Construct a scalar member in place; only a throwing value goes through a temporary

Creating the value first and moving it over the member is needed only when
creating it can throw (a string, a binary value or a container). A scalar
or null is again constructed in place, without the extra move and destroy
per member (and, with JSON_DIAGNOSTICS, without the extra set_parents()).

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/workflows/cancel_closed_pr_runs.yml

@@ -24,7 +24,7 @@ jobs:
     permissions:
       actions: write
 
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
 
     steps:
       - name: Harden Runner

.github/workflows/check_amalgamation.yml

@@ -19,7 +19,7 @@ permissions:
 jobs:
   save:
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2

.github/workflows/check_docs_links.yml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
   check_docs_links:
     if: github.repository == 'nlohmann/json'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Harden Runner

.github/workflows/comment_check_amalgamation.yml

@@ -12,7 +12,7 @@ jobs:
   comment:
     # push runs on develop have no PR to comment on (and no "pr" artifact)
     if: ${{ github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event == 'pull_request' }}
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       actions: read

.github/workflows/dependency-review.yml

@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   dependency-review:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2

.github/workflows/flawfinder.yml

@@ -24,7 +24,7 @@ on:
 jobs:
   flawfinder:
     name: Flawfinder
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read

.github/workflows/labeler.yml

@@ -19,7 +19,7 @@ jobs:
       contents: read
       pull-requests: write
 
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
 
     steps:
       - name: Harden Runner

.github/workflows/publish_documentation.yml

@@ -34,7 +34,7 @@ jobs:
       contents: write
 
     if: github.repository == 'nlohmann/json'
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2

.github/workflows/scorecards.yml

@@ -24,7 +24,7 @@ permissions:
 jobs:
   analysis:
     name: Scorecard analysis
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write

.github/workflows/stale.yml

@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   stale:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
 
     permissions:
       issues: write

.github/workflows/ubuntu.yml

@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   ci_test_gcc:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     container: gcc:latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -130,7 +130,7 @@ jobs:
         run: cmake --build build --target ${{ matrix.target }}
 
   ci_static_analysis_clang:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     container: silkeh/clang:22
     strategy:
       matrix:
@@ -149,7 +149,7 @@ jobs:
         run: cmake --build build --target ${{ matrix.target }}
 
   ci_cmake_options:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     container: ubuntu:24.04
     strategy:
       matrix:
@@ -209,7 +209,7 @@ jobs:
           fail-on-error: false
 
   ci_test_compilers_gcc_old:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         compiler: ['4.8', '4.9', '5', '6']
@@ -251,7 +251,7 @@ jobs:
         run: cmake --build build --target ci_test_compiler_g++-${{ matrix.compiler }}
 
   ci_test_compilers_gcc:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         # older GCC docker images (4, 5, 6) fail to check out code
@@ -269,7 +269,7 @@ jobs:
         run: cmake --build build --target ci_test_compiler_default
 
   ci_test_compilers_clang:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         compiler: ['3.4', '3.5', '3.6', '3.7', '3.8', '3.9', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15-bullseye', '16', '17', '18', '19', '20', '21', '22', 'latest']
@@ -289,7 +289,7 @@ jobs:
         run: cmake --build build --target ci_test_compiler_default
 
   ci_test_standards_gcc:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     container: gcc:latest
     strategy:
       matrix:
@@ -306,7 +306,7 @@ jobs:
         run: cmake --build build --target ci_test_gcc_cxx${{ matrix.standard }}
 
   ci_test_standards_clang:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     container: silkeh/clang:latest
     strategy:
       matrix:
@@ -330,7 +330,7 @@ jobs:
         if: ${{ matrix.stdlib == 'libstdcxx' }}
 
   ci_cuda_example:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
@@ -356,7 +356,7 @@ jobs:
     strategy:
       matrix:
         container: ['gcc:latest', 'silkeh/clang:latest']
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     container: ${{ matrix.container }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -383,7 +383,7 @@ jobs:
         run: cmake --build build --target ci_module_cpp20
 
   ci_icpc:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     # Intel discontinued the classic icc/icpc compiler in oneAPI 2024.0; this is
     # Intel's own last officially published image that still includes it.
     container: intel/oneapi-hpckit:2023.2.1-devel-ubuntu22.04
@@ -402,7 +402,7 @@ jobs:
         run: cmake --build build --target ci_icpc
 
   ci_icpx:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     container: intel/oneapi-hpckit:latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -416,7 +416,7 @@ jobs:
         run: cmake --build build --target ci_icpx
 
   ci_nvhpc:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-latest
     container: nvcr.io/nvidia/nvhpc:25.5-devel-cuda12.9-ubuntu22.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

include/nlohmann/detail/input/binary_reader.hpp

@@ -344,8 +344,8 @@ class binary_reader
     nested document could declare a length that disagrees with where its
     terminator actually falls and quietly hand the bytes in between to the
     enclosing document. A well-formed document is at least 5 bytes (the prefix
-    plus the terminator); open_bson_document() rejects a smaller size before
-    it is stored, so @a document_size is never negative here.
+    plus the terminator); the equality also rejects those impossible sizes,
+    since at least 5 bytes are always consumed.
 
