Reject malformed UTF-16/UTF-32 units in wide-string input

The wide-string input adapter (used for std::u16string, std::u32string,
std::wstring, and iterators over 2- or 4-byte character types) passed
some malformed code units on to the lexer as values that are neither a
byte (0x00..0xFF) nor char_traits<char>::eof(). As a result:

- A lone UTF-16 surrogate inside true/false/null was accepted if its low
  byte matched the expected letter, or ended the input silently if it
  was the last unit.
- A high surrogate followed by a unit that is not its low surrogate
  swallowed that unit; if the swallowed unit was the newline ending a
  // comment, the comment silently extended over the next line.
- Where wint_t is a signed int (macOS, the BSDs), a negative wchar_t
  collided with char_traits<char>::eof() (ending the input early) or was
  truncated to its low byte, depending on its value.

The UTF-32 helper now converts the code unit to std::uint32_t before the
range checks, so a negative unit reaches the same "emit 0xFF" branch
already used for code points above U+10FFFF. The UTF-16 helper now
peeks at the next unit before consuming it, and emits 0xFF instead of
the raw surrogate when no valid pair is found, matching how ill-formed
UTF-8 bytes are rejected elsewhere in the lexer.

Fixes #5645.
Signed-off-by: Niels Lohmann <mail@nlohmann.me>

docs/mkdocs/docs/features/binary_formats/bjdata.md

@@ -132,14 +132,8 @@ The library uses the following mapping from JSON values types to BJData types ac
       parsed back as a regular array,
     - every entry of `"_ArraySize_"` is a positive integer, and their product is representable as a `std::size_t`,
     - `"_ArrayData_"` is an array holding exactly that many elements, and
-    - every element of `"_ArrayData_"` is a number of the kind named by `"_ArrayType_"`: for the integer types, a
-      value that fits the named width; for `double`, any value; for `single`, a value that survives narrowing to
-      `float` and back without change (for instance, `0.1` does not, since it is not exactly representable as
-      `float`).
-
-    An annotated object is always read back with its keys in the order shown above, `"_ArrayType_"`, `"_ArraySize_"`,
-    `"_ArrayData_"`, regardless of the order the ND-array's header stores them in on the wire. This matters for
-    `ordered_json`, whose comparison takes key order into account.
+    - every element of `"_ArrayData_"` is a number of the kind named by `"_ArrayType_"` (a floating-point number for
+      `single` and `double`, an integer otherwise).
 
     The current version of this library does not yet support automatic detection of and conversion from a nested JSON
     array input to a BJData ND-array.

include/nlohmann/detail/input/binary_reader.hpp

@@ -2728,15 +2728,10 @@ class binary_reader
                                is_ndarray can only return `true` when its initial value
                                is `false`
     @param[in] prefix  type marker if already read, otherwise set to 0
-    @param[in] ndarray_dtype  the element type marker of the enclosing bjdata ndarray if
-                              already known (it precedes the dimension vector read here),
-                              otherwise 0; used to emit the "_ArrayType_" annotation key
-                              before "_ArraySize_" if a dimension vector turns out to
-                              describe an ndarray
 
     @return whether size determination completed
     */
-    bool get_ubjson_size_value(std::size_t& result, bool& is_ndarray, char_int_type prefix = 0, char_int_type ndarray_dtype = 0)
+    bool get_ubjson_size_value(std::size_t& result, bool& is_ndarray, char_int_type prefix = 0)
     {
         if (prefix == 0)
         {
@@ -2906,37 +2901,8 @@ class binary_reader
                         }
                     }
 
