DELETE_DEPRECATED_FUNCTIONS) && (JSON_DELETE_DEPRECATED_FUNCTIONS == 1)
+    #define JSON_TEST_DEPRECATED_FUNCTIONS_DELETED
+#endif
+
+#include <nlohmann/json.hpp>
+using json = nlohmann::json;
+
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <initializer_list>
+#include <map>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "sax_countdown.hpp"
+using utils::SaxCountdown;
+
+// a narrow number_float_t, so that a double read from binary input can
+// overflow it
+using float_json = nlohmann::basic_json<std::map, std::vector, std::string, bool, std::int64_t, std::uint64_t, float>;
+
+DOCTEST_CLANG_SUPPRESS_WARNING_PUSH
+DOCTEST_CLANG_SUPPRESS_WARNING("-Wexit-time-destructors")
+
+namespace
+{
+/// builds a value from SAX events, asks the parser to recover from its first
+/// 100 errors, and checks that the events are balanced (see #3989)
+template<typename BasicJsonType>
+class BasicRecoveringParser
+{
+  public:
+    explicit BasicRecoveringParser(BasicJsonType& j)
+        : dom(j, false)
+    {}
+
+    bool null()
+    {
+        value();
+        return dom.null();
+    }
+
+    bool boolean(bool val)
+    {
+        value();
+        return dom.boolean(val);
+    }
+
+    bool number_integer(typename BasicJsonType::number_integer_t val)
+    {
+        value();
+        return dom.number_integer(val);
+    }
+
+    bool number_unsigned(typename BasicJsonType::number_unsigned_t val)
+    {
+        value();
+        return dom.number_unsigned(val);
+    }
+
+    bool number_float(typename BasicJsonType::number_float_t val, const std::string& s)
+    {
+        value();
+        return dom.number_float(val, s);
+    }
+
+    bool string(std::string& val)
+    {
+        value();
+        return dom.string(val);
+    }
+
+    bool binary(typename BasicJsonType::binary_t& val)
+    {
+        value();
+        return dom.binary(val);
+    }
+
+    bool start_object(std::size_t elements)
+    {
+        value();
+        stack.push_back('o');
+        return dom.start_object(elements);
+    }
+
+    bool key(std::string& val)
+    {
+        if (stack.empty() || stack.back() != 'o')
+        {
+            well_formed = false;
+            return false;
+        }
+        stack.back() = 'v';
+        return dom.key(val);
+    }
+
+    bool end_object()
+    {
+        if (stack.empty() || stack.back() != 'o')
+        {
+            well_formed = false;
+            return false;
+        }
+        stack.pop_back();
+        return dom.end_object();
+    }
+
+    bool start_array(std::size_t elements)
+    {
+        value();
+        stack.push_back('a');
+        return dom.start_array(elements);
+    }
+
+    bool end_array()
+    {
+        if (stack.empty() || stack.back() != 'a')
+        {
+            well_formed = false;
+            return false;
+        }
+        stack.pop_back();
+        return dom.end_array();
+    }
+
+    bool parse_error(std::size_t /*unused*/, const std::string& /*unused*/, const json::exception& ex)
+    {
+        messages.emplace_back(ex.what());
+        // a limit, so that a reader that does not stop fails the test
+        // instead of making it hang
+        return ++errors < 100;
+    }
+
+    /// whether the events were balanced and every key was followed by a value
+    bool balanced() const
+    {
+        return well_formed && stack.empty();
+    }
+
+    /// builds the value
+    nlohmann::detail::json_sax_dom_parser<BasicJsonType> dom;
+    std::size_t errors = 0;
+    std::vector<std::string> messages {}; // NOLINT(readability-redundant-member-init)
+    std::vector<char> stack {}; // NOLINT(readability-redundant-member-init)
+    bool well_formed = true;
+
+  private:
+    void value()
+    {
+        if (!stack.empty())
+        {
+            if (stack.back() == 'v')
+            {
+                stack.back() = 'o';
+            }
+            else if (stack.back() == 'o')
+            {
+                well_formed = false;
+            }
+        }
+    }
+
+};
+
+using RecoveringParser = BasicRecoveringParser<json>;
+
+struct BinaryParseResult
+{
+    json value;
+    std::size_t errors;
+    std::vector<std::string> messages;
+    bool ok;
+    bool balanced;
+};
+
+BinaryParseResult parse_binary_recovering(const std::vector<std::uint8_t>& input, const json::input_format_t format)
+{
+    json j;
+    RecoveringParser sax(j);
