Fix to_bjdata() silently truncating out-of-range _ArrayData_ elements

write_bjdata_ndarray() validated that each _ArrayData_ element matched
the number kind (integer vs. float) named by _ArrayType_, but not its
range. An element that did not fit the target C++ type (e.g. 256 for
"uint8") was silently wrapped by the static_cast used to write it, or,
for "single", silently overflowed to infinity.

Range-check each element against the type named by _ArrayType_ before
writing it, reusing the existing fallback path that already encodes
the annotated object as a plain object for other invalid-annotation
cases in this function.

Fixes #5403.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

include/nlohmann/detail/output/binary_writer.hpp

@@ -1647,6 +1647,20 @@ class binary_writer
         return 'D';  // float 64
     }
 
+    /*!
+    @brief checks whether a JSON number fits into @a TargetType
+    @param[in] el a JSON number of either the signed or unsigned integer kind
+    @return whether @a el's value can be represented by @a TargetType without
+            wrapping, regardless of which of the two kinds it is stored as
+    */
+    template<typename TargetType>
+    static bool bjdata_ndarray_value_in_range(const BasicJsonType& el)
+    {
+        return el.is_number_unsigned()
+               ? value_in_range_of<TargetType>(el.template get<std::uint64_t>())
+               : value_in_range_of<TargetType>(el.template get<std::int64_t>());
+    }
+
     /*!
     @return false if the object is successfully converted to a bjdata ndarray, true if the type or size is invalid
     */
@@ -1731,6 +1745,60 @@ class binary_writer
             }
         }
 
+        // every element is cast to the (possibly narrower) C++ type matching
+        // dtype below; a value that does not fit that type would silently
+        // wrap (integers) or overflow to infinity (the "single" precision
+        // float) instead of being reported, so such an object falls back to
+        // a plain object encoding as well
+        for (const auto& el : value.at(key))
+        {
+            bool in_range = true;
+            switch (dtype)
+            {
+                case 'U':
+                case 'C':
+                case 'B':
+                    in_range = bjdata_ndarray_value_in_range<std::uint8_t>(el);
+                    break;
+                case 'i':
+                    in_range = bjdata_ndarray_value_in_range<std::int8_t>(el);
+                    break;
+                case 'u':
+                    in_range = bjdata_ndarray_value_in_range<std::uint16_t>(el);
+                    break;
+                case 'I':
+                    in_range = bjdata_ndarray_value_in_range<std::int16_t>(el);
+                    break;
+                case 'm':
+                    in_range = bjdata_ndarray_value_in_range<std::uint32_t>(el);
+                    break;
+                case 'l':
+                    in_range = bjdata_ndarray_value_in_range<std::int32_t>(el);
+                    break;
+                case 'M':
+                    in_range = bjdata_ndarray_value_in_range<std::uint64_t>(el);
+                    break;
+                case 'L':
+                    in_range = bjdata_ndarray_value_in_range<std::int64_t>(el);
+                    break;
+                case 'd':
+                {
+                    const auto dval = el.template get<double>();
+                    in_range = !std::isfinite(dval) ||
+                               (dval >= static_cast<double>(std::numeric_limits<float>::lowest()) &&
+                                dval <= static_cast<double>((std::numeric_limits<float>::max)()));
+                    break;
+                }
+                default:
+                    // 'D' (double) already spans the full range of number_float_t
+                    break;
+            }
+            if (!in_range)
+            {
+                return true;
+            }
+        }
+
         oa->write_character('[');
         oa->write_character('$');
         oa->write_character(dtype);

include/nlohmann/detail/output/serializer.hpp

@@ -71,7 +71,7 @@ class serializer
         , thousands_sep(loc->thousands_sep == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->thousands_sep)))
         , decimal_point(loc->decimal_point == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->decimal_point)))
         , indent_char(ichar)
-        , indent_string()
+        , indent_string(512, indent_char)
         , error_handler(error_handler_)
     {}
 
@@ -126,10 +126,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -203,10 +199,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -268,10 +260,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -1022,7 +1010,7 @@ class serializer
 
     /// the indentation character
     const char indent_char;
-    /// the indentation string (lazily allocated on first use by a pretty-print branch)
+    /// the indentation string
     string_t indent_string;
 