     @param[in] document_start  value of chars_read before the size prefix
     @param[in] document_size   the declared document size
@@ -353,7 +353,7 @@ class binary_reader
     */
     bool check_bson_document_size(const std::size_t document_start, const std::int32_t document_size)
     {
-        if (JSON_HEDLEY_UNLIKELY(static_cast<std::size_t>(document_size) != chars_read - document_start))
+        if (JSON_HEDLEY_UNLIKELY(document_size < 0 || static_cast<std::size_t>(document_size) != chars_read - document_start))
         {
             return bson_document_size_error(document_size, chars_read - document_start);
         }
@@ -467,13 +467,11 @@ class binary_reader
 
             const std::size_t element_type_parse_position = chars_read;
             // an array's elements are named "0", "1", ... in the wire format,
-            // and those names are not passed on: they are skipped, and only
-            // checked if error_handler_t::strict must reject ill-formed UTF-8
+            // and those names are not passed on: they are skipped unless
+            // error_handler_t::strict must reject ill-formed UTF-8 in them
             const bool is_object = container_stack.back().is_object;
             key.clear();
-            if (JSON_HEDLEY_UNLIKELY(!(is_object || error_handler != error_handler_t::strict
-                                       ? get_bson_cstr(key, is_object)
-                                       : check_bson_cstr(key, std::integral_constant<bool, bulk_scan> {}))))
+            if (JSON_HEDLEY_UNLIKELY(!get_bson_cstr(key, is_object || error_handler == error_handler_t::strict)))
             {
                 return false;
             }
@@ -497,7 +495,7 @@ class binary_reader
     @param[in] store  whether the characters are needed; if not (the names of
                       an array's elements), they are skipped and @a result may
                       be left unchanged, and they are not checked against
-                      @ref error_handler (@ref check_bson_cstr checks them)
+                      @ref error_handler
     @return `true` if the \\x00-byte indicating the end of the string was
              encountered before the EOF; false` indicates an unexpected EOF.
     */
@@ -556,42 +554,6 @@ class binary_reader
         return true;
     }
 
-    /*!
-    @brief skip a C-style string that error_handler_t::strict must check
-
-    The names of an array's elements are not passed on. On contiguous input,
-    a well-formed name is checked in place and skipped without being copied.
-    Otherwise (no \\x00-byte in the input that can be scanned, or ill-formed
-    UTF-8), it is read by @ref get_bson_cstr, which reports the error.
-
-    @param[in,out] result  an empty string, which may receive the name
-    @return whether the name was read and is well-formed
-    */
-    bool check_bson_cstr(string_t& result, std::true_type /*bulk*/)
-    {
-        const std::size_t remaining = ia.bulk_remaining();
-        if (remaining != 0)
-        {
-            const auto* const data = reinterpret_cast<const unsigned char*>(ia.bulk_data());
-            const std::size_t length = find_zero_byte(data, remaining);
-            if (length != remaining && JSON_HEDLEY_LIKELY(valid_utf8_string(data, length)))
-            {
-                // consume the string and its \x00-byte, as get_bson_cstr does
-                ia.bulk_skip(length + 1);
-                chars_read += length + 1;
-                current = 0x00;
-                return true;
-            }
-        }
-        return get_bson_cstr(result);
-    }
-
-    /// input that is not contiguous: the name is read and checked byte by byte
-    bool check_bson_cstr(string_t& result, std::false_type /*bulk*/)
-    {
-        return get_bson_cstr(result);
-    }
-
     /// input that is not contiguous: C-style strings are read byte by byte
     bool get_bson_cstr_bulk(string_t& /*result*/, const bool /*store*/, std::false_type /*bulk*/) const noexcept
     {
@@ -3083,6 +3045,8 @@ class binary_reader
         if (size_and_type.first != npos)
         {
             if (size_and_type.second != 0)
+            {
+                if (size_and_type.second != 'N')
                 {
                     for (std::size_t i = 0; i < size_and_type.first; ++i)
                     {
@@ -3093,6 +3057,7 @@ class binary_reader
                         dim.push_back(dimlen);
                     }
                 }
+            }
             else
             {
                 for (std::size_t i = 0; i < size_and_type.first; ++i)
@@ -3292,9 +3257,11 @@ class binary_reader
                     // follow the documented _ArrayType_, _ArraySize_, _ArrayData_ order
                     if (ndarray_dtype != 0)
                     {
-                        // every optimized type marker is_valid_optimized_type() accepts for BJData has a name
                         const char* type_name = bjd_type_name(ndarray_dtype);
-                        JSON_ASSERT(type_name != nullptr);
+                        if (JSON_HEDLEY_UNLIKELY(type_name == nullptr))
+                        {
+                            return unexpected_byte("invalid byte", "type");
+                        }
 