+    const bool ok = json::sax_parse(input, &sax, format);
+    return {j, sax.errors, sax.messages, ok, sax.balanced()};
+}
+
+#if !defined(JSON_NOEXCEPTION)
+/// the message of the exception that reading @a input into a JSON value
+/// throws, or an empty string if reading succeeds
+std::string binary_error_message(const std::vector<std::uint8_t>& input, const json::input_format_t format)
+{
+    try
+    {
+        json _;
+        switch (format)
+        {
+            case json::input_format_t::cbor:
+                _ = json::from_cbor(input);
+                break;
+            case json::input_format_t::msgpack:
+                _ = json::from_msgpack(input);
+                break;
+            case json::input_format_t::ubjson:
+                _ = json::from_ubjson(input);
+                break;
+            case json::input_format_t::bjdata:
+                _ = json::from_bjdata(input);
+                break;
+            case json::input_format_t::bson:
+                _ = json::from_bson(input);
+                break;
+            case json::input_format_t::bon8:
+                _ = json::from_bon8(input);
+                break;
+            case json::input_format_t::json:
+            default:
+                break;
+        }
+    }
+    catch (const json::exception& e)
+    {
+        return e.what();
+    }
+    return "";
+}
+#endif
+
+/// a BSON element: its type, its name, and its value
+std::vector<std::uint8_t> bson_element(const std::uint8_t type, const std::string& name, const std::vector<std::uint8_t>& value)
+{
+    std::vector<std::uint8_t> result = {type};
+    result.insert(result.end(), name.begin(), name.end());
+    result.push_back(0x00);
+    result.insert(result.end(), value.begin(), value.end());
+    return result;
+}
+
+/// a BSON document of the given elements; @a size_offset is added to the
+/// size it declares
+std::vector<std::uint8_t> bson_document(const std::vector<std::vector<std::uint8_t>>& elements, const int size_offset = 0)
+{
+    std::vector<std::uint8_t> body;
+    for (const auto& element : elements)
+    {
+        body.insert(body.end(), element.begin(), element.end());
+    }
+    const auto size = static_cast<std::uint32_t>(static_cast<int>(body.size()) + 5 + size_offset);
+    std::vector<std::uint8_t> result = {static_cast<std::uint8_t>(size & 0xFFu), static_cast<std::uint8_t>((size >> 8u) & 0xFFu),
+                                        static_cast<std::uint8_t>((size >> 16u) & 0xFFu), static_cast<std::uint8_t>((size >> 24u) & 0xFFu)
+                                       };
+    result.insert(result.end(), body.begin(), body.end());
+    result.push_back(0x00);
+    return result;
+}
+
+/// a BSON int32 value
+std::vector<std::uint8_t> bson_int32(const std::int32_t value)
+{
+    const auto u = static_cast<std::uint32_t>(value);
+    return {static_cast<std::uint8_t>(u & 0xFFu), static_cast<std::uint8_t>((u >> 8u) & 0xFFu),
+            static_cast<std::uint8_t>((u >> 16u) & 0xFFu), static_cast<std::uint8_t>((u >> 24u) & 0xFFu)};
+}
+
+/// a BSON string value, whose length is @a length_offset off
+std::vector<std::uint8_t> bson_string(const std::string& value, const std::int32_t length_offset = 0)
+{
+    auto result = bson_int32(static_cast<std::int32_t>(value.size() + 1) + length_offset);
+    result.insert(result.end(), value.begin(), value.end());
+    result.push_back(0x00);
+    return result;
+}
+
+/// @a count bytes of value 0xAB
+std::vector<std::uint8_t> bytes(const std::size_t count)
+{
+    return std::vector<std::uint8_t>(count, 0xAB);
+}
+
+/// the bytes of @a parts, one after the other
+std::vector<std::uint8_t> concatenated(std::initializer_list<std::vector<std::uint8_t>> parts)
+{
+    std::vector<std::uint8_t> result;
+    for (const auto& part : parts)
+    {
+        result.insert(result.end(), part.begin(), part.end());
+    }
+    return result;
+}
+
+/// U+FFFD REPLACEMENT CHARACTER
+std::string replacement_character()
+{
+    return "\xEF\xBF\xBD";
+}
+}  // namespace
+
+TEST_CASE("regression test - #3989 SAX parse_error() returning true")
+{
+    SECTION("binary formats complete what was read before the input ends")
+    {
+        const json j = {{"a", {1, -2, {{"b", "c"}}, json::array()}}, {"d", {{"e", nullptr}, {"f", true}}}, {"g", 1.5}, {"h", json::binary({1, 2, 3})}};
+
