Bound UBJSON optimized arrays of a valueless type

An element of type 'Z' (null), 'T' (true) or 'F' (false) is encoded by its type marker alone, so an optimized UBJSON array of one of those has no payload: reading an element consumes no input at all. Its declared count is therefore the only thing that decides how much is allocated, and nothing bounded it. "[$Z#l" and a four-byte count is nine bytes of input describing two billion values; #2793 reports 35 GB and 150 seconds from ten bytes, and OSS-Fuzz has an out-of-memory and a timeout report for the same shape. Every other type costs at least one byte per element, so the end of the input bounds it. 'N' (no-op) is already skipped rather than stored. Objects are not affected either: each element is preceded by its key, which costs bytes. And BJData already refuses these markers as an optimized type, so this is a plain UBJSON matter. Reject a count above 1,048,576 elements for those three types with out_of_range.408, the code this reader already uses for a declared size it will not honour. The check runs before the SAX start event, so no container is opened and then abandoned. Rejecting on the read side alone would break the guarantee that anything to_ubjson() writes can be read back, and would trip the round-trip assertion in fuzzer-parse_ubjson.cpp. So the writer falls back to the unoptimized encoding, one byte per element, for arrays of these types above the same limit. Its decision depends only on the array's size, which is identical for a value and for anything parsed back from it, so the round trip is stable. No existing test changes: the largest such count in the test suite is 65,793. The excessive-size test that already used this shape still passes, now rejected a little earlier than by the max_size() check it used to reach. Signed-off-by: Niels Lohmann <mail@nlohmann.me>
Reject a nested BJData ndarray dimension vector where it is read
2026-09-07 00:37:58 +00:00 · 2026-09-06 18:12:41 +02:00 · 2026-09-06 18:12:40 +02:00 · 2026-09-06 18:12:39 +02:00 · 2026-09-06 16:41:35 +02:00
15 changed files with 613 additions and 687 deletions
@@ -241,7 +241,7 @@ update_hedley:
 	rm -f include/nlohmann/thirdparty/hedley/hedley.hpp include/nlohmann/thirdparty/hedley/hedley_undef.hpp
 	curl https://raw.githubusercontent.com/nemequ/hedley/master/hedley.h -o include/nlohmann/thirdparty/hedley/hedley.hpp
 	$(SED) -i 's/HEDLEY_/JSON_HEDLEY_/g' include/nlohmann/thirdparty/hedley/hedley.hpp
-	grep -oE "#[[:blank:]]*define[[:blank:]]+JSON_HEDLEY_[A-Za-z0-9_]+" include/nlohmann/thirdparty/hedley/hedley.hpp | awk '{print $$NF}' | grep -v "__" | sort -u | $(SED) 's/^/#undef /' > include/nlohmann/thirdparty/hedley/hedley_undef.hpp
+	grep "[[:blank:]]*#[[:blank:]]*undef" include/nlohmann/thirdparty/hedley/hedley.hpp | grep -v "__" | sort | uniq | $(SED) 's/ //g' | $(SED) 's/undef/undef /g' > include/nlohmann/thirdparty/hedley/hedley_undef.hpp
 	$(SED) -i '1s/^/#pragma once\n\n/' include/nlohmann/thirdparty/hedley/hedley.hpp
 	$(SED) -i '1s/^/#pragma once\n\n/' include/nlohmann/thirdparty/hedley/hedley_undef.hpp
 	$(MAKE) amalgamate
@@ -69,6 +69,12 @@ The library uses the following mapping from JSON values types to UBJSON types ac
    Note that `use_size = true` alone may result in larger representations - the benefit of this parameter is that the
    receiving side is immediately informed on the number of elements of the container.

+    An array whose type marker is `Z` (null), `T` (true) or `F` (false) stores no payload at all, because the marker
+    already is the value. Its declared count is therefore the only thing that decides how much memory the receiving side
+    allocates, and a handful of bytes can describe billions of elements. `from_ubjson` rejects such an array with
+    [`out_of_range.408`](../../home/exceptions.md#jsonexceptionout_of_range408) when the count exceeds 1,048,576, and
+    `to_ubjson` writes longer arrays of these types without the annotation, so any value it produces can be read back.
+
 !!! info "Binary values"

    If the JSON data contains the binary type, the value stored is a list of integers, as suggested by the UBJSON
@@ -868,6 +868,12 @@ The size of an array or object in a [binary format](../features/binary_formats/i
 the size following `#` for [UBJSON](../features/binary_formats/ubjson.md)/[BJData](../features/binary_formats/bjdata.md),
 or the encoded length for [CBOR](../features/binary_formats/cbor.md).

+The exception is also thrown for a [UBJSON](../features/binary_formats/ubjson.md) array of a type that is encoded by its
+marker alone (`Z`, `T` or `F`) whose declared count exceeds 1,048,576. Such an array has no payload, so its count alone
+decides how much memory is allocated, and a handful of bytes would otherwise describe billions of values.
+[`to_ubjson`](../api/basic_json/to_ubjson.md) writes longer arrays of these types without the size and type annotation,
+so any value it produces can still be read back.
+
 !!! failure "Example messages"

    ```
@@ -879,6 +885,9 @@ or the encoded length for [CBOR](../features/binary_formats/cbor.md).
    ```
    [json.exception.out_of_range.408] syntax error while parsing CBOR size: excessive map size
    ```
+    ```
+    [json.exception.out_of_range.408] syntax error while parsing UBJSON size: excessive array size
+    ```

 ### json.exception.out_of_range.409

@@ -1074,9 +1074,9 @@ char* to_chars(char* first, const char* last, FloatType value)
        *first++ = '-';
    }

-    JSON_HEDLEY_DIAGNOSTIC_PUSH
 #ifdef __GNUC__
-    JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
 #endif
    if (value == 0) // +-0
    {
@@ -1086,7 +1086,9 @@ char* to_chars(char* first, const char* last, FloatType value)
        *first++ = '0';
        return first;
    }
-    JSON_HEDLEY_DIAGNOSTIC_POP
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif

    JSON_ASSERT(last - first >= std::numeric_limits<FloatType>::max_digits10);

@@ -32,9 +32,9 @@
 // functions to. As a result, we suppress this warning here to avoid client
 // code stumbling over this. See https://github.com/nlohmann/json/issues/4087
 // for a discussion.
-JSON_HEDLEY_DIAGNOSTIC_PUSH
 #if defined(__clang__)
-    JSON_HEDLEY_PRAGMA(clang diagnostic ignored "-Wweak-vtables")
+    #pragma clang diagnostic push
+    #pragma clang diagnostic ignored "-Wweak-vtables"
 #endif

 NLOHMANN_JSON_NAMESPACE_BEGIN
@@ -286,4 +286,6 @@ class other_error : public exception
 }  // namespace detail
 NLOHMANN_JSON_NAMESPACE_END

-JSON_HEDLEY_DIAGNOSTIC_POP
+#if defined(__clang__)
+    #pragma clang diagnostic pop
+#endif
@@ -58,6 +58,26 @@ inline bool little_endianness(int num = 1) noexcept
    return *reinterpret_cast<char*>(&num) == 1;
 }

+/*!
+@brief largest element count accepted for a UBJSON container of a valueless type
+
+An element of type 'Z' (null), 'T' (true) or 'F' (false) is encoded by its
+type marker alone, so an optimized container of one of those types has no
+payload at all and its declared count is the only thing that decides how much
+is allocated: `[$Z#L` followed by a large count turns some ten bytes of input
+into that many values (see #2793, which reports 35 GB and 150 seconds). Every
+other type costs at least one byte per element and is bounded by the end of
+the input.
+
+This is a sanity bound rather than a security boundary, and it is far above
+any container met in practice. @ref binary_writer falls back to the
+unoptimized encoding for longer containers, so that a value serialized by
+this library can always be read back.
+
+@sa https://github.com/nlohmann/json/issues/2793
+*/
+JSON_INLINE_VARIABLE constexpr std::size_t max_valueless_container_size = 1 << 20;
+
 ///////////////////
 // binary reader //
 ///////////////////
@@ -996,23 +1016,21 @@ class binary_reader
    }

    /*!
-    @brief reads a CBOR string
+    @brief reads a definite-length CBOR string

-    This function first reads starting bytes to determine the expected
-    string length and then copies this number of bytes into a string.
-    Additionally, CBOR's strings with indefinite lengths are supported.
+    Reads everything @ref get_cbor_string accepts except the indefinite-length
+    form, which that function handles itself. The bytes are appended to @a
+    result, so consecutive chunks of an indefinite-length string can be read
+    into the same string.

-    @param[out] result  created string
+    @param[out] result  string the bytes are appended to

    @return whether string creation completed
-    */
-    bool get_cbor_string(string_t& result)
-    {
-        if (JSON_HEDLEY_UNLIKELY(!unexpect_eof(input_format_t::cbor, "string")))
-        {
-            return false;
-        }

+    @pre @a current is not EOF
+    */
+    bool get_cbor_string_chunk(string_t& result)
+    {
        switch (current)
        {
            // UTF-8 string (0x00..0x17 bytes follow)
@@ -1068,20 +1086,6 @@ class binary_reader
                return get_number(input_format_t::cbor, len) && get_string(input_format_t::cbor, len, result);
            }

-            case 0x7F: // UTF-8 string (indefinite length)
-            {
-                while (get() != 0xFF)
-                {
-                    string_t chunk;
-                    if (!get_cbor_string(chunk))
-                    {
-                        return false;
-                    }
-                    result.append(chunk);
-                }
-                return true;
-            }
-
            default:
            {
                auto last_token = get_token_string();
@@ -1092,23 +1096,82 @@ class binary_reader
    }

    /*!
-    @brief reads a CBOR byte array
+    @brief reads a CBOR string

    This function first reads starting bytes to determine the expected
-    byte array length and then copies this number of bytes into the byte array.
-    Additionally, CBOR's byte arrays with indefinite lengths are supported.
+    string length and then copies this number of bytes into a string.
+    Additionally, CBOR's strings with indefinite lengths are supported.

