Throw std::length_error for operator[](SIZE_MAX) instead of corrupting the array

For idx == SIZE_MAX, the non-const array operator[] computed the new size as
idx + 1, which wraps to 0. resize(0) then emptied the array, and the
subsequent operator[](idx) on the now-empty vector wrote one element before
its buffer. Every other too-large index (e.g. SIZE_MAX - 1) already went
through resize(), which throws std::length_error and leaves the array
unchanged; SIZE_MAX was the one value for which the overflow bypassed that
safety net.

Add a guard that throws std::length_error before computing idx + 1 when idx
is the largest representable size_type value, so the array is left
unchanged, matching the exception vector::resize() already throws for
smaller (but still too large) indices.

Fixes #5647.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

docs/mkdocs/docs/api/basic_json/operator[].md

@@ -70,6 +70,9 @@ Strong exception safety: if an exception occurs, the original value stays intact
 1. The function can throw the following exceptions:
     - Throws [`type_error.305`](../../home/exceptions.md#jsonexceptiontype_error305) if the JSON value is not an array
       or null; in that case, using the `[]` operator with an index makes no sense.
+    - Throws `#!cpp std::length_error` if `idx` equals the maximum value of `size_type`; the array is left unchanged.
+      (This is the one index for which growing the array to hold it cannot be expressed as a `size_type` size, the same
+      way an oversized [`resize`](https://en.cppreference.com/w/cpp/container/vector/resize) throws.)
 2. The function can throw the following exceptions:
     - Throws [`type_error.305`](../../home/exceptions.md#jsonexceptiontype_error305) if the JSON value is not an object
       or null; in that case, using the `[]` operator with a key makes no sense.
@@ -257,7 +260,8 @@ Strong exception safety: if an exception occurs, the original value stays intact
 
 ## Version history
 
-1. Added in version 1.0.0.
+1. Added in version 1.0.0. Fixed in version 3.13.0 to throw `#!cpp std::length_error` instead of emptying the array and
+   accessing it out of bounds when `idx` equals the maximum value of `size_type`.
 2. Added in version 1.0.0. Added overloads for `T* key` in version 1.1.0. Removed overloads for `T* key` (replaced by 3)
    in version 3.11.0.
 3. Added in version 3.11.0. Fixed in version 3.13.0 to consistently accept `std::string_view`-convertible keys, as

include/nlohmann/detail/macro_scope.hpp

@@ -336,7 +336,7 @@ void templated_json_throw(ExceptionType exception)
             return ej_pair.second == j;                                                         \
         });                                                                                     \
         if (it != std::end(m)) e = it->first;                                                   \
-        else templated_json_throw<nlohmann::detail::out_of_range>(nlohmann::detail::out_of_range::create(410, nlohmann::detail::concat("enum value out of range for " #ENUM_TYPE ": ", j.dump(-1, ' ', false, nlohmann::detail::error_handler_t::replace)), &j)); \
+        else templated_json_throw<nlohmann::detail::out_of_range>(nlohmann::detail::out_of_range::create(410,"enum value out of range for " #ENUM_TYPE ": " + j.dump(), &j)); \
     }
 
 // Ugly macros to avoid uglier copy-paste when specializing basic_json. They

include/nlohmann/json.hpp

@@ -36,7 +36,9 @@
     #include <iosfwd> // istream, ostream
 #endif  // JSON_NO_IO
 #include <iterator> // make_move_iterator, random_access_iterator_tag
+#include <limits> // numeric_limits
 #include <memory> // unique_ptr
+#include <stdexcept> // length_error
 #include <string> // string, stoi, to_string
 #include <utility> // declval, forward, move, pair, swap
 #include <vector> // vector
@@ -2830,6 +2832,13 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
             // fill up the array with null values if given idx is outside the range
             if (idx >= m_data.m_value.array->size())
             {
+                // idx + 1 would overflow size_type and wrap to 0, which would empty
+                // the array instead of growing it; reject such an idx the same way
+                // resize() rejects other indices that are too large to represent
+                if (JSON_HEDLEY_UNLIKELY(idx == (std::numeric_limits<size_type>::max)()))
+                {
+                    JSON_THROW(std::length_error(detail::concat("array index ", std::to_string(idx), " exceeds size_type")));
+                }
 #if JSON_DIAGNOSTICS
                 // remember array size & capacity before resizing
                 const auto old_size = m_data.m_value.array->size();

single_include/nlohmann/json.hpp

@@ -36,7 +36,9 @@
     #include <iosfwd> // istream, ostream
 #endif  // JSON_NO_IO
 #include <iterator> // make_move_iterator, random_access_iterator_tag
+#include <limits> // numeric_limits
 #include <memory> // unique_ptr
+#include <stdexcept> // length_error
 #include <string> // string, stoi, to_string
 #include <utility> // declval, forward, move, pair, swap
 #include <vector> // vector
@@ -2747,7 +2749,7 @@ void templated_json_throw(ExceptionType exception)
             return ej_pair.second == j;                                                         \
         });                                                                                     \
         if (it != std::end(m)) e = it->first;                                                   \
-        else templated_json_throw<nlohmann::detail::out_of_range>(nlohmann::detail::out_of_range::create(410, nlohmann::detail::concat("enum value out of range for " #ENUM_TYPE ": ", j.dump(-1, ' ', false, nlohmann::detail::error_handler_t::replace)), &j)); \
+        else templated_json_throw<nlohmann::detail::out_of_range>(nlohmann::detail::out_of_range::create(410,"enum value out of range for " #ENUM_TYPE ": " + j.dump(), &j)); \
     }
 