-                    if (JSON_HEDLEY_UNLIKELY(!sax->start_object(3)))
-                    {
-                        return false;
-                    }
-
-                    // the element type precedes the dimension vector (see get_ubjson_size_type)
-                    // and is passed down as ndarray_dtype; emit it here so the annotation keys
-                    // follow the documented _ArrayType_, _ArraySize_, _ArrayData_ order
-                    if (ndarray_dtype != 0)
-                    {
-                        auto it = std::lower_bound(bjd_types_map.begin(), bjd_types_map.end(), ndarray_dtype, [](const bjd_type & p, char_int_type t)
-                        {
-                            return p.first < t;
-                        });
-                        if (JSON_HEDLEY_UNLIKELY(it == bjd_types_map.end() || it->first != ndarray_dtype))
-                        {
-                            auto last_token = get_token_string();
-                            return sax->parse_error(chars_read, last_token, parse_error::create(112, chars_read,
-                                                    exception_message(input_format, "invalid byte: 0x" + last_token, "type"), nullptr));
-                        }
-
-                        string_t type_key = "_ArrayType_";
-                        string_t type = it->second; // sax->string() takes a reference
-                        if (JSON_HEDLEY_UNLIKELY(!sax->key(type_key) || !sax->string(type)))
-                        {
-                            return false;
-                        }
-                    }
-
                     string_t key = "_ArraySize_";
-                    if (JSON_HEDLEY_UNLIKELY(!sax->key(key) || !sax->start_array(dim.size())))
+                    if (JSON_HEDLEY_UNLIKELY(!sax->start_object(3) || !sax->key(key) || !sax->start_array(dim.size())))
                     {
                         return false;
                     }
@@ -3037,7 +3003,7 @@ class binary_reader
                                         exception_message(input_format, concat("expected '#' after type information; last byte: 0x", last_token), "size"), nullptr));
             }
 
-            const bool is_error = get_ubjson_size_value(result.first, is_ndarray, 0, result.second);
+            const bool is_error = get_ubjson_size_value(result.first, is_ndarray);
             // an ndarray was read here only if the flag flipped; when it was
             // seeded true, get_ubjson_size_value() already rejected the nested
             // dimension vector
@@ -3273,17 +3239,30 @@ class binary_reader
         if (input_format == input_format_t::bjdata && size_and_type.first != npos && (size_and_type.second & (1 << 8)) != 0)
         {
             size_and_type.second &= ~(static_cast<char_int_type>(1) << 8);  // use bit 8 to indicate ndarray, here we remove the bit to restore the type marker
+            auto it = std::lower_bound(bjd_types_map.begin(), bjd_types_map.end(), size_and_type.second, [](const bjd_type & p, char_int_type t)
+            {
+                return p.first < t;
+            });
+            string_t key = "_ArrayType_";
+            if (JSON_HEDLEY_UNLIKELY(it == bjd_types_map.end() || it->first != size_and_type.second))
+            {
+                auto last_token = get_token_string();
+                return sax->parse_error(chars_read, last_token, parse_error::create(112, chars_read,
+                                        exception_message(input_format, "invalid byte: 0x" + last_token, "type"), nullptr));
+            }
+
+            string_t type = it->second; // sax->string() takes a reference
+            if (JSON_HEDLEY_UNLIKELY(!sax->key(key) || !sax->string(type)))
+            {
+                return false;
+            }
 
-            // the "_ArrayType_" and "_ArraySize_" annotation keys were already emitted by
-            // get_ubjson_size_value() (the type marker is known before the dimension vector
-            // that determines size_and_type.first is read, so it is emitted first there to
-            // match the documented _ArrayType_, _ArraySize_, _ArrayData_ key order)
             if (size_and_type.second == 'C' || size_and_type.second == 'B')
             {
                 size_and_type.second = 'U';
             }
 
-            string_t key = "_ArrayData_";
+            key = "_ArrayData_";
             if (JSON_HEDLEY_UNLIKELY(!sax->key(key) || !sax->start_array(size_and_type.first) ))
             {
                 return false;

include/nlohmann/detail/input/input_adapters.hpp

@@ -445,8 +445,10 @@ struct wide_string_input_helper<BaseInputAdapter, 4>
         }
         else
         {
-            // get the current character
-            const auto wc = input.get_character();
+            // get the current character; converted to an unsigned type so that
+            // a negative unit (wint_t is signed on some platforms) is not
+            // mistaken for an ASCII character or for EOF
+            const auto wc = static_cast<std::uint32_t>(input.get_character());
 