     /// error_handler how to react on decoding errors

single_include/nlohmann/json.hpp

@@ -18655,6 +18655,20 @@ class binary_writer
         return 'D';  // float 64
     }
 
+    /*!
+    @brief checks whether a JSON number fits into @a TargetType
+    @param[in] el a JSON number of either the signed or unsigned integer kind
+    @return whether @a el's value can be represented by @a TargetType without
+            wrapping, regardless of which of the two kinds it is stored as
+    */
+    template<typename TargetType>
+    static bool bjdata_ndarray_value_in_range(const BasicJsonType& el)
+    {
+        return el.is_number_unsigned()
+               ? value_in_range_of<TargetType>(el.template get<std::uint64_t>())
+               : value_in_range_of<TargetType>(el.template get<std::int64_t>());
+    }
+
     /*!
     @return false if the object is successfully converted to a bjdata ndarray, true if the type or size is invalid
     */
@@ -18739,6 +18753,60 @@ class binary_writer
             }
         }
 
+        // every element is cast to the (possibly narrower) C++ type matching
+        // dtype below; a value that does not fit that type would silently
+        // wrap (integers) or overflow to infinity (the "single" precision
+        // float) instead of being reported, so such an object falls back to
+        // a plain object encoding as well
+        for (const auto& el : value.at(key))
+        {
+            bool in_range = true;
+            switch (dtype)
+            {
+                case 'U':
+                case 'C':
+                case 'B':
+                    in_range = bjdata_ndarray_value_in_range<std::uint8_t>(el);
+                    break;
+                case 'i':
+                    in_range = bjdata_ndarray_value_in_range<std::int8_t>(el);
+                    break;
+                case 'u':
+                    in_range = bjdata_ndarray_value_in_range<std::uint16_t>(el);
+                    break;
+                case 'I':
+                    in_range = bjdata_ndarray_value_in_range<std::int16_t>(el);
+                    break;
+                case 'm':
+                    in_range = bjdata_ndarray_value_in_range<std::uint32_t>(el);
+                    break;
+                case 'l':
+                    in_range = bjdata_ndarray_value_in_range<std::int32_t>(el);
+                    break;
+                case 'M':
+                    in_range = bjdata_ndarray_value_in_range<std::uint64_t>(el);
+                    break;
+                case 'L':
+                    in_range = bjdata_ndarray_value_in_range<std::int64_t>(el);
+                    break;
+                case 'd':
+                {
+                    const auto dval = el.template get<double>();
+                    in_range = !std::isfinite(dval) ||
+                               (dval >= static_cast<double>(std::numeric_limits<float>::lowest()) &&
+                                dval <= static_cast<double>((std::numeric_limits<float>::max)()));
+                    break;
+                }
+                default:
+                    // 'D' (double) already spans the full range of number_float_t
+                    break;
+            }
+            if (!in_range)
+            {
+                return true;
+            }
+        }
+
         oa->write_character('[');
         oa->write_character('$');
         oa->write_character(dtype);
@@ -20150,7 +20218,7 @@ class serializer
         , thousands_sep(loc->thousands_sep == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->thousands_sep)))
         , decimal_point(loc->decimal_point == nullptr ? '\0' : std::char_traits<char>::to_char_type(* (loc->decimal_point)))
         , indent_char(ichar)
-        , indent_string()
+        , indent_string(512, indent_char)
         , error_handler(error_handler_)
     {}
 
@@ -20205,10 +20273,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -20282,10 +20346,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -20347,10 +20407,6 @@ class serializer
 
                     // variable to hold indentation for recursive calls
                     const auto new_indent = current_indent + indent_step;
-                    if (JSON_HEDLEY_UNLIKELY(indent_string.empty()))
-                    {
-                        indent_string.resize(512, indent_char);
-                    }
                     if (JSON_HEDLEY_UNLIKELY(indent_string.size() < new_indent))
                     {
                         indent_string.resize(indent_string.size() * 2, ' ');
@@ -21101,7 +21157,7 @@ class serializer
 
     /// the indentation character
     const char indent_char;
-    /// the indentation string (lazily allocated on first use by a pretty-print branch)
+    /// the indentation string
     string_t indent_string;
 