-    @param[out] result  created byte array
+    @param[out] result  created string
+
+    @return whether string creation completed
+    */
+    bool get_cbor_string(string_t& result)
+    {
+        // number of indefinite-length strings that have been opened and not
+        // closed yet. RFC 8949, Section 3.2.3 does not permit nesting them,
+        // but this reader has always accepted it, so the open levels are
+        // counted instead of recursed through, which overflowed the stack for
+        // an input of repeated 0x7F bytes (see #5104). Every chunk is appended
+        // to the same result, so no per-level state is needed.
+        std::size_t open = 0;
+
+        while (true)
+        {
+            if (JSON_HEDLEY_UNLIKELY(!unexpect_eof(input_format_t::cbor, "string")))
+            {
+                return false;
+            }
+
+            if (current == 0x7F) // UTF-8 string (indefinite length)
+            {
+                ++open;
+                get();
+                continue;
+            }
+
+            // a break marker closes the innermost indefinite-length string;
+            // outside of one it is not a string and falls through to the error
+            if (open != 0 && current == 0xFF)
+            {
+                if (--open == 0)
+                {
+                    return true;
+                }
+                get();
+                continue;
+            }
+
+            if (JSON_HEDLEY_UNLIKELY(!get_cbor_string_chunk(result)))
+            {
+                return false;
+            }
+
+            if (open == 0)
+            {
+                return true;
+            }
+
+            get();
+        }
+    }
+
+    /*!
+    @brief reads a definite-length CBOR byte array
+
+    Reads everything @ref get_cbor_binary accepts except the indefinite-length
+    form, which that function handles itself. The bytes are appended to @a
+    result, so consecutive chunks of an indefinite-length byte array can be
+    read into the same byte array.
+
+    @param[out] result  byte array the bytes are appended to

    @return whether byte array creation completed
-    */
-    bool get_cbor_binary(binary_t& result)
-    {
-        if (JSON_HEDLEY_UNLIKELY(!unexpect_eof(input_format_t::cbor, "binary")))
-        {
-            return false;
-        }

+    @pre @a current is not EOF
+    */
+    bool get_cbor_binary_chunk(binary_t& result)
+    {
        switch (current)
        {
            // Binary data (0x00..0x17 bytes follow)
@@ -1168,20 +1231,6 @@ class binary_reader
                       get_binary(input_format_t::cbor, len, result);
            }

-            case 0x5F: // Binary data (indefinite length)
-            {
-                while (get() != 0xFF)
-                {
-                    binary_t chunk;
-                    if (!get_cbor_binary(chunk))
-                    {
-                        return false;
-                    }
-                    result.insert(result.end(), chunk.begin(), chunk.end());
-                }
-                return true;
-            }
-
            default:
            {
                auto last_token = get_token_string();
@@ -1191,6 +1240,63 @@ class binary_reader
        }
    }

+    /*!
+    @brief reads a CBOR byte array
+
+    This function first reads starting bytes to determine the expected
+    byte array length and then copies this number of bytes into the byte array.
+    Additionally, CBOR's byte arrays with indefinite lengths are supported.
+
+    @param[out] result  created byte array
+
+    @return whether byte array creation completed
+    */
+    bool get_cbor_binary(binary_t& result)
+    {
+        // the open indefinite-length byte arrays are counted rather than
+        // recursed through, for the reason given in @ref get_cbor_string
+        std::size_t open = 0;
+
+        while (true)
+        {
+            if (JSON_HEDLEY_UNLIKELY(!unexpect_eof(input_format_t::cbor, "binary")))
+            {
+                return false;
+            }
+
+            if (current == 0x5F) // Binary data (indefinite length)
+            {
+                ++open;
+                get();
+                continue;
+            }
+
+            // a break marker closes the innermost indefinite-length byte
+            // array; outside of one it falls through to the error below
+            if (open != 0 && current == 0xFF)
+            {
+                if (--open == 0)
+                {
+                    return true;
+                }
+                get();
+                continue;
+            }
+
+            if (JSON_HEDLEY_UNLIKELY(!get_cbor_binary_chunk(result)))
+            {
+                return false;
+            }
+
+            if (open == 0)
+            {
+                return true;
+            }
+
+            get();
+        }
+    }
+
    /*!
    @brief narrow a definite CBOR array/map length to std::size_t

@@ -2391,7 +2497,12 @@ class binary_reader
    {
        result.first = npos; // size
        result.second = 0; // type
-        bool is_ndarray = false;
+        // seed the flag with the caller's context: inside an ndarray dimension
+        // vector another ndarray is not allowed, and get_ubjson_size_value()
+        // rejects it up front instead of reading it and reporting afterwards.
+        // Seeding it with `false` made every '#' of a "[#[#[..." chain descend
+        // another level, which overflowed the stack (see #5104).
+        bool is_ndarray = inside_ndarray;

        get_ignore_noop();

@@ -2424,13 +2535,11 @@ class binary_reader
            }

            const bool is_error = get_ubjson_size_value(result.first, is_ndarray);
-            if (input_format == input_format_t::bjdata && is_ndarray)
+            // an ndarray was read here only if the flag flipped; when it was
+            // seeded true, get_ubjson_size_value() already rejected the nested
+            // dimension vector
+            if (input_format == input_format_t::bjdata && is_ndarray && !inside_ndarray)
            {
-                if (inside_ndarray)
-                {
-                    return sax->parse_error(chars_read, get_token_string(), parse_error::create(112, chars_read,
-                                            exception_message(input_format, "ndarray can not be recursive", "size"), nullptr));
-                }
                result.second |= (1 << 8); // use bit 8 to indicate ndarray, all UBJSON and BJData markers should be ASCII letters
            }
            return is_error;
@@ -2439,7 +2548,7 @@ class binary_reader
        if (current == '#')
        {
            const bool is_error = get_ubjson_size_value(result.first, is_ndarray);
-            if (input_format == input_format_t::bjdata && is_ndarray)
+            if (input_format == input_format_t::bjdata && is_ndarray && !inside_ndarray)
            {
                return sax->parse_error(chars_read, get_token_string(), parse_error::create(112, chars_read,
                                        exception_message(input_format, "ndarray requires both type and size", "size"), nullptr));
@@ -2710,6 +2819,17 @@ class binary_reader

        if (size_and_type.first != npos)
        {
+            // reading an element of a valueless type consumes no input, so the
+            // declared count alone decides how much is allocated; the check is
+            // made before the start event so that no container is opened that
+            // is then abandoned. See @ref max_valueless_container_size.
+            if (JSON_HEDLEY_UNLIKELY((size_and_type.second == 'Z' || size_and_type.second == 'T' || size_and_type.second == 'F')
+                                     && size_and_type.first > max_valueless_container_size))
+            {
+                return sax->parse_error(chars_read, get_token_string(), out_of_range::create(408,
+                                        exception_message(input_format, "excessive array size", "size"), nullptr));
+            }
+
            if (JSON_HEDLEY_UNLIKELY(!sax->start_array(size_and_type.first)))
            {
                return false;
@@ -18,7 +18,6 @@
 #endif

 #include <nlohmann/detail/abi_macros.hpp>
-#include <nlohmann/detail/macro_scope.hpp>
 #include <nlohmann/detail/meta/type_traits.hpp>
 #include <nlohmann/detail/string_utils.hpp>
 #include <nlohmann/detail/value_t.hpp>
@@ -207,10 +206,10 @@ NLOHMANN_JSON_NAMESPACE_END
 namespace std
 {

-// Fix: https://github.com/nlohmann/json/issues/1401
-JSON_HEDLEY_DIAGNOSTIC_PUSH
 #if defined(__clang__)
-    JSON_HEDLEY_PRAGMA(clang diagnostic ignored "-Wmismatched-tags")
+    // Fix: https://github.com/nlohmann/json/issues/1401
+    #pragma clang diagnostic push
+    #pragma clang diagnostic ignored "-Wmismatched-tags"
 #endif
 template<typename IteratorType>
 class tuple_size<::nlohmann::detail::iteration_proxy_value<IteratorType>> // NOLINT(cert-dcl58-cpp)
@@ -224,7 +223,9 @@ class tuple_element<N, ::nlohmann::detail::iteration_proxy_value<IteratorType >>
                     get<N>(std::declval <
                            ::nlohmann::detail::iteration_proxy_value<IteratorType >> ()));
 };
-JSON_HEDLEY_DIAGNOSTIC_POP
+#if defined(__clang__)
+    #pragma clang diagnostic pop
+#endif

 }  // namespace std

@@ -826,7 +826,17 @@ class binary_writer

                    std::vector<CharType> bjdx = {'[', '{', 'S', 'H', 'T', 'F', 'N', 'Z'}; // excluded markers in bjdata optimized type