             // UTF-32 to UTF-8 encoding
             if (wc < 0x80)
@@ -541,9 +543,11 @@ struct wide_string_input_helper<BaseInputAdapter, 2>
                 bool valid_pair = false;
                 if (wc <= 0xDBFF && JSON_HEDLEY_UNLIKELY(!input.empty()))
                 {
-                    const auto wc2 = static_cast<unsigned int>(input.get_character());
+                    // only consume the next unit if it completes the pair
+                    const auto wc2 = static_cast<unsigned int>(*input.current);
                     if (0xDC00 <= wc2 && wc2 <= 0xDFFF)
                     {
+                        input.get_character();
                         const auto charcode = 0x10000u + (((static_cast<unsigned int>(wc) & 0x3FFu) << 10u) | (wc2 & 0x3FFu));
                         utf8_bytes[0] = static_cast<std::char_traits<char>::int_type>(0xF0u | (charcode >> 18u));
                         utf8_bytes[1] = static_cast<std::char_traits<char>::int_type>(0x80u | ((charcode >> 12u) & 0x3Fu));
@@ -556,7 +560,8 @@ struct wide_string_input_helper<BaseInputAdapter, 2>
 
                 if (!valid_pair)
                 {
-                    utf8_bytes[0] = static_cast<std::char_traits<char>::int_type>(wc);
+                    // emit a byte that is never valid UTF-8 (see the UTF-32 case)
+                    utf8_bytes[0] = 0xFF;
                     utf8_bytes_filled = 1;
                 }
             }

include/nlohmann/detail/output/binary_writer.hpp

@@ -1991,21 +1991,9 @@ class binary_writer
                 case 'd':
                 {
                     const auto dval = el.template get<double>();
-#ifdef __GNUC__
-                    JSON_HEDLEY_DIAGNOSTIC_PUSH
-                    JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
-#endif
-                    // a value that would be rounded (rather than exactly represented) by the
-                    // narrowing to float is treated like an out-of-range integer element above;
-                    // this is the same criterion write_compact_float() uses for CBOR/MessagePack
-                    in_range = std::isnan(dval) ||
+                    in_range = !std::isfinite(dval) ||
                                (dval >= static_cast<double>(std::numeric_limits<float>::lowest()) &&
-                                dval <= static_cast<double>((std::numeric_limits<float>::max)()) &&
-                                static_cast<double>(static_cast<float>(dval)) == dval) ||
-                               std::isinf(dval);
-#ifdef __GNUC__
-                    JSON_HEDLEY_DIAGNOSTIC_POP
-#endif
+                                dval <= static_cast<double>((std::numeric_limits<float>::max)()));
                     break;
                 }
                 default:

single_include/nlohmann/json.hpp

@@ -7989,8 +7989,10 @@ struct wide_string_input_helper<BaseInputAdapter, 4>
         }
         else
         {
-            // get the current character
-            const auto wc = input.get_character();
+            // get the current character; converted to an unsigned type so that
+            // a negative unit (wint_t is signed on some platforms) is not
+            // mistaken for an ASCII character or for EOF
+            const auto wc = static_cast<std::uint32_t>(input.get_character());
 
             // UTF-32 to UTF-8 encoding
             if (wc < 0x80)
@@ -8085,9 +8087,11 @@ struct wide_string_input_helper<BaseInputAdapter, 2>
                 bool valid_pair = false;
                 if (wc <= 0xDBFF && JSON_HEDLEY_UNLIKELY(!input.empty()))
                 {
-                    const auto wc2 = static_cast<unsigned int>(input.get_character());
+                    // only consume the next unit if it completes the pair
+                    const auto wc2 = static_cast<unsigned int>(*input.current);
                     if (0xDC00 <= wc2 && wc2 <= 0xDFFF)
                     {
+                        input.get_character();
                         const auto charcode = 0x10000u + (((static_cast<unsigned int>(wc) & 0x3FFu) << 10u) | (wc2 & 0x3FFu));
                         utf8_bytes[0] = static_cast<std::char_traits<char>::int_type>(0xF0u | (charcode >> 18u));
                         utf8_bytes[1] = static_cast<std::char_traits<char>::int_type>(0x80u | ((charcode >> 12u) & 0x3Fu));
@@ -8100,7 +8104,8 @@ struct wide_string_input_helper<BaseInputAdapter, 2>
 
                 if (!valid_pair)
                 {
-                    utf8_bytes[0] = static_cast<std::char_traits<char>::int_type>(wc);
+                    // emit a byte that is never valid UTF-8 (see the UTF-32 case)
+                    utf8_bytes[0] = 0xFF;
                     utf8_bytes_filled = 1;
                 }
             }
@@ -15495,15 +15500,10 @@ class binary_reader
                                is_ndarray can only return `true` when its initial value
                                is `false`
     @param[in] prefix  type marker if already read, otherwise set to 0
-    @param[in] ndarray_dtype  the element type marker of the enclosing bjdata ndarray if
-                              already known (it precedes the dimension vector read here),
-                              otherwise 0; used to emit the "_ArrayType_" annotation key
-                              before "_ArraySize_" if a dimension vector turns out to
-                              describe an ndarray
 