+        const std::vector<std::pair<json::input_format_t, std::vector<std::uint8_t>>> encodings =
+        {
+            {json::input_format_t::cbor, json::to_cbor(j)},
+            {json::input_format_t::msgpack, json::to_msgpack(j)},
+            {json::input_format_t::ubjson, json::to_ubjson(j)},
+            {json::input_format_t::ubjson, json::to_ubjson(j, true, true)},
+            {json::input_format_t::bjdata, json::to_bjdata(j)},
+            {json::input_format_t::bjdata, json::to_bjdata(j, true, true)},
+            {json::input_format_t::bson, json::to_bson(j)},
+            {json::input_format_t::bon8, json::to_bon8(j)},
+        };
+
+        for (const auto& encoding : encodings)
+        {
+            const auto format = encoding.first;
+            const auto& bytes = encoding.second;
+            CAPTURE(format)
+
+            // every prefix is truncated input
+            for (std::size_t length = 0; length < bytes.size(); ++length)
+            {
+                CAPTURE(length)
+                const auto result = parse_binary_recovering(std::vector<std::uint8_t>(bytes.begin(), bytes.begin() + static_cast<std::ptrdiff_t>(length)), format);
+                CHECK(!result.ok);
+                CHECK(result.errors == 1);
+                CHECK(result.balanced);
+            }
+
+            // the complete input is read as usual (binary values do not
+            // round-trip through every format, so compare with a plain parse)
+            json expected;
+            nlohmann::detail::json_sax_dom_parser<json> dom(expected);
+            CHECK(json::sax_parse(bytes, &dom, format));
+            const auto complete = parse_binary_recovering(bytes, format);
+            CHECK(complete.ok);
+            CHECK(complete.errors == 0);
+            CHECK(complete.value == expected);
+
+            // a byte after the value
+            auto trailing_bytes = bytes;
+            trailing_bytes.push_back(0x01);
+            const auto trailing = parse_binary_recovering(trailing_bytes, format);
+            CHECK(!trailing.ok);
+            CHECK(trailing.errors == 1);
+            CHECK(trailing.value == expected);
+        }
+    }
+
+    SECTION("containers without an end")
+    {
+        // these made the readers loop, or read on, after the error
+        const auto cbor_array = parse_binary_recovering({0x9F}, json::input_format_t::cbor);
+        CHECK(cbor_array.errors == 1);
+        CHECK(cbor_array.value == json::array());
+
+        const auto cbor_map = parse_binary_recovering({0xBF, 0x61, 'a'}, json::input_format_t::cbor);
+        CHECK(cbor_map.errors == 1);
+        CHECK(cbor_map.value == json({{"a", nullptr}}));
+
+        const auto msgpack_array = parse_binary_recovering({0xDD, 0xFF, 0xFF, 0xFF, 0xFF}, json::input_format_t::msgpack);
+        CHECK(msgpack_array.errors == 1);
+        CHECK(msgpack_array.value == json::array());
+
+        const auto msgpack_map = parse_binary_recovering({0x81, 0xA1, 'a', 0x92, 0x01}, json::input_format_t::msgpack);
+        CHECK(msgpack_map.errors == 1);
+        CHECK(msgpack_map.value == json({{"a", {1}}}));
+    }
+
+    SECTION("BJData ndarray")
+    {
+        // a 2x3 int8 array with two of its six elements; the annotated array
+        // format opens an object and two arrays of its own
+        const auto result = parse_binary_recovering({'[', '$', 'i', '#', '[', '$', 'i', '#', 'i', 2, 2, 3, 1, 2}, json::input_format_t::bjdata);
+        CHECK(result.errors == 1);
+        CHECK(result.balanced);
+        CHECK(result.value == json({{"_ArrayType_", "int8"}, {"_ArraySize_", {2, 3}}, {"_ArrayData_", {1, 2}}}));
+    }
+
+    SECTION("binary formats repair items whose end is known")
+    {
+        struct Repair
+        {
+            json::input_format_t format;
+            std::vector<std::uint8_t> input;
+            json expected;
+            std::size_t errors;
+        };
+
+        const std::vector<Repair> repairs =
+        {
+            // CBOR: tags are ignored (here tag 1 and the self-describe tag 55799)
+            {json::input_format_t::cbor, {0x82, 0xC1, 0x05, 0xD9, 0xD9, 0xF7, 0x06}, {5, 6}, 2},
+            // CBOR: undefined and other simple values become null
+            {json::input_format_t::cbor, {0x84, 0xF7, 0xE0, 0xF8, 0x20, 0x01}, {nullptr, nullptr, nullptr, 1}, 3},