-                    if (same_prefix && !(use_bjdata && std::find(bjdx.begin(), bjdx.end(), first_prefix) != bjdx.end()))
+                    // an optimized array of a valueless type carries no payload, so a
+                    // reader has nothing but the declared count to bound the allocation
+                    // by and refuses an excessive one. Write the unoptimized form for
+                    // those, at one byte per element, so the result can be read back.
+                    // Objects are not affected: every element is preceded by its key.
+                    const bool valueless_type = (first_prefix == 'Z' || first_prefix == 'T' || first_prefix == 'F');
+                    const bool excessive_valueless = valueless_type
+                                                     && j.m_data.m_value.array->size() > detail::max_valueless_container_size;
+
+                    if (same_prefix && !excessive_valueless
+                            && !(use_bjdata && std::find(bjdx.begin(), bjdx.end(), first_prefix) != bjdx.end()))
                    {
                        prefix_required = false;
                        oa->write_character(to_char_type('$'));
@@ -1849,9 +1859,9 @@ class binary_writer

    void write_compact_float(const number_float_t n, detail::input_format_t format)
    {
-        JSON_HEDLEY_DIAGNOSTIC_PUSH
 #ifdef __GNUC__
-        JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
 #endif
        if (!std::isfinite(n) || ((static_cast<double>(n) >= static_cast<double>(std::numeric_limits<float>::lowest()) &&
                                   static_cast<double>(n) <= static_cast<double>((std::numeric_limits<float>::max)()) &&
@@ -1869,7 +1879,9 @@ class binary_writer
                                : get_msgpack_float_prefix(n));
            write_number(n);
        }
-        JSON_HEDLEY_DIAGNOSTIC_POP
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
    }

  public:
@@ -3769,13 +3769,15 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
    /// @sa https://json.nlohmann.me/api/basic_json/operator_eq/
    bool operator==(const_reference rhs) const noexcept
    {
-        JSON_HEDLEY_DIAGNOSTIC_PUSH
 #ifdef __GNUC__
-        JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
 #endif
        const_reference lhs = *this;
        JSON_IMPLEMENT_OPERATOR( ==, true, false, false)
-        JSON_HEDLEY_DIAGNOSTIC_POP
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
    }

    /// @brief comparison: equal
@@ -3860,12 +3862,14 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
    /// @sa https://json.nlohmann.me/api/basic_json/operator_eq/
    friend bool operator==(const_reference lhs, const_reference rhs) noexcept
    {
-        JSON_HEDLEY_DIAGNOSTIC_PUSH
 #ifdef __GNUC__
-        JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
 #endif
        JSON_IMPLEMENT_OPERATOR( ==, true, false, false)
-        JSON_HEDLEY_DIAGNOSTIC_POP
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
    }

    /// @brief comparison: equal
@@ -4470,7 +4474,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::forward<InputType>(i));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in CBOR format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -4487,7 +4491,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::move(first), std::move(last));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    template<typename T>
@@ -4513,7 +4517,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in MessagePack format
@@ -4528,7 +4532,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::forward<InputType>(i));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in MessagePack format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -4544,7 +4548,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::move(first), std::move(last));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    template<typename T>
@@ -4568,7 +4572,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in UBJSON format
@@ -4583,7 +4587,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::forward<InputType>(i));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in UBJSON format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -4599,7 +4603,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::move(first), std::move(last));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    template<typename T>
@@ -4623,7 +4627,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in BJData format
@@ -4638,7 +4642,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::forward<InputType>(i));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bjdata).sax_parse(input_format_t::bjdata, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in BJData format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -4654,7 +4658,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::move(first), std::move(last));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bjdata).sax_parse(input_format_t::bjdata, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in BSON format
@@ -4669,7 +4673,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::forward<InputType>(i));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in BSON format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -4685,7 +4689,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::move(first), std::move(last));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    template<typename T>
@@ -4709,7 +4713,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }
    /// @}

@@ -17,7 +17,7 @@
 #undef JSON_HEDLEY_CLANG_HAS_ATTRIBUTE
 #undef JSON_HEDLEY_CLANG_HAS_BUILTIN
 #undef JSON_HEDLEY_CLANG_HAS_CPP_ATTRIBUTE
-#undef JSON_HEDLEY_CLANG_HAS_DECLSPEC_ATTRIBUTE
+#undef JSON_HEDLEY_CLANG_HAS_DECLSPEC_DECLSPEC_ATTRIBUTE
 #undef JSON_HEDLEY_CLANG_HAS_EXTENSION
 #undef JSON_HEDLEY_CLANG_HAS_FEATURE
 #undef JSON_HEDLEY_CLANG_HAS_WARNING
@@ -108,10 +108,7 @@
 #undef JSON_HEDLEY_PELLES_VERSION_CHECK
 #undef JSON_HEDLEY_PGI_VERSION
 #undef JSON_HEDLEY_PGI_VERSION_CHECK
-#undef JSON_HEDLEY_PRAGMA
 #undef JSON_HEDLEY_PREDICT
-#undef JSON_HEDLEY_PREDICT_FALSE
-#undef JSON_HEDLEY_PREDICT_TRUE
 #undef JSON_HEDLEY_PRINTF_FORMAT
 #undef JSON_HEDLEY_PRIVATE
 #undef JSON_HEDLEY_PUBLIC
@@ -4944,9 +4944,9 @@ NLOHMANN_JSON_NAMESPACE_END
 // functions to. As a result, we suppress this warning here to avoid client
 // code stumbling over this. See https://github.com/nlohmann/json/issues/4087
 // for a discussion.
-JSON_HEDLEY_DIAGNOSTIC_PUSH
 #if defined(__clang__)
-    JSON_HEDLEY_PRAGMA(clang diagnostic ignored "-Wweak-vtables")
+    #pragma clang diagnostic push
+    #pragma clang diagnostic ignored "-Wweak-vtables"
 #endif

 NLOHMANN_JSON_NAMESPACE_BEGIN
@@ -5198,7 +5198,9 @@ class other_error : public exception
 }  // namespace detail
 NLOHMANN_JSON_NAMESPACE_END

-JSON_HEDLEY_DIAGNOSTIC_POP
+#if defined(__clang__)
+    #pragma clang diagnostic pop
+#endif

 // #include <nlohmann/detail/macro_scope.hpp>

@@ -5973,8 +5975,6 @@ NLOHMANN_JSON_NAMESPACE_END

 // #include <nlohmann/detail/abi_macros.hpp>

-// #include <nlohmann/detail/macro_scope.hpp>
-
 // #include <nlohmann/detail/meta/type_traits.hpp>

 // #include <nlohmann/detail/string_utils.hpp>
@@ -6204,10 +6204,10 @@ NLOHMANN_JSON_NAMESPACE_END
 namespace std
 {

-// Fix: https://github.com/nlohmann/json/issues/1401
-JSON_HEDLEY_DIAGNOSTIC_PUSH
 #if defined(__clang__)
-    JSON_HEDLEY_PRAGMA(clang diagnostic ignored "-Wmismatched-tags")
+    // Fix: https://github.com/nlohmann/json/issues/1401
+    #pragma clang diagnostic push
+    #pragma clang diagnostic ignored "-Wmismatched-tags"
 #endif
 template<typename IteratorType>
 class tuple_size<::nlohmann::detail::iteration_proxy_value<IteratorType>> // NOLINT(cert-dcl58-cpp)
@@ -6221,7 +6221,9 @@ class tuple_element<N, ::nlohmann::detail::iteration_proxy_value<IteratorType >>
                     get<N>(std::declval <
                            ::nlohmann::detail::iteration_proxy_value<IteratorType >> ()));
 };
-JSON_HEDLEY_DIAGNOSTIC_POP
+#if defined(__clang__)
+    #pragma clang diagnostic pop
+#endif

 }  // namespace std

@@ -10743,6 +10745,26 @@ inline bool little_endianness(int num = 1) noexcept
    return *reinterpret_cast<char*>(&num) == 1;
 }

+/*!
+@brief largest element count accepted for a UBJSON container of a valueless type
+
+An element of type 'Z' (null), 'T' (true) or 'F' (false) is encoded by its
+type marker alone, so an optimized container of one of those types has no
+payload at all and its declared count is the only thing that decides how much
+is allocated: `[$Z#L` followed by a large count turns some ten bytes of input
+into that many values (see #2793, which reports 35 GB and 150 seconds). Every
+other type costs at least one byte per element and is bounded by the end of
+the input.
+
+This is a sanity bound rather than a security boundary, and it is far above
+any container met in practice. @ref binary_writer falls back to the
+unoptimized encoding for longer containers, so that a value serialized by
+this library can always be read back.
+
+@sa https://github.com/nlohmann/json/issues/2793
+*/
+JSON_INLINE_VARIABLE constexpr std::size_t max_valueless_container_size = 1 << 20;
+
 ///////////////////
 // binary reader //
 ///////////////////
@@ -11681,23 +11703,21 @@ class binary_reader
    }

    /*!
-    @brief reads a CBOR string
+    @brief reads a definite-length CBOR string

-    This function first reads starting bytes to determine the expected
-    string length and then copies this number of bytes into a string.
-    Additionally, CBOR's strings with indefinite lengths are supported.
+    Reads everything @ref get_cbor_string accepts except the indefinite-length
+    form, which that function handles itself. The bytes are appended to @a
+    result, so consecutive chunks of an indefinite-length string can be read
+    into the same string.

-    @param[out] result  created string
+    @param[out] result  string the bytes are appended to

    @return whether string creation completed
-    */
-    bool get_cbor_string(string_t& result)
-    {
-        if (JSON_HEDLEY_UNLIKELY(!unexpect_eof(input_format_t::cbor, "string")))
-        {
-            return false;
-        }

+    @pre @a current is not EOF
+    */
+    bool get_cbor_string_chunk(string_t& result)
+    {
        switch (current)
        {
            // UTF-8 string (0x00..0x17 bytes follow)
@@ -11753,20 +11773,6 @@ class binary_reader
                return get_number(input_format_t::cbor, len) && get_string(input_format_t::cbor, len, result);
            }

-            case 0x7F: // UTF-8 string (indefinite length)
-            {
-                while (get() != 0xFF)
-                {
-                    string_t chunk;
-                    if (!get_cbor_string(chunk))
-                    {
-                        return false;
-                    }
-                    result.append(chunk);
-                }
-                return true;
-            }
-
            default:
            {
                auto last_token = get_token_string();
@@ -11777,23 +11783,82 @@ class binary_reader
    }

    /*!
-    @brief reads a CBOR byte array
+    @brief reads a CBOR string

    This function first reads starting bytes to determine the expected
-    byte array length and then copies this number of bytes into the byte array.
-    Additionally, CBOR's byte arrays with indefinite lengths are supported.
+    string length and then copies this number of bytes into a string.
+    Additionally, CBOR's strings with indefinite lengths are supported.