     @return whether size determination completed
     */
-    bool get_ubjson_size_value(std::size_t& result, bool& is_ndarray, char_int_type prefix = 0, char_int_type ndarray_dtype = 0)
+    bool get_ubjson_size_value(std::size_t& result, bool& is_ndarray, char_int_type prefix = 0)
     {
         if (prefix == 0)
         {
@@ -15673,37 +15673,8 @@ class binary_reader
                         }
                     }
 
-                    if (JSON_HEDLEY_UNLIKELY(!sax->start_object(3)))
-                    {
-                        return false;
-                    }
-
-                    // the element type precedes the dimension vector (see get_ubjson_size_type)
-                    // and is passed down as ndarray_dtype; emit it here so the annotation keys
-                    // follow the documented _ArrayType_, _ArraySize_, _ArrayData_ order
-                    if (ndarray_dtype != 0)
-                    {
-                        auto it = std::lower_bound(bjd_types_map.begin(), bjd_types_map.end(), ndarray_dtype, [](const bjd_type & p, char_int_type t)
-                        {
-                            return p.first < t;
-                        });
-                        if (JSON_HEDLEY_UNLIKELY(it == bjd_types_map.end() || it->first != ndarray_dtype))
-                        {
-                            auto last_token = get_token_string();
-                            return sax->parse_error(chars_read, last_token, parse_error::create(112, chars_read,
-                                                    exception_message(input_format, "invalid byte: 0x" + last_token, "type"), nullptr));
-                        }
-
-                        string_t type_key = "_ArrayType_";
-                        string_t type = it->second; // sax->string() takes a reference
-                        if (JSON_HEDLEY_UNLIKELY(!sax->key(type_key) || !sax->string(type)))
-                        {
-                            return false;
-                        }
-                    }
-
                     string_t key = "_ArraySize_";
-                    if (JSON_HEDLEY_UNLIKELY(!sax->key(key) || !sax->start_array(dim.size())))
+                    if (JSON_HEDLEY_UNLIKELY(!sax->start_object(3) || !sax->key(key) || !sax->start_array(dim.size())))
                     {
                         return false;
                     }
@@ -15804,7 +15775,7 @@ class binary_reader
                                         exception_message(input_format, concat("expected '#' after type information; last byte: 0x", last_token), "size"), nullptr));
             }
 
-            const bool is_error = get_ubjson_size_value(result.first, is_ndarray, 0, result.second);
+            const bool is_error = get_ubjson_size_value(result.first, is_ndarray);
             // an ndarray was read here only if the flag flipped; when it was
             // seeded true, get_ubjson_size_value() already rejected the nested
             // dimension vector
@@ -16040,17 +16011,30 @@ class binary_reader
         if (input_format == input_format_t::bjdata && size_and_type.first != npos && (size_and_type.second & (1 << 8)) != 0)
         {
             size_and_type.second &= ~(static_cast<char_int_type>(1) << 8);  // use bit 8 to indicate ndarray, here we remove the bit to restore the type marker
+            auto it = std::lower_bound(bjd_types_map.begin(), bjd_types_map.end(), size_and_type.second, [](const bjd_type & p, char_int_type t)
+            {
+                return p.first < t;
+            });
+            string_t key = "_ArrayType_";
+            if (JSON_HEDLEY_UNLIKELY(it == bjd_types_map.end() || it->first != size_and_type.second))
+            {
+                auto last_token = get_token_string();
+                return sax->parse_error(chars_read, last_token, parse_error::create(112, chars_read,
+                                        exception_message(input_format, "invalid byte: 0x" + last_token, "type"), nullptr));
+            }
+
+            string_t type = it->second; // sax->string() takes a reference
+            if (JSON_HEDLEY_UNLIKELY(!sax->key(key) || !sax->string(type)))
+            {
+                return false;
+            }
 