+            // CBOR: members whose key is not a string are skipped, whatever their key and value
+            {json::input_format_t::cbor, {0xA4, 0x01, 0x02, 0x82, 0x01, 0x02, 0xA1, 0x61, 'x', 0x9F, 0xFF, 0xC1, 0x01, 0x5F, 0x41, 0x00, 0xFF, 0x61, 'a', 0x03}, {{"a", 3}}, 3},
+            {json::input_format_t::cbor, {0xBF, 0xF5, 0xBF, 0x61, 'x', 0x7F, 0x61, 'y', 0xFF, 0xFF, 0x61, 'a', 0x03, 0xFF}, {{"a", 3}}, 1},
+            // MessagePack: members whose key is not a string are skipped
+            {json::input_format_t::msgpack, {0x84, 0x01, 0x02, 0x81, 0xA1, 'x', 0x01, 0x92, 0x01, 0x02, 0xD4, 0x01, 0x02, 0xC0, 0xA1, 'a', 0x04}, {{"a", 4}}, 3},
+            // UBJSON: a char that is not ASCII becomes U+FFFD
+            {json::input_format_t::ubjson, {'[', 'C', 0x80, 'C', 'A', ']'}, {replacement_character(), "A"}, 1},
+            // UBJSON: the longest beginning of a high-precision number is kept
+            {json::input_format_t::ubjson, {'[', 'H', 'i', 5, '1', '2', 'a', 'b', 'c', 'H', 'i', 2, '1', '.', 'H', 'i', 3, 'a', 'b', 'c', 'H', 'i', 3, '4', '.', '5', ']'}, {12, 1, nullptr, 4.5}, 3},
+            // BJData, too
+            {json::input_format_t::bjdata, {'[', 'C', 0xFF, 'H', 'i', 2, '-', '1', 'H', 'i', 2, '-', 'x', ']'}, {replacement_character(), -1, nullptr}, 2},
+            // a NUL ends a high-precision number, as it ends JSON text
+            {json::input_format_t::ubjson, {'[', 'H', 'i', 4, '1', '2', 0, '9', 'H', 'i', 2, 0, '1', 'i', 3, ']'}, {12, nullptr, 3}, 2},
+            // BON8: members whose key is not a string are skipped
+            {json::input_format_t::bon8, {0x89, 0x91, 0x92, 0xC9, 0x40, 0x82, 0x91, 0x92, 0x61, 0x93}, {{"a", 3}}, 2},
+            {json::input_format_t::bon8, {0x8B, 0x91, 0x85, 0x91, 0xFE, 0xFA, 0x8B, 'x', 0x91, 0xFE, 0x61, 0x93, 0xFE}, {{"a", 3}}, 2},
+            // BSON: elements of types the library does not read become null
+            {
+                json::input_format_t::bson, bson_document(
+                {
+                    bson_element(0x07, "_id", bytes(12)),                         // ObjectId
+                    bson_element(0x09, "date", bytes(8)),                         // UTC datetime
+                    bson_element(0x13, "decimal", bytes(16)),                     // 128-bit decimal
+                    bson_element(0x0B, "regex", {'a', '+', 0, 'i', 0}),           // regular expression
+                    bson_element(0x0D, "code", bson_string("f()")),               // JavaScript code
+                    bson_element(0x0E, "symbol", bson_string("s")),               // symbol
+                    bson_element(0x0C, "pointer", concatenated({bson_string("c"), bytes(12)})), // DBPointer
+                    bson_element(0x0F, "scope", concatenated({bson_int32(15), bson_string("g"), bson_document({})})), // code with scope
+                    bson_element(0x06, "undefined", {}),                          // undefined
+                    bson_element(0xFF, "min", {}),                                // min key
+                    bson_element(0x7F, "max", {}),                                // max key
+                    bson_element(0x10, "z", bson_int32(7)),
+                }),
+                {{"_id", nullptr}, {"date", nullptr}, {"decimal", nullptr}, {"regex", nullptr}, {"code", nullptr}, {"symbol", nullptr}, {"pointer", nullptr}, {"scope", nullptr}, {"undefined", nullptr}, {"min", nullptr}, {"max", nullptr}, {"z", 7}},
+                11
+            },
+            // BSON: an element of an unknown type becomes null, and the rest of its document is skipped
+            {
+                json::input_format_t::bson, bson_document(
+                {
+                    bson_element(0x03, "inner", bson_document({bson_element(0x10, "a", bson_int32(1)), bson_element(0x42, "x", bytes(3)), bson_element(0x10, "b", bson_int32(2))})),
+                    bson_element(0x04, "array", bson_document({bson_element(0x10, "0", bson_int32(1)), bson_element(0x42, "1", bytes(3))})),
+                    bson_element(0x10, "after", bson_int32(3)),
+                }),
+                {{"inner", {{"a", 1}, {"x", nullptr}}}, {"array", {1, nullptr}}, {"after", 3}},
+                2
+            },
+            // BSON: so does a string or byte array whose length cannot be right
+            {
+                json::input_format_t::bson, bson_document(
+                {