-    @param[out] result  created byte array
+    @param[out] result  created string
+
+    @return whether string creation completed
+    */
+    bool get_cbor_string(string_t& result)
+    {
+        // number of indefinite-length strings that have been opened and not
+        // closed yet. RFC 8949, Section 3.2.3 does not permit nesting them,
+        // but this reader has always accepted it, so the open levels are
+        // counted instead of recursed through, which overflowed the stack for
+        // an input of repeated 0x7F bytes (see #5104). Every chunk is appended
+        // to the same result, so no per-level state is needed.
+        std::size_t open = 0;
+
+        while (true)
+        {
+            if (JSON_HEDLEY_UNLIKELY(!unexpect_eof(input_format_t::cbor, "string")))
+            {
+                return false;
+            }
+
+            if (current == 0x7F) // UTF-8 string (indefinite length)
+            {
+                ++open;
+                get();
+                continue;
+            }
+
+            // a break marker closes the innermost indefinite-length string;
+            // outside of one it is not a string and falls through to the error
+            if (open != 0 && current == 0xFF)
+            {
+                if (--open == 0)
+                {
+                    return true;
+                }
+                get();
+                continue;
+            }
+
+            if (JSON_HEDLEY_UNLIKELY(!get_cbor_string_chunk(result)))
+            {
+                return false;
+            }
+
+            if (open == 0)
+            {
+                return true;
+            }
+
+            get();
+        }
+    }
+
+    /*!
+    @brief reads a definite-length CBOR byte array
+
+    Reads everything @ref get_cbor_binary accepts except the indefinite-length
+    form, which that function handles itself. The bytes are appended to @a
+    result, so consecutive chunks of an indefinite-length byte array can be
+    read into the same byte array.
+
+    @param[out] result  byte array the bytes are appended to

    @return whether byte array creation completed
-    */
-    bool get_cbor_binary(binary_t& result)
-    {
-        if (JSON_HEDLEY_UNLIKELY(!unexpect_eof(input_format_t::cbor, "binary")))
-        {
-            return false;
-        }

+    @pre @a current is not EOF
+    */
+    bool get_cbor_binary_chunk(binary_t& result)
+    {
        switch (current)
        {
            // Binary data (0x00..0x17 bytes follow)
@@ -11853,20 +11918,6 @@ class binary_reader
                       get_binary(input_format_t::cbor, len, result);
            }

-            case 0x5F: // Binary data (indefinite length)
-            {
-                while (get() != 0xFF)
-                {
-                    binary_t chunk;
-                    if (!get_cbor_binary(chunk))
-                    {
-                        return false;
-                    }
-                    result.insert(result.end(), chunk.begin(), chunk.end());
-                }
-                return true;
-            }
-
            default:
            {
                auto last_token = get_token_string();
@@ -11876,6 +11927,63 @@ class binary_reader
        }
    }

+    /*!
+    @brief reads a CBOR byte array
+
+    This function first reads starting bytes to determine the expected
+    byte array length and then copies this number of bytes into the byte array.
+    Additionally, CBOR's byte arrays with indefinite lengths are supported.
+
+    @param[out] result  created byte array
+
+    @return whether byte array creation completed
+    */
+    bool get_cbor_binary(binary_t& result)
+    {
+        // the open indefinite-length byte arrays are counted rather than
+        // recursed through, for the reason given in @ref get_cbor_string
+        std::size_t open = 0;
+
+        while (true)
+        {
+            if (JSON_HEDLEY_UNLIKELY(!unexpect_eof(input_format_t::cbor, "binary")))
+            {
+                return false;
+            }
+
+            if (current == 0x5F) // Binary data (indefinite length)
+            {
+                ++open;
+                get();
+                continue;
+            }
+
+            // a break marker closes the innermost indefinite-length byte
+            // array; outside of one it falls through to the error below
+            if (open != 0 && current == 0xFF)
+            {
+                if (--open == 0)
+                {
+                    return true;
+                }
+                get();
+                continue;
+            }
+
+            if (JSON_HEDLEY_UNLIKELY(!get_cbor_binary_chunk(result)))
+            {
+                return false;
+            }
+
+            if (open == 0)
+            {
+                return true;
+            }
+
+            get();
+        }
+    }
+
    /*!
    @brief narrow a definite CBOR array/map length to std::size_t

@@ -13076,7 +13184,12 @@ class binary_reader
    {
        result.first = npos; // size
        result.second = 0; // type
-        bool is_ndarray = false;
+        // seed the flag with the caller's context: inside an ndarray dimension
+        // vector another ndarray is not allowed, and get_ubjson_size_value()
+        // rejects it up front instead of reading it and reporting afterwards.
+        // Seeding it with `false` made every '#' of a "[#[#[..." chain descend
+        // another level, which overflowed the stack (see #5104).
+        bool is_ndarray = inside_ndarray;

        get_ignore_noop();

@@ -13109,13 +13222,11 @@ class binary_reader
            }

            const bool is_error = get_ubjson_size_value(result.first, is_ndarray);
-            if (input_format == input_format_t::bjdata && is_ndarray)
+            // an ndarray was read here only if the flag flipped; when it was
+            // seeded true, get_ubjson_size_value() already rejected the nested
+            // dimension vector
+            if (input_format == input_format_t::bjdata && is_ndarray && !inside_ndarray)
            {
-                if (inside_ndarray)
-                {
-                    return sax->parse_error(chars_read, get_token_string(), parse_error::create(112, chars_read,
-                                            exception_message(input_format, "ndarray can not be recursive", "size"), nullptr));
-                }
                result.second |= (1 << 8); // use bit 8 to indicate ndarray, all UBJSON and BJData markers should be ASCII letters
            }
            return is_error;
@@ -13124,7 +13235,7 @@ class binary_reader
        if (current == '#')
        {
            const bool is_error = get_ubjson_size_value(result.first, is_ndarray);
-            if (input_format == input_format_t::bjdata && is_ndarray)
+            if (input_format == input_format_t::bjdata && is_ndarray && !inside_ndarray)
            {
                return sax->parse_error(chars_read, get_token_string(), parse_error::create(112, chars_read,
                                        exception_message(input_format, "ndarray requires both type and size", "size"), nullptr));
@@ -13395,6 +13506,17 @@ class binary_reader

        if (size_and_type.first != npos)
        {
+            // reading an element of a valueless type consumes no input, so the
+            // declared count alone decides how much is allocated; the check is
+            // made before the start event so that no container is opened that
+            // is then abandoned. See @ref max_valueless_container_size.
+            if (JSON_HEDLEY_UNLIKELY((size_and_type.second == 'Z' || size_and_type.second == 'T' || size_and_type.second == 'F')
+                                     && size_and_type.first > max_valueless_container_size))
+            {
+                return sax->parse_error(chars_read, get_token_string(), out_of_range::create(408,
+                                        exception_message(input_format, "excessive array size", "size"), nullptr));
+            }
+
            if (JSON_HEDLEY_UNLIKELY(!sax->start_array(size_and_type.first)))
            {
                return false;
@@ -17832,7 +17954,17 @@ class binary_writer

                    std::vector<CharType> bjdx = {'[', '{', 'S', 'H', 'T', 'F', 'N', 'Z'}; // excluded markers in bjdata optimized type

-                    if (same_prefix && !(use_bjdata && std::find(bjdx.begin(), bjdx.end(), first_prefix) != bjdx.end()))
+                    // an optimized array of a valueless type carries no payload, so a
+                    // reader has nothing but the declared count to bound the allocation
+                    // by and refuses an excessive one. Write the unoptimized form for
+                    // those, at one byte per element, so the result can be read back.
+                    // Objects are not affected: every element is preceded by its key.
+                    const bool valueless_type = (first_prefix == 'Z' || first_prefix == 'T' || first_prefix == 'F');
+                    const bool excessive_valueless = valueless_type
+                                                     && j.m_data.m_value.array->size() > detail::max_valueless_container_size;
+
+                    if (same_prefix && !excessive_valueless
+                            && !(use_bjdata && std::find(bjdx.begin(), bjdx.end(), first_prefix) != bjdx.end()))
                    {
                        prefix_required = false;
                        oa->write_character(to_char_type('$'));
@@ -18855,9 +18987,9 @@ class binary_writer

    void write_compact_float(const number_float_t n, detail::input_format_t format)
    {
-        JSON_HEDLEY_DIAGNOSTIC_PUSH
 #ifdef __GNUC__
-        JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
 #endif
        if (!std::isfinite(n) || ((static_cast<double>(n) >= static_cast<double>(std::numeric_limits<float>::lowest()) &&
                                   static_cast<double>(n) <= static_cast<double>((std::numeric_limits<float>::max)()) &&
@@ -18875,7 +19007,9 @@ class binary_writer
                                : get_msgpack_float_prefix(n));
            write_number(n);
        }
-        JSON_HEDLEY_DIAGNOSTIC_POP
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
    }

  public:
@@ -20048,9 +20182,9 @@ char* to_chars(char* first, const char* last, FloatType value)
        *first++ = '-';
    }