-            // the "_ArrayType_" and "_ArraySize_" annotation keys were already emitted by
-            // get_ubjson_size_value() (the type marker is known before the dimension vector
-            // that determines size_and_type.first is read, so it is emitted first there to
-            // match the documented _ArrayType_, _ArraySize_, _ArrayData_ key order)
             if (size_and_type.second == 'C' || size_and_type.second == 'B')
             {
                 size_and_type.second = 'U';
             }
 
-            string_t key = "_ArrayData_";
+            key = "_ArrayData_";
             if (JSON_HEDLEY_UNLIKELY(!sax->key(key) || !sax->start_array(size_and_type.first) ))
             {
                 return false;
@@ -22342,21 +22326,9 @@ class binary_writer
                 case 'd':
                 {
                     const auto dval = el.template get<double>();
-#ifdef __GNUC__
-                    JSON_HEDLEY_DIAGNOSTIC_PUSH
-                    JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
-#endif
-                    // a value that would be rounded (rather than exactly represented) by the
-                    // narrowing to float is treated like an out-of-range integer element above;
-                    // this is the same criterion write_compact_float() uses for CBOR/MessagePack
-                    in_range = std::isnan(dval) ||
+                    in_range = !std::isfinite(dval) ||
                                (dval >= static_cast<double>(std::numeric_limits<float>::lowest()) &&
-                                dval <= static_cast<double>((std::numeric_limits<float>::max)()) &&
-                                static_cast<double>(static_cast<float>(dval)) == dval) ||
-                               std::isinf(dval);
-#ifdef __GNUC__
-                    JSON_HEDLEY_DIAGNOSTIC_POP
-#endif
+                                dval <= static_cast<double>((std::numeric_limits<float>::max)()));
                     break;
                 }
                 default:

tests/src/unit-bjdata.cpp

@@ -11,7 +11,6 @@
 #define JSON_TESTS_PRIVATE
 #include <nlohmann/json.hpp>
 using nlohmann::json;
-using ordered_json = nlohmann::ordered_json;
 
 #include <algorithm>
 #include <climits>
@@ -2295,33 +2294,29 @@ TEST_CASE("BJData")
 
         SECTION("start_array() in ndarray _ArraySize_")
         {
-            // _ArrayType_ (2 events: key + string) is now emitted before
-            // _ArraySize_ (see GitHub issue #5661), which shifts the events
-            // below later by the same 2 events
             std::vector<uint8_t> const v = {'[', '$', 'i', '#', '[', '$', 'i', '#', 'i', 2, 2, 1, 1, 2};
-            SaxCountdown scp(4);
+            SaxCountdown scp(2);
             CHECK_FALSE(json::sax_parse(v, &scp, json::input_format_t::bjdata));
         }
 
         SECTION("number_integer() in ndarray _ArraySize_")
         {
             std::vector<uint8_t> const v = {'[', '$', 'U', '#', '[', '$', 'i', '#', 'i', 2, 2, 1, 1, 2};
-            SaxCountdown scp(5);
+            SaxCountdown scp(3);
             CHECK_FALSE(json::sax_parse(v, &scp, json::input_format_t::bjdata));
         }
 
         SECTION("key() in ndarray _ArrayType_")
         {
-            // _ArrayType_ is emitted right after start_object(), before _ArraySize_
             std::vector<uint8_t> const v = {'[', '$', 'U', '#', '[', '$', 'U', '#', 'i', 2, 2, 2, 1, 2, 3, 4};
-            SaxCountdown scp(1);
+            SaxCountdown scp(6);
             CHECK_FALSE(json::sax_parse(v, &scp, json::input_format_t::bjdata));
         }
 
         SECTION("string() in ndarray _ArrayType_")
         {
             std::vector<uint8_t> const v = {'[', '$', 'U', '#', '[', '$', 'U', '#', 'i', 2, 2, 2, 1, 2, 3, 4};
-            SaxCountdown scp(2);
+            SaxCountdown scp(7);
             CHECK_FALSE(json::sax_parse(v, &scp, json::input_format_t::bjdata));
         }
 