+                    bson_element(0x03, "inner", bson_document({bson_element(0x02, "s", bson_string("abc", -10)), bson_element(0x10, "b", bson_int32(2))})),
+                    bson_element(0x03, "bin", bson_document({bson_element(0x05, "b", concatenated({bson_int32(-1), bytes(1)})), bson_element(0x10, "b", bson_int32(2))})),
+                    bson_element(0x10, "after", bson_int32(3)),
+                }),
+                {{"inner", {{"s", nullptr}}}, {"bin", {{"b", nullptr}}}, {"after", 3}},
+                2
+            },
+            // BSON: a string without its terminator, and a document whose size does not match, are kept
+            {
+                json::input_format_t::bson, bson_document(
+                {
+                    bson_element(0x02, "s", {2, 0, 0, 0, 'a', 'X'}),
+                    bson_element(0x03, "inner", bson_document({bson_element(0x10, "a", bson_int32(1))}, 1)),
+                }),
+                {{"s", "a"}, {"inner", {{"a", 1}}}},
+                2
+            },
+        };
+
+        for (const auto& repair : repairs)
+        {
+            CAPTURE(repair.format)
+            CAPTURE(repair.input)
+            const auto result = parse_binary_recovering(repair.input, repair.format);
+            CHECK(!result.ok);
+            CHECK(result.balanced);
+            CHECK(result.errors == repair.errors);
+            CHECK(result.value == repair.expected);
+            REQUIRE(!result.messages.empty());
+#if !defined(JSON_NOEXCEPTION)
+            // the first error is the one reported without recovering; under
+            // JSON_NOEXCEPTION, reading without recovering aborts instead of
+            // throwing, so there is no message to compare with
+            CHECK(result.messages.front() == binary_error_message(repair.input, repair.format));
+#endif
+        }
+    }
+
+    SECTION("binary formats repair numbers that are out of range")
+    {
+        // CBOR: a double too large for a float number_float_t
+        float_json cbor;
+        BasicRecoveringParser<float_json> sax(cbor);
+        const std::vector<std::uint8_t> cbor_input = {0x82, 0xFB, 0x7E, 0x37, 0xE4, 0x3C, 0x88, 0x00, 0x75, 0x9C, 0x01}; // [1e300, 1]
+        CHECK(!float_json::sax_parse(cbor_input, &sax, float_json::input_format_t::cbor));
+        CHECK(sax.errors == 1);
+        CHECK(sax.messages.front() == "[json.exception.out_of_range.406] syntax error while parsing CBOR value: number overflow");
+        REQUIRE(cbor.size() == 2);
+        CHECK(std::isinf(cbor[0].get<float>()));
+        CHECK(cbor[1] == 1);
+
+        // UBJSON: a high-precision number too large for number_float_t
+        const auto ubjson = parse_binary_recovering({'H', 'i', 5, '1', 'e', '9', '9', '9'}, json::input_format_t::ubjson);
+        CHECK(ubjson.errors == 1);
+        CHECK(ubjson.value.is_number_float());
+        CHECK(std::isinf(ubjson.value.get<double>()));
+    }
+
+    SECTION("binary formats stop where the end of an item is not known")
+    {
+        // a byte that begins no item
+        const auto cbor = parse_binary_recovering({0x82, 0x01, 0x1C, 0x02}, json::input_format_t::cbor);
+        CHECK(cbor.errors == 1);
+        CHECK(cbor.value == json({1}));
+
+        // a key that is no item: the unused MessagePack byte, a CBOR break
+        // in a map of known size, and the end of a BON8 container
+        const auto msgpack = parse_binary_recovering({0x82, 0xA1, 'a', 0x01, 0xC1, 0x02}, json::input_format_t::msgpack);
+        CHECK(msgpack.errors == 1);
+        CHECK(msgpack.value == json({{"a", 1}}));
+        const auto cbor_break = parse_binary_recovering({0xA2, 0x61, 'a', 0x01, 0xFF, 0x02}, json::input_format_t::cbor);
+        CHECK(cbor_break.errors == 1);
+        CHECK(cbor_break.value == json({{"a", 1}}));
+        const auto bon8 = parse_binary_recovering({0x88, 0x61, 0x91, 0xFE}, json::input_format_t::bon8);
+        CHECK(bon8.errors == 1);
+        CHECK(bon8.value == json({{"a", 1}}));
+
+        // an indefinite-length string inside an indefinite-length string
+        const auto nested = parse_binary_recovering({0x82, 0x01, 0x7F, 0x7F, 0x61, 'a', 0xFF, 0xFF}, json::input_format_t::cbor);
+        CHECK(nested.errors == 1);
+        CHECK(nested.value == json({1}));
+
+        // a BJData ndarray whose element type has no name: the object that