-    JSON_HEDLEY_DIAGNOSTIC_PUSH
 #ifdef __GNUC__
-    JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
 #endif
    if (value == 0) // +-0
    {
@@ -20060,7 +20194,9 @@ char* to_chars(char* first, const char* last, FloatType value)
        *first++ = '0';
        return first;
    }
-    JSON_HEDLEY_DIAGNOSTIC_POP
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif

    JSON_ASSERT(last - first >= std::numeric_limits<FloatType>::max_digits10);

@@ -25191,13 +25327,15 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
    /// @sa https://json.nlohmann.me/api/basic_json/operator_eq/
    bool operator==(const_reference rhs) const noexcept
    {
-        JSON_HEDLEY_DIAGNOSTIC_PUSH
 #ifdef __GNUC__
-        JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
 #endif
        const_reference lhs = *this;
        JSON_IMPLEMENT_OPERATOR( ==, true, false, false)
-        JSON_HEDLEY_DIAGNOSTIC_POP
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
    }

    /// @brief comparison: equal
@@ -25282,12 +25420,14 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
    /// @sa https://json.nlohmann.me/api/basic_json/operator_eq/
    friend bool operator==(const_reference lhs, const_reference rhs) noexcept
    {
-        JSON_HEDLEY_DIAGNOSTIC_PUSH
 #ifdef __GNUC__
-        JSON_HEDLEY_PRAGMA(GCC diagnostic ignored "-Wfloat-equal")
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wfloat-equal"
 #endif
        JSON_IMPLEMENT_OPERATOR( ==, true, false, false)
-        JSON_HEDLEY_DIAGNOSTIC_POP
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
    }

    /// @brief comparison: equal
@@ -25892,7 +26032,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::forward<InputType>(i));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in CBOR format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -25909,7 +26049,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::move(first), std::move(last));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    template<typename T>
@@ -25935,7 +26075,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::cbor).sax_parse(input_format_t::cbor, &sdp, strict, tag_handler); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in MessagePack format
@@ -25950,7 +26090,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::forward<InputType>(i));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in MessagePack format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -25966,7 +26106,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::move(first), std::move(last));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    template<typename T>
@@ -25990,7 +26130,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::msgpack).sax_parse(input_format_t::msgpack, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in UBJSON format
@@ -26005,7 +26145,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::forward<InputType>(i));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in UBJSON format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -26021,7 +26161,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::move(first), std::move(last));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    template<typename T>
@@ -26045,7 +26185,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::ubjson).sax_parse(input_format_t::ubjson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in BJData format
@@ -26060,7 +26200,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::forward<InputType>(i));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bjdata).sax_parse(input_format_t::bjdata, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in BJData format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -26076,7 +26216,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::move(first), std::move(last));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bjdata).sax_parse(input_format_t::bjdata, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in BSON format
@@ -26091,7 +26231,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::forward<InputType>(i));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    /// @brief create a JSON value from an input in BSON format (iterator pair, or iterator+sentinel pair for C++20 ranges support)
@@ -26107,7 +26247,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        auto ia = detail::input_adapter(std::move(first), std::move(last));
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }

    template<typename T>
@@ -26131,7 +26271,7 @@ class basic_json // NOLINT(cppcoreguidelines-special-member-functions,hicpp-spec
        detail::json_sax_dom_parser<basic_json, decltype(ia)> sdp(result, allow_exceptions);
        // NOLINTNEXTLINE(hicpp-move-const-arg,performance-move-const-arg)
        const bool res = binary_reader<decltype(ia)>(std::move(ia), input_format_t::bson).sax_parse(input_format_t::bson, &sdp, strict); // cppcheck-suppress[accessMoved]
-        return res ? result : basic_json(value_t::discarded);
+        return res ? std::move(result) : basic_json(value_t::discarded);
    }
    /// @}

@@ -26955,7 +27095,7 @@ struct formatter<nlohmann::NLOHMANN_BASIC_JSON_TPL, char> // NOLINT(cert-dcl58-c
 #undef JSON_HEDLEY_CLANG_HAS_ATTRIBUTE
 #undef JSON_HEDLEY_CLANG_HAS_BUILTIN
 #undef JSON_HEDLEY_CLANG_HAS_CPP_ATTRIBUTE
-#undef JSON_HEDLEY_CLANG_HAS_DECLSPEC_ATTRIBUTE
+#undef JSON_HEDLEY_CLANG_HAS_DECLSPEC_DECLSPEC_ATTRIBUTE
 #undef JSON_HEDLEY_CLANG_HAS_EXTENSION
 #undef JSON_HEDLEY_CLANG_HAS_FEATURE
 #undef JSON_HEDLEY_CLANG_HAS_WARNING
@@ -27046,10 +27186,7 @@ struct formatter<nlohmann::NLOHMANN_BASIC_JSON_TPL, char> // NOLINT(cert-dcl58-c
 #undef JSON_HEDLEY_PELLES_VERSION_CHECK
 #undef JSON_HEDLEY_PGI_VERSION
 #undef JSON_HEDLEY_PGI_VERSION_CHECK
-#undef JSON_HEDLEY_PRAGMA
 #undef JSON_HEDLEY_PREDICT
-#undef JSON_HEDLEY_PREDICT_FALSE
-#undef JSON_HEDLEY_PREDICT_TRUE
 #undef JSON_HEDLEY_PRINTF_FORMAT
 #undef JSON_HEDLEY_PRIVATE
 #undef JSON_HEDLEY_PUBLIC
@@ -3288,8 +3288,10 @@ TEST_CASE("BJData")
            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR1), "[json.exception.parse_error.113] parse error at byte 6: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
            CHECK(json::from_bjdata(vR1, true, false).is_discarded());

+            // a dimension vector that opens another one is rejected where the
+            // nested '[' is read, rather than after it has been descended into
            std::vector<uint8_t> const vR2 = {'[', '$', 'i', '#', '[', '#', '[', 'i', 1, ']', ']', 1};
-            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR2), "[json.exception.parse_error.113] parse error at byte 11: syntax error while parsing BJData size: expected length type specification (U, i, u, I, m, l, M, L) after '#'; last byte: 0x5D", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR2), "[json.exception.parse_error.113] parse error at byte 7: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
            CHECK(json::from_bjdata(vR2, true, false).is_discarded());

            std::vector<uint8_t> const vR3 = {'[', '#', '[', 'i', '2', 'i', 2, ']'};
@@ -3297,7 +3299,7 @@ TEST_CASE("BJData")
            CHECK(json::from_bjdata(vR3, true, false).is_discarded());

            std::vector<uint8_t> const vR4 = {'[', '$', 'i', '#', '[', '$', 'i', '#', '[', 'i', 1, ']', 1};
-            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR4), "[json.exception.parse_error.110] parse error at byte 14: syntax error while parsing BJData number: unexpected end of input", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR4), "[json.exception.parse_error.113] parse error at byte 9: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
            CHECK(json::from_bjdata(vR4, true, false).is_discarded());

            std::vector<uint8_t> const vR5 = {'[', '$', 'i', '#', '[', '[', '[', ']', ']', ']'};
@@ -3305,12 +3307,25 @@ TEST_CASE("BJData")
            CHECK(json::from_bjdata(vR5, true, false).is_discarded());

            std::vector<uint8_t> const vR6 = {'[', '$', 'i', '#', '[', '$', 'i', '#', '[', 'i', '2', 'i', 2, ']'};
-            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR6), "[json.exception.parse_error.112] parse error at byte 14: syntax error while parsing BJData size: ndarray can not be recursive", json::parse_error&);
+            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vR6), "[json.exception.parse_error.113] parse error at byte 9: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
            CHECK(json::from_bjdata(vR6, true, false).is_discarded());

            std::vector<uint8_t> const vH = {'[', 'H', '[', '#', '[', '$', 'i', '#', '[', 'i', '2', 'i', 2, ']'};
            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vH), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
            CHECK(json::from_bjdata(vH, true, false).is_discarded());
+
+            // Every "#[" of this chain used to open another dimension vector
+            // and cost several stack frames before anything was rejected, so a
+            // long enough chain crashed the process (see #5104). The nested
+            // vector is refused where it is read, so the length is irrelevant.
+            std::vector<uint8_t> vRdeep = {'['};
+            for (std::size_t i = 0; i < 100000; ++i)
+            {
+                vRdeep.push_back('#');
+                vRdeep.push_back('[');
+            }
+            CHECK_THROWS_WITH_AS(_ = json::from_bjdata(vRdeep), "[json.exception.parse_error.113] parse error at byte 5: syntax error while parsing BJData size: ndarray dimensional vector is not allowed", json::parse_error&);
+            CHECK(json::from_bjdata(vRdeep, true, false).is_discarded());
        }

        SECTION("objects")
@@ -2035,6 +2035,58 @@ TEST_CASE("CBOR definite length equal to the indefinite-length sentinel")
    }
 }