@@ -2924,22 +2919,6 @@ TEST_CASE("BJData")
                 CHECK(out_single.at(0) == '{');
                 CHECK(json::from_bjdata(out_single) == j_single);
 
-                // a double element that is finite and within the range of "single"
-                // but is not exactly representable as a float, so narrowing it would
-                // silently round it (0.1 is read back as 0.10000000149011612); this,
-                // like the overflow case above, falls back to a plain object (see
-                // GitHub issue #5661)
-                json const j_single_rounded = json({{"_ArrayType_", "single"}, {"_ArraySize_", {2, 1}}, {"_ArrayData_", {1.5, 0.1}}});
-                const auto out_single_rounded = json::to_bjdata(j_single_rounded);
-                CHECK(out_single_rounded.at(0) == '{');
-                CHECK(json::from_bjdata(out_single_rounded) == j_single_rounded);
-
-                // a double element that underflows to 0 when narrowed to "single"
-                json const j_single_underflow = json({{"_ArrayType_", "single"}, {"_ArraySize_", {2, 1}}, {"_ArrayData_", {1.5, 1e-300}}});
-                const auto out_single_underflow = json::to_bjdata(j_single_underflow);
-                CHECK(out_single_underflow.at(0) == '{');
-                CHECK(json::from_bjdata(out_single_underflow) == j_single_underflow);
-
                 // in-range boundary values still use the compact ndarray encoding
                 json const j_uint8_ok = json({{"_ArrayType_", "uint8"}, {"_ArraySize_", {2, 1}}, {"_ArrayData_", {0, 255}}});
                 CHECK(json::to_bjdata(j_uint8_ok) == std::vector<uint8_t>({'[', '$', 'U', '#', '[', 'i', 2, 'i', 1, ']', 0, 255}));
@@ -2953,23 +2932,6 @@ TEST_CASE("BJData")
                 CHECK(json::from_bjdata(out_single_ok) == json({{"_ArrayType_", "single"}, {"_ArraySize_", {2, 1}}, {"_ArrayData_", {1.5f, -1.5f}}}));
             }
 
-            SECTION("ndarray annotation keys are read back in the documented order")
-            {
-                // from_bjdata() must emit the annotation object's keys in the order
-                // used throughout the documentation, _ArrayType_, _ArraySize_,
-                // _ArrayData_: the type marker precedes the dimension vector on the
-                // wire (see get_ubjson_size_type()), so it is known, and emitted,
-                // before _ArraySize_. For a plain json this key order is invisible
-                // (its comparison ignores it), but for an ordered_json it is not (see
-                // GitHub issue #5661).
-                const ordered_json o = ordered_json::parse(R"({"_ArrayType_":"uint8","_ArraySize_":[2,2],"_ArrayData_":[1,2,3,4]})");
-                const auto packed = ordered_json::to_bjdata(o);
-                CHECK(packed.at(0) == '[');
-                const ordered_json o_back = ordered_json::from_bjdata(packed);
-                CHECK(o_back == o);
-                CHECK(o_back.dump() == o.dump());
-            }
-
             SECTION("ndarray that would not be read back as an annotated object stays as object")
             {
                 // the reader only restores an annotated object from an ND-array

tests/src/unit-wstring.cpp

@@ -8,6 +8,7 @@
 
 #include "doctest_compatibility.h"
 
+#include <cwchar>
 #include <nlohmann/json.hpp>
 using nlohmann::json;
 
@@ -98,15 +99,15 @@ TEST_CASE("wide strings")
             CHECK_THROWS_AS(_ = json::parse(w), json::parse_error&);
 