 // Ugly macros to avoid uglier copy-paste when specializing basic_json. They
@@ -28911,6 +28913,13 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
             // fill up the array with null values if given idx is outside the range
             if (idx >= m_data.m_value.array->size())
             {
+                // idx + 1 would overflow size_type and wrap to 0, which would empty
+                // the array instead of growing it; reject such an idx the same way
+                // resize() rejects other indices that are too large to represent
+                if (JSON_HEDLEY_UNLIKELY(idx == (std::numeric_limits<size_type>::max)()))
+                {
+                    JSON_THROW(std::length_error(detail::concat("array index ", std::to_string(idx), " exceeds size_type")));
+                }
 #if JSON_DIAGNOSTICS
                 // remember array size & capacity before resizing
                 const auto old_size = m_data.m_value.array->size();

tests/src/unit-alt-string.cpp

@@ -174,15 +174,6 @@ bool operator<(const char* op1, const alt_string& op2) noexcept
     return op1 < op2.str_impl;
 }
 
-enum class alt_color { red, green };
-
-// NOLINTNEXTLINE(misc-use-internal-linkage,misc-const-correctness,cppcoreguidelines-avoid-c-arrays,hicpp-avoid-c-arrays,modernize-avoid-c-arrays) - false positive
-NLOHMANN_JSON_SERIALIZE_ENUM_STRICT(alt_color,
-{
-    {alt_color::red, "red"},
-    {alt_color::green, "green"},
-})
-
 TEST_CASE("alternative string type")
 {
     SECTION("binary formats")
@@ -383,19 +374,4 @@ TEST_CASE("alternative string type")
         const auto j2 = j.flatten();
         CHECK(j2.dump() == R"({"/foo/0":"bar","/foo/1":"baz"})");
     }
-
-    SECTION("strict enum")
-    {
-        // regression test for #5667: NLOHMANN_JSON_SERIALIZE_ENUM_STRICT's from_json
-        // built its exception message with "..." + j.dump(), which does not compile
-        // when j.dump() returns a custom string_t (here alt_string) instead of
-        // std::string
-        alt_json doc;
-        doc = "red";
-        CHECK(doc.get<alt_color>() == alt_color::red);
-
-        alt_json _;
-        doc = "blue";
-        CHECK_THROWS_WITH_AS(_ = doc.get<alt_color>(), "[json.exception.out_of_range.410] enum value out of range for alt_color: \"blue\"", alt_json::out_of_range&);
-    }
 }

tests/src/unit-conversions.cpp

@@ -1740,12 +1740,6 @@ TEST_CASE("Strict JSON to enum mapping")
 
         // conversion of unmapped enum -> exception thrown
         CHECK_THROWS_WITH_AS(json(strict_cards::andere), "[json.exception.out_of_range.410] enum value out of range for strict_cards", json::out_of_range&);
-
-        // invalid UTF-8 -> out_of_range.410, not the type_error.316 thrown while building the
-        // message (regression test for #5667); such strings can reach get<Enum>() unvalidated,
-        // e.g. from from_cbor()/from_msgpack() (#5529)
-        const json j_invalid_utf8 = "\xFF";
-        CHECK_THROWS_WITH_AS(_ = j_invalid_utf8.get<strict_cards>(), "[json.exception.out_of_range.410] enum value out of range for strict_cards: \"\xEF\xBF\xBD\"", json::out_of_range&);
     }
 
     SECTION("traditional enum")

tests/src/unit-element_access1.cpp

@@ -147,6 +147,24 @@ TEST_CASE("element access 1")
                 CHECK(j_const[7] == json({1, 2, 3}));
             }
 
+            SECTION("SIZE_MAX index (#5647)")
+            {
+                // idx + 1 must not be computed for idx == SIZE_MAX: it wraps to 0,
+                // which would empty the array and then write out of bounds instead
+                // of growing it; reject it like an oversized resize() would and
+                // leave the array unchanged
+                const auto max_idx = (std::numeric_limits<json::size_type>::max)();
+                const std::string expected = "array index " + std::to_string(max_idx) + " exceeds size_type";
+                const json j_before = j; // NOLINT(performance-unnecessary-copy-initialization)
+
+                CHECK_THROWS_WITH_AS(j[max_idx] = 1, expected.c_str(), std::length_error&);
+                CHECK(j == j_before);
+
+                json j_empty = json::array();
+                CHECK_THROWS_WITH_AS(j_empty[max_idx] = 1, expected.c_str(), std::length_error&);
+                CHECK(j_empty == json::array());
+            }
+
             SECTION("access on non-array type")
             {
                 SECTION("null")