+TEST_CASE("CBOR indefinite-length strings do not recurse per chunk")
+{
+    // Reading an indefinite-length string or byte array used to call itself
+    // once per chunk, so a payload of repeated 0x7F (or 0x5F) bytes exhausted
+    // the call stack before any of the input was rejected. The open levels are
+    // counted now, and the levels below prove the reader still reads the same
+    // values and reports the same errors at the same byte offsets.
+    json _;
+
+    SECTION("many open levels are reported, not crashed on")
+    {
+        const std::vector<uint8_t> input(200000, 0x7F);
+        CHECK_THROWS_WITH_AS(_ = json::from_cbor(input), "[json.exception.parse_error.110] parse error at byte 200001: syntax error while parsing CBOR string: unexpected end of input", json::parse_error&);
+        CHECK(json::from_cbor(input, true, false).is_discarded());
+    }
+
+    SECTION("many open levels are reported, not crashed on (binary)")
+    {
+        const std::vector<uint8_t> input(200000, 0x5F);
+        CHECK_THROWS_WITH_AS(_ = json::from_cbor(input), "[json.exception.parse_error.110] parse error at byte 200001: syntax error while parsing CBOR binary: unexpected end of input", json::parse_error&);
+        CHECK(json::from_cbor(input, true, false).is_discarded());
+    }
+
+    SECTION("chunks are still concatenated")
+    {
+        CHECK(json::from_cbor(std::vector<uint8_t>({0x7F, 0xFF})) == json(""));
+        CHECK(json::from_cbor(std::vector<uint8_t>({0x7F, 0x61, 0x61, 0xFF})) == json("a"));
+        // nested indefinite-length strings are concatenated across levels
+        CHECK(json::from_cbor(std::vector<uint8_t>({0x7F, 0x7F, 0x61, 0x61, 0xFF, 0x61, 0x62, 0xFF})) == json("ab"));
+        CHECK(json::from_cbor(std::vector<uint8_t>({0x7F, 0x7F, 0x7F, 0x61, 0x7A, 0xFF, 0xFF, 0xFF})) == json("z"));
+        CHECK(json::from_cbor(std::vector<uint8_t>({0xA1, 0x7F, 0x61, 0x61, 0xFF, 0x01})) == json({{"a", 1}}));
+    }
+
+    SECTION("chunks are still concatenated (binary)")
+    {
+        CHECK(json::from_cbor(std::vector<uint8_t>({0x5F, 0x41, 0x61, 0xFF})) == json::binary({0x61}));
+        CHECK(json::from_cbor(std::vector<uint8_t>({0x5F, 0x5F, 0x41, 0x61, 0xFF, 0x41, 0x62, 0xFF})) == json::binary({0x61, 0x62}));
+    }
+
+    SECTION("a chunk that is not a string is still rejected")
+    {
+        CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<uint8_t>({0x7F, 0x7F, 0x00})), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing CBOR string: expected length specification (0x60-0x7B) or indefinite string type (0x7F); last byte: 0x00", json::parse_error&);
+        CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<uint8_t>({0x5F, 0x5F, 0x00})), "[json.exception.parse_error.113] parse error at byte 3: syntax error while parsing CBOR binary: expected length specification (0x40-0x5B) or indefinite binary array type (0x5F); last byte: 0x00", json::parse_error&);
+    }
+
+    SECTION("a break marker outside an indefinite-length string is not a string")
+    {
+        // 0xFF only closes a string that was opened; on its own it is not one
+        CHECK_THROWS_WITH_AS(_ = json::from_cbor(std::vector<uint8_t>({0xA1, 0xFF, 0x01})), "[json.exception.parse_error.113] parse error at byte 2: syntax error while parsing CBOR string: expected length specification (0x60-0x7B) or indefinite string type (0x7F); last byte: 0xFF", json::parse_error&);
+    }
+}
+
 TEST_CASE("CBOR roundtrips" * doctest::skip())
 {
    SECTION("input from flynn")
@@ -1,486 +0,0 @@
-//     __ _____ _____ _____
-//  __|  |   __|     |   | |  JSON for Modern C++
-// |  |  |__   |  |  | | | |  version 3.12.0
-// |_____|_____|_____|_|___|  https://github.com/nlohmann/json
-//
-// SPDX-FileCopyrightText: 2013-2026 Niels Lohmann <https://nlohmann.me>
-// SPDX-License-Identifier: MIT
-
-// This file makes sure that none of the internal JSON_HEDLEY_* macros (vendored
-// from https://nemequ.github.io/hedley/, see
-// include/nlohmann/thirdparty/hedley/hedley.hpp) leak into the including
-// translation unit. include/nlohmann/detail/macro_unscope.hpp is supposed to
-// #undef every JSON_HEDLEY_* macro (via hedley_undef.hpp) once json.hpp has
-// been fully processed. See https://github.com/nlohmann/json/issues/5408,
-// where JSON_HEDLEY_PRAGMA, JSON_HEDLEY_PREDICT_TRUE, JSON_HEDLEY_PREDICT_FALSE,
-// and JSON_HEDLEY_CLANG_HAS_DECLSPEC_ATTRIBUTE escaped this cleanup because
-// hedley_undef.hpp had no matching #undef for them.
-//
-// The #ifdef/#error checks below are mechanically derived from the full list
-// of macro names in hedley_undef.hpp, so every JSON_HEDLEY_* macro is covered
-// -- not just the four that leaked historically.
-
-#include "doctest_compatibility.h"
-
-#include <nlohmann/json.hpp>
-
-#ifdef JSON_HEDLEY_ALWAYS_INLINE
-    #error "JSON_HEDLEY_ALWAYS_INLINE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_ARM_VERSION
-    #error "JSON_HEDLEY_ARM_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_ARM_VERSION_CHECK
-    #error "JSON_HEDLEY_ARM_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_ARRAY_PARAM
-    #error "JSON_HEDLEY_ARRAY_PARAM must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_ASSUME
-    #error "JSON_HEDLEY_ASSUME must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_BEGIN_C_DECLS
-    #error "JSON_HEDLEY_BEGIN_C_DECLS must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CLANG_HAS_ATTRIBUTE
-    #error "JSON_HEDLEY_CLANG_HAS_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CLANG_HAS_BUILTIN
-    #error "JSON_HEDLEY_CLANG_HAS_BUILTIN must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CLANG_HAS_CPP_ATTRIBUTE
-    #error "JSON_HEDLEY_CLANG_HAS_CPP_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CLANG_HAS_DECLSPEC_ATTRIBUTE
-    #error "JSON_HEDLEY_CLANG_HAS_DECLSPEC_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CLANG_HAS_EXTENSION
-    #error "JSON_HEDLEY_CLANG_HAS_EXTENSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CLANG_HAS_FEATURE
-    #error "JSON_HEDLEY_CLANG_HAS_FEATURE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CLANG_HAS_WARNING
-    #error "JSON_HEDLEY_CLANG_HAS_WARNING must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_COMPCERT_VERSION
-    #error "JSON_HEDLEY_COMPCERT_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_COMPCERT_VERSION_CHECK
-    #error "JSON_HEDLEY_COMPCERT_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CONCAT
-    #error "JSON_HEDLEY_CONCAT must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CONCAT3
-    #error "JSON_HEDLEY_CONCAT3 must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CONCAT3_EX
-    #error "JSON_HEDLEY_CONCAT3_EX must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CONCAT_EX
-    #error "JSON_HEDLEY_CONCAT_EX must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CONST
-    #error "JSON_HEDLEY_CONST must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CONSTEXPR
-    #error "JSON_HEDLEY_CONSTEXPR must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CONST_CAST
-    #error "JSON_HEDLEY_CONST_CAST must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CPP_CAST
-    #error "JSON_HEDLEY_CPP_CAST must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CRAY_VERSION
-    #error "JSON_HEDLEY_CRAY_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_CRAY_VERSION_CHECK
-    #error "JSON_HEDLEY_CRAY_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_C_DECL
-    #error "JSON_HEDLEY_C_DECL must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DEPRECATED
-    #error "JSON_HEDLEY_DEPRECATED must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DEPRECATED_FOR
-    #error "JSON_HEDLEY_DEPRECATED_FOR must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DIAGNOSTIC_DISABLE_CAST_QUAL
-    #error "JSON_HEDLEY_DIAGNOSTIC_DISABLE_CAST_QUAL must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DIAGNOSTIC_DISABLE_CPP98_COMPAT_WRAP_
-    #error "JSON_HEDLEY_DIAGNOSTIC_DISABLE_CPP98_COMPAT_WRAP_ must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DIAGNOSTIC_DISABLE_DEPRECATED
-    #error "JSON_HEDLEY_DIAGNOSTIC_DISABLE_DEPRECATED must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DIAGNOSTIC_DISABLE_UNKNOWN_CPP_ATTRIBUTES
-    #error "JSON_HEDLEY_DIAGNOSTIC_DISABLE_UNKNOWN_CPP_ATTRIBUTES must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DIAGNOSTIC_DISABLE_UNKNOWN_PRAGMAS
-    #error "JSON_HEDLEY_DIAGNOSTIC_DISABLE_UNKNOWN_PRAGMAS must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DIAGNOSTIC_DISABLE_UNUSED_FUNCTION
-    #error "JSON_HEDLEY_DIAGNOSTIC_DISABLE_UNUSED_FUNCTION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DIAGNOSTIC_POP
-    #error "JSON_HEDLEY_DIAGNOSTIC_POP must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DIAGNOSTIC_PUSH
-    #error "JSON_HEDLEY_DIAGNOSTIC_PUSH must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DMC_VERSION
-    #error "JSON_HEDLEY_DMC_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_DMC_VERSION_CHECK
-    #error "JSON_HEDLEY_DMC_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_EMPTY_BASES
-    #error "JSON_HEDLEY_EMPTY_BASES must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_EMSCRIPTEN_VERSION
-    #error "JSON_HEDLEY_EMSCRIPTEN_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_EMSCRIPTEN_VERSION_CHECK
-    #error "JSON_HEDLEY_EMSCRIPTEN_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_END_C_DECLS
-    #error "JSON_HEDLEY_END_C_DECLS must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_FALL_THROUGH
-    #error "JSON_HEDLEY_FALL_THROUGH must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_FLAGS
-    #error "JSON_HEDLEY_FLAGS must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_FLAGS_CAST
-    #error "JSON_HEDLEY_FLAGS_CAST must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GCC_HAS_ATTRIBUTE
-    #error "JSON_HEDLEY_GCC_HAS_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GCC_HAS_BUILTIN
-    #error "JSON_HEDLEY_GCC_HAS_BUILTIN must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GCC_HAS_CPP_ATTRIBUTE
-    #error "JSON_HEDLEY_GCC_HAS_CPP_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GCC_HAS_DECLSPEC_ATTRIBUTE
-    #error "JSON_HEDLEY_GCC_HAS_DECLSPEC_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GCC_HAS_EXTENSION
-    #error "JSON_HEDLEY_GCC_HAS_EXTENSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GCC_HAS_FEATURE
-    #error "JSON_HEDLEY_GCC_HAS_FEATURE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GCC_HAS_WARNING
-    #error "JSON_HEDLEY_GCC_HAS_WARNING must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GCC_NOT_CLANG_VERSION_CHECK