+        // holds the ndarray was already begun
+        const auto ndarray = parse_binary_recovering({'[', '$', 0x01, '#', '[', '$', 'i', '#', 'i', 2, 2, 3}, json::input_format_t::bjdata);
+        CHECK(ndarray.errors == 1);
+        CHECK(ndarray.balanced);
+        CHECK(ndarray.value == json::object());
+
+        // a skipped member that the input ends in
+        const auto truncated = parse_binary_recovering({0xA2, 0x01, 0x82, 0x01}, json::input_format_t::cbor);
+        CHECK(truncated.errors == 2);
+        CHECK(truncated.balanced);
+        CHECK(truncated.value == json::object());
+
+        // a BSON element of an unknown type in a document whose size cannot be right
+        const auto bson = parse_binary_recovering(bson_document({bson_element(0x10, "a", bson_int32(1)), bson_element(0x42, "x", bytes(3))}, -10), json::input_format_t::bson);
+        CHECK(bson.errors == 1);
+        CHECK(bson.value == json({{"a", 1}, {"x", nullptr}}));
+    }
+
+    SECTION("changed bytes in binary input")
+    {
+        const json j = {{"a", {1, -2, {{"b", "c"}}, json::array()}}, {"d", {{"e", nullptr}, {"f", true}}}, {"g", 1.5}, {"h", json::binary({1, 2, 3})}, {"i", "\xC3\xA4"}};
+
+        const std::vector<std::pair<json::input_format_t, std::vector<std::uint8_t>>> encodings =
+        {
+            {json::input_format_t::cbor, json::to_cbor(j)},
+            {json::input_format_t::msgpack, json::to_msgpack(j)},
+            {json::input_format_t::ubjson, json::to_ubjson(j)},
+            {json::input_format_t::ubjson, json::to_ubjson(j, true, true)},
+            {json::input_format_t::bjdata, json::to_bjdata(j)},
+            {json::input_format_t::bjdata, json::to_bjdata(j, true, true)},
+            {json::input_format_t::bson, json::to_bson(j)},
+            {json::input_format_t::bon8, json::to_bon8(j)},
+        };
+        const std::vector<std::uint8_t> replacements = {0x00, 0x01, 0x7F, 0x80, 0xC1, 0xD9, 0xE0, 0xF7, 0xFE, 0xFF};
+
+        for (const auto& encoding : encodings)
+        {
+            const auto format = encoding.first;
+            const auto& original = encoding.second;
+            CAPTURE(format)
+
+            std::vector<std::vector<std::uint8_t>> inputs;
+            for (std::size_t position = 0; position < original.size(); ++position)
+            {
+                for (const auto replacement : replacements)
+                {
+                    auto changed = original;
+                    changed[position] = replacement;
+                    inputs.push_back(changed);
+                }
+                auto removed = original;
+                removed.erase(removed.begin() + static_cast<std::ptrdiff_t>(position));
+                inputs.push_back(removed);
+            }
+
+            for (const auto& input : inputs)
+            {
+                CAPTURE(input)
+                const auto result = parse_binary_recovering(input, format);
+                CHECK(result.balanced);
+                CHECK(result.errors <= input.size() + 1);
+#if !defined(JSON_NOEXCEPTION)
+                // an error is reported exactly if reading into a JSON value
+                // fails, and the first one is the same (under JSON_NOEXCEPTION,
+                // that reading aborts instead of throwing)
+                const auto message = binary_error_message(input, format);
+                CHECK(result.ok == message.empty());
+                if (!result.ok && result.errors < 100)
+                {
+                    CHECK(result.messages.front() == message);
+                }
+#endif
+            }
+        }
+    }
+
+    SECTION("JSON text")
+    {
+        // the parser stopped, but reported success
+        json j;
+        RecoveringParser sax(j);
+        CHECK(!json::sax_parse("[1,2,3,]", &sax));
+        CHECK(sax.errors == 1);
+        CHECK(j == json({1, 2, 3}));
+    }
+
+    SECTION("the SAX parsers of the library stop")
+    {
+        json _;
+        CHECK(json::from_cbor(std::vector<std::uint8_t> {0x9F}, true, false).is_discarded());
+        CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<std::uint8_t> {0x9F}), "[json.exception.parse_error.110] parse error at byte 2: syntax error while parsing CBOR value: unexpected end of input", json::parse_error&);
+        CHECK(json::parse("[1,2,3,]", nullptr, false).is_discarded());