     /// error_handler how to react on decoding errors

tests/src/unit-bjdata.cpp

@@ -2776,6 +2776,53 @@ TEST_CASE("BJData")
                 CHECK(out_num.at(0) == '{');
                 CHECK(json::from_bjdata(out_num) == j_num);
             }
+
+            SECTION("ndarray with out-of-range _ArrayData_ elements stays as object")
+            {
+                // each element is cast to the (possibly narrower) C++ type
+                // named by _ArrayType_ before being written; a value that
+                // does not fit that type would silently wrap instead of
+                // being reported, so such an object falls back to a plain
+                // object encoding that still round-trips (see GitHub issue #5403)
+
+                // an unsigned element that does not fit uint8
+                json const j_uint8 = json({{"_ArrayType_", "uint8"}, {"_ArraySize_", {2}}, {"_ArrayData_", {1, 256}}});
+                const auto out_uint8 = json::to_bjdata(j_uint8);
+                CHECK(out_uint8.at(0) == '{');
+                CHECK(json::from_bjdata(out_uint8) == j_uint8);
+
+                // a signed element that does not fit int8
+                json const j_int8 = json({{"_ArrayType_", "int8"}, {"_ArraySize_", {2}}, {"_ArrayData_", {1, 200}}});
+                const auto out_int8 = json::to_bjdata(j_int8);
+                CHECK(out_int8.at(0) == '{');
+                CHECK(json::from_bjdata(out_int8) == j_int8);
+
+                // a negative element is likewise out of range for an
+                // unsigned _ArrayType_
+                json const j_uint16_neg = json({{"_ArrayType_", "uint16"}, {"_ArraySize_", {2}}, {"_ArrayData_", {1, -1}}});
+                const auto out_uint16_neg = json::to_bjdata(j_uint16_neg);
+                CHECK(out_uint16_neg.at(0) == '{');
+                CHECK(json::from_bjdata(out_uint16_neg) == j_uint16_neg);
+
+                // a double element that overflows to infinity when narrowed
+                // to the "single" (float) precision named by _ArrayType_
+                json const j_single = json({{"_ArrayType_", "single"}, {"_ArraySize_", {2}}, {"_ArrayData_", {1.5, 1e40}}});
+                const auto out_single = json::to_bjdata(j_single);
+                CHECK(out_single.at(0) == '{');
+                CHECK(json::from_bjdata(out_single) == j_single);
+
+                // in-range boundary values still use the compact ndarray encoding
+                json const j_uint8_ok = json({{"_ArrayType_", "uint8"}, {"_ArraySize_", {2}}, {"_ArrayData_", {0, 255}}});
+                CHECK(json::to_bjdata(j_uint8_ok) == std::vector<uint8_t>({'[', '$', 'U', '#', '[', 'i', 2, ']', 0, 255}));
+
+                json const j_int8_ok = json({{"_ArrayType_", "int8"}, {"_ArraySize_", {2}}, {"_ArrayData_", {-128, 127}}});
+                CHECK(json::to_bjdata(j_int8_ok) == std::vector<uint8_t>({'[', '$', 'i', '#', '[', 'i', 2, ']', 0x80, 0x7F}));
+
+                json const j_single_ok = json({{"_ArrayType_", "single"}, {"_ArraySize_", {1}}, {"_ArrayData_", {1.5}}});
+                const auto out_single_ok = json::to_bjdata(j_single_ok);
+                CHECK(out_single_ok.at(0) == '[');
+                CHECK(json::from_bjdata(out_single_ok) == json({1.5f}));
+            }
         }
     }
 