-    #error "JSON_HEDLEY_GCC_NOT_CLANG_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GCC_VERSION
-    #error "JSON_HEDLEY_GCC_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GCC_VERSION_CHECK
-    #error "JSON_HEDLEY_GCC_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GNUC_HAS_ATTRIBUTE
-    #error "JSON_HEDLEY_GNUC_HAS_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GNUC_HAS_BUILTIN
-    #error "JSON_HEDLEY_GNUC_HAS_BUILTIN must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GNUC_HAS_CPP_ATTRIBUTE
-    #error "JSON_HEDLEY_GNUC_HAS_CPP_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GNUC_HAS_DECLSPEC_ATTRIBUTE
-    #error "JSON_HEDLEY_GNUC_HAS_DECLSPEC_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GNUC_HAS_EXTENSION
-    #error "JSON_HEDLEY_GNUC_HAS_EXTENSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GNUC_HAS_FEATURE
-    #error "JSON_HEDLEY_GNUC_HAS_FEATURE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GNUC_HAS_WARNING
-    #error "JSON_HEDLEY_GNUC_HAS_WARNING must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GNUC_VERSION
-    #error "JSON_HEDLEY_GNUC_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_GNUC_VERSION_CHECK
-    #error "JSON_HEDLEY_GNUC_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_HAS_ATTRIBUTE
-    #error "JSON_HEDLEY_HAS_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_HAS_BUILTIN
-    #error "JSON_HEDLEY_HAS_BUILTIN must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_HAS_CPP_ATTRIBUTE
-    #error "JSON_HEDLEY_HAS_CPP_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_HAS_CPP_ATTRIBUTE_NS
-    #error "JSON_HEDLEY_HAS_CPP_ATTRIBUTE_NS must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_HAS_DECLSPEC_ATTRIBUTE
-    #error "JSON_HEDLEY_HAS_DECLSPEC_ATTRIBUTE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_HAS_EXTENSION
-    #error "JSON_HEDLEY_HAS_EXTENSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_HAS_FEATURE
-    #error "JSON_HEDLEY_HAS_FEATURE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_HAS_WARNING
-    #error "JSON_HEDLEY_HAS_WARNING must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_IAR_VERSION
-    #error "JSON_HEDLEY_IAR_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_IAR_VERSION_CHECK
-    #error "JSON_HEDLEY_IAR_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_IBM_VERSION
-    #error "JSON_HEDLEY_IBM_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_IBM_VERSION_CHECK
-    #error "JSON_HEDLEY_IBM_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_IMPORT
-    #error "JSON_HEDLEY_IMPORT must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_INLINE
-    #error "JSON_HEDLEY_INLINE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_INTEL_CL_VERSION
-    #error "JSON_HEDLEY_INTEL_CL_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_INTEL_CL_VERSION_CHECK
-    #error "JSON_HEDLEY_INTEL_CL_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_INTEL_VERSION
-    #error "JSON_HEDLEY_INTEL_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_INTEL_VERSION_CHECK
-    #error "JSON_HEDLEY_INTEL_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_IS_CONSTANT
-    #error "JSON_HEDLEY_IS_CONSTANT must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_IS_CONSTEXPR_
-    #error "JSON_HEDLEY_IS_CONSTEXPR_ must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_LIKELY
-    #error "JSON_HEDLEY_LIKELY must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_MALLOC
-    #error "JSON_HEDLEY_MALLOC must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_MCST_LCC_VERSION
-    #error "JSON_HEDLEY_MCST_LCC_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_MCST_LCC_VERSION_CHECK
-    #error "JSON_HEDLEY_MCST_LCC_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_MESSAGE
-    #error "JSON_HEDLEY_MESSAGE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_MSVC_VERSION
-    #error "JSON_HEDLEY_MSVC_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_MSVC_VERSION_CHECK
-    #error "JSON_HEDLEY_MSVC_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_NEVER_INLINE
-    #error "JSON_HEDLEY_NEVER_INLINE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_NON_NULL
-    #error "JSON_HEDLEY_NON_NULL must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_NO_ESCAPE
-    #error "JSON_HEDLEY_NO_ESCAPE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_NO_RETURN
-    #error "JSON_HEDLEY_NO_RETURN must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_NO_THROW
-    #error "JSON_HEDLEY_NO_THROW must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_NULL
-    #error "JSON_HEDLEY_NULL must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PELLES_VERSION
-    #error "JSON_HEDLEY_PELLES_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PELLES_VERSION_CHECK
-    #error "JSON_HEDLEY_PELLES_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PGI_VERSION
-    #error "JSON_HEDLEY_PGI_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PGI_VERSION_CHECK
-    #error "JSON_HEDLEY_PGI_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PRAGMA
-    #error "JSON_HEDLEY_PRAGMA must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PREDICT
-    #error "JSON_HEDLEY_PREDICT must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PREDICT_FALSE
-    #error "JSON_HEDLEY_PREDICT_FALSE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PREDICT_TRUE
-    #error "JSON_HEDLEY_PREDICT_TRUE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PRINTF_FORMAT
-    #error "JSON_HEDLEY_PRINTF_FORMAT must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PRIVATE
-    #error "JSON_HEDLEY_PRIVATE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PUBLIC
-    #error "JSON_HEDLEY_PUBLIC must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_PURE
-    #error "JSON_HEDLEY_PURE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_REINTERPRET_CAST
-    #error "JSON_HEDLEY_REINTERPRET_CAST must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_REQUIRE
-    #error "JSON_HEDLEY_REQUIRE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_REQUIRE_CONSTEXPR
-    #error "JSON_HEDLEY_REQUIRE_CONSTEXPR must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_REQUIRE_MSG
-    #error "JSON_HEDLEY_REQUIRE_MSG must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_RESTRICT
-    #error "JSON_HEDLEY_RESTRICT must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_RETURNS_NON_NULL
-    #error "JSON_HEDLEY_RETURNS_NON_NULL must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_SENTINEL
-    #error "JSON_HEDLEY_SENTINEL must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_STATIC_ASSERT
-    #error "JSON_HEDLEY_STATIC_ASSERT must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_STATIC_CAST
-    #error "JSON_HEDLEY_STATIC_CAST must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_STRINGIFY
-    #error "JSON_HEDLEY_STRINGIFY must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_STRINGIFY_EX
-    #error "JSON_HEDLEY_STRINGIFY_EX must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_SUNPRO_VERSION
-    #error "JSON_HEDLEY_SUNPRO_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_SUNPRO_VERSION_CHECK
-    #error "JSON_HEDLEY_SUNPRO_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TINYC_VERSION
-    #error "JSON_HEDLEY_TINYC_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TINYC_VERSION_CHECK
-    #error "JSON_HEDLEY_TINYC_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_ARMCL_VERSION
-    #error "JSON_HEDLEY_TI_ARMCL_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_ARMCL_VERSION_CHECK
-    #error "JSON_HEDLEY_TI_ARMCL_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_CL2000_VERSION
-    #error "JSON_HEDLEY_TI_CL2000_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_CL2000_VERSION_CHECK
-    #error "JSON_HEDLEY_TI_CL2000_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_CL430_VERSION
-    #error "JSON_HEDLEY_TI_CL430_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_CL430_VERSION_CHECK
-    #error "JSON_HEDLEY_TI_CL430_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_CL6X_VERSION
-    #error "JSON_HEDLEY_TI_CL6X_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_CL6X_VERSION_CHECK
-    #error "JSON_HEDLEY_TI_CL6X_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_CL7X_VERSION
-    #error "JSON_HEDLEY_TI_CL7X_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_CL7X_VERSION_CHECK
-    #error "JSON_HEDLEY_TI_CL7X_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_CLPRU_VERSION
-    #error "JSON_HEDLEY_TI_CLPRU_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_CLPRU_VERSION_CHECK
-    #error "JSON_HEDLEY_TI_CLPRU_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_VERSION
-    #error "JSON_HEDLEY_TI_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_TI_VERSION_CHECK
-    #error "JSON_HEDLEY_TI_VERSION_CHECK must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_UNAVAILABLE
-    #error "JSON_HEDLEY_UNAVAILABLE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_UNLIKELY
-    #error "JSON_HEDLEY_UNLIKELY must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_UNPREDICTABLE
-    #error "JSON_HEDLEY_UNPREDICTABLE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_UNREACHABLE
-    #error "JSON_HEDLEY_UNREACHABLE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_UNREACHABLE_RETURN
-    #error "JSON_HEDLEY_UNREACHABLE_RETURN must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_VERSION
-    #error "JSON_HEDLEY_VERSION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_VERSION_DECODE_MAJOR
-    #error "JSON_HEDLEY_VERSION_DECODE_MAJOR must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_VERSION_DECODE_MINOR
-    #error "JSON_HEDLEY_VERSION_DECODE_MINOR must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_VERSION_DECODE_REVISION
-    #error "JSON_HEDLEY_VERSION_DECODE_REVISION must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_VERSION_ENCODE
-    #error "JSON_HEDLEY_VERSION_ENCODE must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_WARNING
-    #error "JSON_HEDLEY_WARNING must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_WARN_UNUSED_RESULT
-    #error "JSON_HEDLEY_WARN_UNUSED_RESULT must not remain defined after including json.hpp"
-#endif
-#ifdef JSON_HEDLEY_WARN_UNUSED_RESULT_MSG
-    #error "JSON_HEDLEY_WARN_UNUSED_RESULT_MSG must not remain defined after including json.hpp"
-#endif
-
-TEST_CASE("no JSON_HEDLEY_* macro leaks after including json.hpp")
-{
-    // if this test compiles at all, none of the JSON_HEDLEY_* macros checked
-    // above remained defined after including <nlohmann/json.hpp>
-    CHECK(true);
-}
@@ -2149,6 +2149,61 @@ TEST_CASE("UBJSON")
    }
 }