             // a lone low surrogate cannot start a pair
-            CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'"', 0xDC00, u'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"<U+0000>'", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'"', 0xDC00, u'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"\xFF'", json::parse_error&);
             // a high surrogate followed by a non-low-surrogate unit is invalid
-            CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'"', 0xD800, u'a', u'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"<U+0000>'", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'"', 0xD800, u'a', u'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"\xFF'", json::parse_error&);
             // ... also when the unit is above the low surrogates
-            CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'"', 0xD800, 0xE000, u'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"<U+0000>'", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'"', 0xD800, 0xE000, u'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"\xFF'", json::parse_error&);
             // a lone low surrogate must not swallow the following unit: pairing
             // it with any second unit would produce valid UTF-8, so the error
             // has to report an ill-formed byte at the surrogate's own position
-            CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'"', 0xDC00, u'a', u'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"<U+0000>'", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'"', 0xDC00, u'a', u'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"\xFF'", json::parse_error&);
             // a valid surrogate pair is still decoded (U+1F600)
             CHECK(json::parse(std::u16string{u'"', 0xD83D, 0xDE00, u'"'}).get<std::string>() == "\xF0\x9F\x98\x80");
         }
@@ -141,5 +142,56 @@ TEST_CASE("wide strings")
             CHECK_THROWS_WITH_AS(_ = json::parse(std::u32string{U'"', static_cast<char32_t>(0xFFFFFFFF), U'"'}), "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid string: ill-formed UTF-8 byte; last read: '\"\xFF'", json::parse_error&);
         }
     }
+
+    SECTION("malformed wide-string input outside strings (#5645)")
+    {
+        json _;
+
+        // a lone low surrogate inside a literal must not be truncated to its
+        // low byte and mistaken for the letter the literal expects next
+        // (0xDC72 truncates to 'r', which is what "true" expects after 't')
+        CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u't', static_cast<char16_t>(0xDC72), u'u', u'e'}),
+                             "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid literal; last read: 't\xFF'", json::parse_error&);
+
+        // ... also when the lone surrogate is the last unit of the input
+        CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u'f', u'a', u'l', u's', static_cast<char16_t>(0xDD65)}),
+                             "[json.exception.parse_error.101] parse error at line 1, column 5: syntax error while parsing value - invalid literal; last read: 'fals\xFF'", json::parse_error&);
+
+        // a high surrogate followed by a unit that is not its low surrogate
+        // must not silently swallow that unit
+        CHECK_THROWS_WITH_AS(_ = json::parse(std::u16string{u't', static_cast<char16_t>(0xD872), u'X', u'u', u'e'}),
+                             "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid literal; last read: 't\xFF'", json::parse_error&);
+
+        // ... in particular, if the swallowed unit is the newline that ends a
+        // // comment, the comment must not extend over the following line
+        CHECK(json::parse(std::u16string{u'[', u'1', u' ', u'/', u'/', static_cast<char16_t>(0xD800), u'\n',
+                                         u',', u'2', u' ', u'/', u'/', u'\n', u']'},
+                          nullptr, true, /*ignore_comments*/true) == json::parse("[1,2]"));
+        CHECK(json::accept(std::u16string{u'[', u'1', u' ', u'/', u'/', static_cast<char16_t>(0xD800), u'\n',
+                                          u',', u'2', u' ', u'/', u'/', u'\n', u']'}, /*ignore_comments*/true));
+
+        // cases 5 and 6 use a 32-bit wchar_t (Linux, macOS, the BSDs) to reach
+        // the UTF-32 helper tested above via u32string; the 16-bit wchar_t of
+        // Windows goes through the UTF-16 helper instead, already covered by
+        // the u16string cases above
+#if WCHAR_MAX > 0xFFFFu
+        // a negative wchar_t must not be mistaken for
+        // char_traits<char>::eof() and silently end the input, letting
+        // trailing garbage pass the strict end-of-input check (only observable
+        // where wint_t is signed, e.g. macOS/the BSDs; on Linux wint_t is
+        // unsigned and this was already handled by #5348)
+        std::wstring w = L"[1]";
+        w.push_back(static_cast<wchar_t>(-1));
+        w += L"garbage";
+        CHECK(!json::accept(w));
+        CHECK_THROWS_WITH_AS(_ = json::parse(w),
+                             "[json.exception.parse_error.101] parse error at line 1, column 4: syntax error while parsing value - invalid literal; last read: '1]\xFF'; expected end of input", json::parse_error&);
+
+        // other negative wchar_t units must not be truncated to their low
+        // byte (0xFFFFFF72 truncates to 'r', as in the u16string case above)
+        CHECK_THROWS_WITH_AS(_ = json::parse(std::wstring{L't', static_cast<wchar_t>(0xFFFFFF72), L'u', L'e'}),
+                             "[json.exception.parse_error.101] parse error at line 1, column 2: syntax error while parsing value - invalid literal; last read: 't\xFF'", json::parse_error&);
+#endif
+    }
 }
 #endif