+        CHECK(!json::accept("[1,2,3,]"));
+    }
+}
+
+
+TEST_CASE("issue #5676 - SAX parsing of CBOR tags")
+{
+    const json expected = json::binary({1, 2, 3}, 42);
+    const auto cbor = json::to_cbor(expected);
+
+    nlohmann::detail::json_sax_acceptor<json> acceptor;
+    CHECK_FALSE(json::sax_parse(cbor, &acceptor, json::input_format_t::cbor));
+    CHECK_FALSE(json::sax_parse(cbor, &acceptor, json::input_format_t::cbor,
+                                true, false, false, json::cbor_tag_handler_t::error));
+
+    CHECK(json::sax_parse(cbor, &acceptor, json::input_format_t::cbor,
+                          true, false, false, json::cbor_tag_handler_t::ignore));
+
+    json parsed;
+    nlohmann::detail::json_sax_dom_parser<json, nlohmann::detail::string_input_adapter_type> sax(parsed);
+    CHECK(json::sax_parse(cbor, &sax, json::input_format_t::cbor,
+                          true, false, false, json::cbor_tag_handler_t::store));
+    CHECK(parsed == expected);
+
+    json iterator_parsed;
+    nlohmann::detail::json_sax_dom_parser<json, nlohmann::detail::string_input_adapter_type> iterator_sax(iterator_parsed);
+    CHECK(json::sax_parse(cbor.begin(), cbor.end(), &iterator_sax, json::input_format_t::cbor,
+                          true, false, false, json::cbor_tag_handler_t::store));
+    CHECK(iterator_parsed == expected);
+
+#ifndef JSON_TEST_DEPRECATED_FUNCTIONS_DELETED
+    json span_parsed;
+    nlohmann::detail::json_sax_dom_parser<json, nlohmann::detail::string_input_adapter_type> span_sax(span_parsed);
+    CHECK(json::sax_parse(nlohmann::detail::span_input_adapter(cbor.data(), cbor.size()), &span_sax,
+                          json::input_format_t::cbor, true, false, false, json::cbor_tag_handler_t::store));
+    CHECK(span_parsed == expected);
+#endif
+
+    const std::string text = "null";
+    CHECK(json::sax_parse(text, &acceptor, json::input_format_t::json,
+                          true, false, false, json::cbor_tag_handler_t::store));
+    CHECK(json::sax_parse(text.begin(), text.end(), &acceptor, json::input_format_t::json,
+                          true, false, false, json::cbor_tag_handler_t::store));
+#ifndef JSON_TEST_DEPRECATED_FUNCTIONS_DELETED
+    CHECK(json::sax_parse(nlohmann::detail::span_input_adapter(text.data(), text.size()), &acceptor,
+                          json::input_format_t::json, true, false, false, json::cbor_tag_handler_t::store));
+#endif
+}
+
+
+TEST_CASE("MessagePack SAX aborts")
+{
+    SECTION("start_array(len)")
+    {
+        std::vector<uint8_t> const v = {0x93, 0x01, 0x02, 0x03};
+        SaxCountdown scp(0);
+        CHECK(!json::sax_parse(v, &scp, json::input_format_t::msgpack));
+    }
+
+    SECTION("start_object(len)")
+    {
+        std::vector<uint8_t> const v = {0x81, 0xa3, 0x66, 0x6F, 0x6F, 0xc2};
+        SaxCountdown scp(0);
+        CHECK(!json::sax_parse(v, &scp, json::input_format_t::msgpack));
+    }
+
+    SECTION("key()")
+    {
+        std::vector<uint8_t> const v = {0x81, 0xa3, 0x66, 0x6F, 0x6F, 0xc2};
+        SaxCountdown scp(1);
+        CHECK(!json::sax_parse(v, &scp, json::input_format_t::msgpack));
+    }
+}
+
+TEST_CASE("issue #5405 - a user-defined SAX consumer is unaffected by the internal DOM reserve optimization")
+{
+    // the reserve() call is local to json_sax_dom_parser / json_sax_dom_callback_parser;
+    // a custom SAX consumer that does not touch a DOM array sees identical events
+    json j = json::array();
+    for (int i = 0; i < 100; ++i)
+    {
+        j.push_back(i);
+    }
+    const auto packed = json::to_msgpack(j);
+
+    SaxCountdown scp(1000000); // large enough to never trigger an abort
+    CHECK(json::sax_parse(packed, &scp, json::input_format_t::msgpack));
+}
+
+TEST_CASE("MessagePack nesting does not consume the call stack - SAX interface")
+{
+    // see the test case of the same name in unit-msgpack.cpp (#5104)
+    std::vector<uint8_t> input(300000, 0x91);
+    input.push_back(0x01); // innermost value
+
+    SaxCountdown accept_all(600001);
+    CHECK(json::sax_parse(input, &accept_all, json::input_format_t::msgpack));
+}
+
+TEST_CASE("MessagePack SAX parsing stops at every event")
+{
+    // Containers are opened and closed by the loop that reads them; a SAX
+    // handler that rejects any event - including the end of a nested
+    // container - must stop the parse right there.