+TEST_CASE("UBJSON optimized arrays of a valueless type are bounded")
+{
+    // An element of type 'Z', 'T' or 'F' is encoded by its marker alone, so an
+    // optimized array of one of those has no payload and the declared count is
+    // the only thing deciding how much is allocated. Ten bytes used to produce
+    // billions of values (#2793); every other type costs at least one byte per
+    // element and is bounded by the end of the input.
+    json _;
+
+    SECTION("an excessive count is rejected")
+    {
+        // 'l' is a big-endian int32: 0x7FFFFFFF elements, about 34 GB of value
+        for (const auto marker :
+                {'Z', 'T', 'F'
+                })
+        {
+            const std::vector<uint8_t> input = {'[', '$', static_cast<uint8_t>(marker), '#', 'l', 0x7F, 0xFF, 0xFF, 0xFF};
+            CHECK_THROWS_WITH_AS(_ = json::from_ubjson(input), "[json.exception.out_of_range.408] syntax error while parsing UBJSON size: excessive array size", json::out_of_range&);
+            CHECK(json::from_ubjson(input, true, false).is_discarded());
+        }
+    }
+
+    SECTION("ordinary counts are unaffected")
+    {
+        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '$', 'Z', '#', 'i', 3})) == json({nullptr, nullptr, nullptr}));
+        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '$', 'T', '#', 'i', 2})) == json({true, true}));
+        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '$', 'F', '#', 'i', 2})) == json({false, false}));
+        // 'N' is a no-op rather than a value, and still yields an empty array
+        CHECK(json::from_ubjson(std::vector<uint8_t>({'[', '$', 'N', '#', 'i', 2})) == json::array());
+    }
+
+    SECTION("a type with a payload is unaffected")
+    {
+        // the same count for 'U' is bounded by the end of the input instead
+        const std::vector<uint8_t> input = {'[', '$', 'U', '#', 'l', 0x7F, 0xFF, 0xFF, 0xFF};
+        CHECK_THROWS_AS(_ = json::from_ubjson(input), json::parse_error&);
+    }
+
+    SECTION("the writer stays within what the reader accepts")
+    {
+        // below the limit the optimized form is used and is tiny; above it the
+        // writer falls back so that the result can still be read back
+        json const at_limit(1048576, nullptr);
+        const auto v_at_limit = json::to_ubjson(at_limit, true, true);
+        CHECK(v_at_limit.size() == 9);
+        CHECK(v_at_limit.at(1) == '$');
+        CHECK(json::from_ubjson(v_at_limit) == at_limit);
+
+        json const above_limit(1048577, nullptr);
+        const auto v_above_limit = json::to_ubjson(above_limit, true, true);
+        CHECK(v_above_limit.at(1) != '$');
+        CHECK(json::from_ubjson(v_above_limit) == above_limit);
+    }
+}
+
 TEST_CASE("Universal Binary JSON Specification Examples 1")
 {
    SECTION("Null Value")
Author	SHA1	Message	Date
Niels Lohmann	d89acce09a	Bound UBJSON optimized arrays of a valueless type An element of type 'Z' (null), 'T' (true) or 'F' (false) is encoded by its type marker alone, so an optimized UBJSON array of one of those has no payload: reading an element consumes no input at all. Its declared count is therefore the only thing that decides how much is allocated, and nothing bounded it. "[$Z#l" and a four-byte count is nine bytes of input describing two billion values; #2793 reports 35 GB and 150 seconds from ten bytes, and OSS-Fuzz has an out-of-memory and a timeout report for the same shape. Every other type costs at least one byte per element, so the end of the input bounds it. 'N' (no-op) is already skipped rather than stored. Objects are not affected either: each element is preceded by its key, which costs bytes. And BJData already refuses these markers as an optimized type, so this is a plain UBJSON matter. Reject a count above 1,048,576 elements for those three types with out_of_range.408, the code this reader already uses for a declared size it will not honour. The check runs before the SAX start event, so no container is opened and then abandoned. Rejecting on the read side alone would break the guarantee that anything to_ubjson() writes can be read back, and would trip the round-trip assertion in fuzzer-parse_ubjson.cpp. So the writer falls back to the unoptimized encoding, one byte per element, for arrays of these types above the same limit. Its decision depends only on the array's size, which is identical for a value and for anything parsed back from it, so the round trip is stable. No existing test changes: the largest such count in the test suite is 65,793. The excessive-size test that already used this shape still passes, now rejected a little earlier than by the max_size() check it used to reach. Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-09-06 18:12:41 +02:00
Niels Lohmann	bcd5af62c7	Reject a nested BJData ndarray dimension vector where it is read get_ubjson_size_type() takes an inside_ndarray parameter saying whether it is being called for an ndarray's dimension vector, where another ndarray is not allowed. It then seeded the flag it passes down to get_ubjson_size_value() with `false` rather than with that parameter, and only consulted inside_ndarray afterwards, on the '$' branch. So on the '#' branch nothing stopped the descent: every "#[" pair of an input like "[" followed by "#[#[#[..." opened another dimension vector, several native stack frames deeper each time, and the recursion was only reported on the way back out. 100,000 pairs crash the process. This is #5104 again, in a path that has nothing to do with containers. Seed the flag with inside_ndarray, which is what get_ubjson_size_value() documents it wants: "for input, `true` means already inside an ndarray vector or ndarray dimension is not allowed". The nested '[' is then refused where it is read, so the length of the chain no longer matters. Both post-checks gain `&& !inside_ndarray`, because an ndarray was found here only if the flag flipped -- get_ubjson_size_value() only ever returns `true` when its initial value was `false`, as its documentation says. With that, the "ndarray can not be recursive" branch is unreachable: a recursive ndarray is now caught one level earlier, and reported as "ndarray dimensional vector is not allowed" like every other nested dimension vector. Three existing expectations move accordingly (vR2, vR4, vR6). All three now fail earlier, and all three now report the same error that vR1, vR5 and vH already reported for the same shape, which is the more consistent outcome. Everything else is unchanged: valid 1D and 2D ndarrays, optimized containers and plain arrays produce identical results, and unit-ubjson is untouched. Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-09-06 18:12:40 +02:00
Niels Lohmann	25a4333a31	Stop CBOR indefinite-length strings from recursing per chunk get_cbor_string() and get_cbor_binary() handled the indefinite-length forms (0x7F and 0x5F) by calling themselves once per chunk. Each chunk therefore cost a native stack frame, and since a chunk may itself be an indefinite- length string, an input of repeated 0x7F bytes reached one frame per input byte: 200,000 of them crash the process with SIGSEGV before a single byte is rejected. This is the same defect as #5104, in a path the container-level work does not touch. Count the open levels instead of recursing through them. That is enough here because every chunk is appended to the same result -- get_bytes() writes at result.size() -- so there is no per-level state to keep. The temporary chunk string and its copy into the result go away with the recursion. The definite-length cases move to get_cbor_string_chunk() and get_cbor_binary_chunk() unchanged, including their error messages, which still name 0x7F and 0x5F because those are handled one level up. Behaviour is unchanged. Comparing against develop over the interesting byte sequences -- empty, single-chunk, nested, over-closed and truncated forms, both strings and byte arrays, and an indefinite-length map key -- produces identical values, error codes, messages and byte offsets. The 200,000-level input now reports parse_error.110 at byte 200001 instead of crashing. Note that nesting these is not valid CBOR: RFC 8949, Section 3.2.3 forbids it. This does not change that either way -- it has always been accepted, and rejecting it is a separate decision (#5317, #5325). Should it be rejected later, that is now one condition on the level counter rather than a change to the control flow. Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-09-06 18:12:39 +02:00
Niels Lohmann	c3219fdc30	Return the parsed value by move from from_cbor() and friends The binary entry points end with return res ? result : basic_json(value_t::discarded); The condition operator's second operand is an lvalue, so this is not a case where the return value can be elided or implicitly moved from: every successful from_cbor(), from_msgpack(), from_ubjson(), from_bjdata() and from_bson() call deep-copies the value it just parsed, and then destroys the original. The copy is not cheap, and it is not incidental: basic_json's copy constructor walks the whole value. Parsing a 2 MB CBOR document with 60,000 objects, median of 25 runs, clang 17 -O3: from_cbor 26.99 ms -> 14.65 ms from_msgpack 26.82 ms -> 14.82 ms Moving instead of copying is the entire change; the parsed value is not used again after the return expression is evaluated. There is a second reason to prefer the move. The copy constructor recurses once per nesting level, so the copy is also a stack-overflow path on the return side, on a value the reader has already accepted. That is currently masked because the readers themselves recurse and overflow first (#5104), but it has to be fixed for making them iterative to have any effect. Signed-off-by: Niels Lohmann <mail@nlohmann.me>	2026-09-06 16:41:35 +02:00