tests/src/unit-serialization.cpp

@@ -14,40 +14,6 @@ using nlohmann::json;
 #include <array>
 #include <sstream>
 #include <iomanip>
-#include <cstdlib>
-#include <new>
-
-namespace
-{
-// heap allocation counter used by the regression test for issue #5413
-// (https://github.com/nlohmann/json/issues/5413); disabled (and thus a
-// no-op besides the counting) unless explicitly toggled on
-bool count_heap_allocations = false; // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
-std::size_t heap_allocations = 0; // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
-} // namespace
-
-void* operator new (std::size_t size) // NOLINT(cppcoreguidelines-owning-memory,misc-new-delete-overloads)
-{
-    if (count_heap_allocations)
-    {
-        ++heap_allocations;
-    }
-    if (void* ptr = std::malloc(size)) // NOLINT(cppcoreguidelines-no-malloc,cppcoreguidelines-owning-memory)
-    {
-        return ptr;
-    }
-    throw std::bad_alloc(); // NOLINT(hicpp-exception-baseclass)
-}
-
-void operator delete (void* ptr) noexcept // NOLINT(cppcoreguidelines-owning-memory,misc-new-delete-overloads)
-{
-    std::free(ptr); // NOLINT(cppcoreguidelines-no-malloc,cppcoreguidelines-owning-memory)
-}
-
-void operator delete (void* ptr, std::size_t /*size*/) noexcept // NOLINT(cppcoreguidelines-owning-memory,misc-new-delete-overloads)
-{
-    std::free(ptr); // NOLINT(cppcoreguidelines-no-malloc,cppcoreguidelines-owning-memory)
-}
 
 TEST_CASE("serialization")
 {
@@ -416,76 +382,3 @@ TEST_CASE("dump for basic_json with long double number_float_t")
         check_same(100.0L,  100.0);
     }
 }
-
-TEST_CASE("regression test for issue #5413 - lazily allocated indent_string")
-{
-    // the serializer used to unconditionally allocate a 512-byte
-    // indent_string in its constructor, even though it is only ever read
-    // inside the pretty_print branches of dump(). This wasted a heap
-    // allocation (and its matching deallocation) on every single compact
-    // (i.e. non-pretty, the default) dump() call. indent_string is now
-    // allocated lazily, the first time a pretty-print branch actually
-    // needs it -- so a compact dump() must perform strictly fewer heap
-    // allocations than a pretty dump() of the same value.
-    const json j = {{"level", "info"}, {"msg", "hello world"}, {"id", 12345}};
-
-    // warm up anything unrelated to indentation (e.g., one-time locale
-    // lookups) that might otherwise allocate on first use regardless of
-    // pretty-printing, so it does not skew the counts measured below
-    const auto warmup = j.dump();
-    const auto warmup_pretty = j.dump(4);
-    CHECK(!warmup.empty());
-    CHECK(!warmup_pretty.empty());
-
-    SECTION("compact dump() has a stable, minimal allocation count")
-    {
-        count_heap_allocations = true;
-
-        heap_allocations = 0;
-        const auto compact1 = j.dump();
-        const auto allocs_compact1 = heap_allocations;
-
-        heap_allocations = 0;
-        const auto compact2 = j.dump(-1);
-        const auto allocs_compact2 = heap_allocations;
-
-        count_heap_allocations = false;
-
-        CHECK(compact1 == compact2);
-        // dump() and dump(-1) both take the compact code path and must
-        // never touch indent_string, so they allocate identically often
-        CHECK(allocs_compact1 == allocs_compact2);
-    }
-
-    SECTION("first pretty dump() allocates more than a compact dump()")
-    {
-        // use a tiny value whose compact ({"a":1}, 7 bytes) and pretty
-        // ({"a": 1} with 1-space indent, 11 bytes) serializations both stay
-        // well inside every common std::string small-string-optimization
-        // buffer (>= 15 bytes on libstdc++/MSVC STL, >= 22 on libc++), so
-        // building the result string itself causes no heap allocation
-        // either way -- isolating indent_string as the only thing that can
-        // possibly account for a difference in allocation count
-        const json tiny = {{"a", 1}};
-
-        count_heap_allocations = true;
-
-        heap_allocations = 0;
-        const auto compact = tiny.dump();
-        const auto allocs_compact = heap_allocations;
-
-        heap_allocations = 0;
-        const auto pretty = tiny.dump(1);
-        const auto allocs_pretty = heap_allocations;
-
-        count_heap_allocations = false;
-
-        CHECK(compact == "{\"a\":1}");
-        CHECK(pretty == "{\n \"a\": 1\n}");
-        // a fresh serializer is created per dump() call; the pretty branch
-        // lazily allocates indent_string on its first use, so it must
-        // allocate at least once more than the compact branch, which never
-        // touches indent_string at all
-        CHECK(allocs_pretty > allocs_compact);
-    }
-}