+    const auto count_events = [](const std::vector<std::uint8_t>& input)
+    {
+        int events = 0;
+        while (true)
+        {
+            SaxCountdown scp(events);
+            if (json::sax_parse(input, &scp, json::input_format_t::msgpack))
+            {
+                return events;
+            }
+            ++events;
+            REQUIRE(events < 1000);
+        }
+    };
+
+    // 20 events: every container kind closes inside another one
+    const json j = json::parse(R"({"a": [1, {"b": []}], "c": {"d": [[2]]}})");
+    CHECK(count_events(json::to_msgpack(j)) == 20);
+}
+
+DOCTEST_CLANG_SUPPRESS_WARNING_POP

tests/src/unit-ubjson.cpp

@@ -2023,7 +2023,7 @@ TEST_CASE("UBJSON")
             CHECK(json::from_ubjson(v0, true, false).is_discarded());
 
             std::vector<uint8_t> const vi = {'[', '$', '#'};
-            CHECK_THROWS_WITH_AS(_ = json::from_ubjson(vi), "[json.exception.parse_error.112] parse error at byte 3: syntax error while parsing UBJSON type: marker 0x23 is not a permitted optimized array type", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::from_ubjson(vi), "[json.exception.parse_error.110] parse error at byte 4: syntax error while parsing UBJSON value: unexpected end of input", json::parse_error&);
             CHECK(json::from_ubjson(vi, true, false).is_discarded());
 
             std::vector<uint8_t> const vT = {'[', '$', 'T'};
@@ -3348,55 +3348,3 @@ TEST_CASE("UBJSON large strings (chunked reader)")
         }
     }
 }
-
-TEST_CASE("UBJSON optimized container type marker is validated for count 0")
-{
-    // the '$' type marker must be a legal marker even if no element follows
-    SECTION("invalid marker")
-    {
-        for (const char marker :
-                {'x', 'E', 'B', 'u', 'm', 'M', 'h'
-                })
-        {
-            for (const char open :
-                    {'[', '{'
-                    })
-            {
-                for (const int count :
-                        {
-                            0, 1
-                        })
-                {
-                    CAPTURE(marker)
-                    CAPTURE(open)
-                    CAPTURE(count)
-                    const std::vector<std::uint8_t> v = {static_cast<std::uint8_t>(open), '$', static_cast<std::uint8_t>(marker), '#', 'i', static_cast<std::uint8_t>(count)};
-                    json _;
-                    CHECK_THROWS_AS(_ = json::from_ubjson(v), json::parse_error&);
-                    CHECK(json::from_ubjson(v, true, false).is_discarded());
-                }
-            }
-        }
-    }
-
-    SECTION("error message")
-    {
-        const std::vector<std::uint8_t> v = {'[', '$', 'x', '#', 'i', 0};
-        json _;
-        CHECK_THROWS_WITH_AS(_ = json::from_ubjson(v), "[json.exception.parse_error.112] parse error at byte 3: syntax error while parsing UBJSON type: marker 0x78 is not a permitted optimized array type", json::parse_error&);
-    }
-
-    SECTION("valid marker")
-    {
-        for (const char marker :
-                {'Z', 'N', 'T', 'F', 'i', 'U', 'I', 'l', 'L', 'd', 'D', 'H', 'C', 'S', '[', '{'
-                })
-        {
-            CAPTURE(marker)
-            const std::vector<std::uint8_t> va = {'[', '$', static_cast<std::uint8_t>(marker), '#', 'i', 0};
-            const std::vector<std::uint8_t> vo = {'{', '$', static_cast<std::uint8_t>(marker), '#', 'i', 0};
-            CHECK(json::from_ubjson(va) == json::array());
-            CHECK(json::from_ubjson(vo) == json::object());
-        }
-    }
-}