                         string_t type_key = "_ArrayType_";
                         string_t type = type_name; // sax->string() takes a reference
@@ -3377,6 +3344,12 @@ class binary_reader
         if (current == '$')
         {
             result.second = get();  // must not ignore 'N', because 'N' maybe the type
+            if (input_format == input_format_t::bjdata
+                    && JSON_HEDLEY_UNLIKELY(is_bjd_excluded_optimized_type(result.second)))
+            {
+                return optimized_type_error();
+            }
+
             if (JSON_HEDLEY_UNLIKELY(!unexpect_eof("type")))
             {
                 return false;
@@ -3404,7 +3377,7 @@ class binary_reader
             // an ndarray was read here only if the flag flipped; when it was
             // seeded true, get_ubjson_size_value() already rejected the nested
             // dimension vector
-            if (is_ndarray && !inside_ndarray)
+            if (input_format == input_format_t::bjdata && is_ndarray && !inside_ndarray)
             {
                 result.second |= (1 << 8); // use bit 8 to indicate ndarray, all UBJSON and BJData markers should be ASCII letters
             }
@@ -3414,7 +3387,7 @@ class binary_reader
         if (current == '#')
         {
             const bool is_error = get_ubjson_size_value(result.first, is_ndarray);
-            if (is_ndarray && !inside_ndarray)
+            if (input_format == input_format_t::bjdata && is_ndarray && !inside_ndarray)
             {
                 return last_byte_error(exception_id::unexpected_byte, "ndarray requires both type and size", "size");
             }
@@ -3588,6 +3561,7 @@ class binary_reader
     JSON_HEDLEY_NEVER_INLINE
     bool parse_ubjson_typed_run(std::size_t& remaining, const char_int_type type, std::true_type /*bulk*/)
     {
+        const bool bjdata = input_format == input_format_t::bjdata;
         switch (type)
         {
             case 'U':
@@ -3601,11 +3575,11 @@ class binary_reader
             case 'L':
                 return parse_ubjson_typed_run<std::int64_t>(remaining);
             case 'u':
-                return parse_ubjson_typed_run<std::uint16_t>(remaining);
+                return !bjdata || parse_ubjson_typed_run<std::uint16_t>(remaining);
             case 'm':
-                return parse_ubjson_typed_run<std::uint32_t>(remaining);
+                return !bjdata || parse_ubjson_typed_run<std::uint32_t>(remaining);
             case 'M':
-                return parse_ubjson_typed_run<std::uint64_t>(remaining);
+                return !bjdata || parse_ubjson_typed_run<std::uint64_t>(remaining);
             case 'd':
                 return parse_ubjson_typed_run<float>(remaining);
             case 'D':
@@ -3686,7 +3660,7 @@ class binary_reader
         // if bit-8 of size_and_type.second is set to 1, encode bjdata ndarray as an object in JData annotated array format (https://github.com/NeuroJSON/jdata):
         // {"_ArrayType_" : "typeid", "_ArraySize_" : [n1, n2, ...], "_ArrayData_" : [v1, v2, ...]}
 
-        if ((size_and_type.second & (1 << 8)) != 0)
+        if (input_format == input_format_t::bjdata && size_and_type.first != npos && (size_and_type.second & (1 << 8)) != 0)
         {
             size_and_type.second &= ~(static_cast<char_int_type>(1) << 8);  // use bit 8 to indicate ndarray, here we remove the bit to restore the type marker
 
@@ -3745,7 +3719,7 @@ class binary_reader
         }
 
         // If BJData type marker is 'B' decode as binary
-        if (size_and_type.first != npos && size_and_type.second == 'B')
+        if (input_format == input_format_t::bjdata && size_and_type.first != npos && size_and_type.second == 'B')
         {
             binary_t result;
             return get_binary(size_and_type.first, result) && sax->binary(result);
@@ -3794,7 +3768,7 @@ class binary_reader
         }
 
         // do not accept ND-array size in objects in BJData
-        if ((size_and_type.second & (1 << 8)) != 0)
+        if (input_format == input_format_t::bjdata && size_and_type.first != npos && (size_and_type.second & (1 << 8)) != 0)
         {
             return last_byte_error(exception_id::unexpected_byte, "BJData object does not support ND-array size in optimized format", "object");
         }
@@ -5075,9 +5049,8 @@ class binary_reader
   JSON_PRIVATE_UNLESS_TESTED:
     /*!
     @brief check whether @a marker is a type marker that may follow '$'
-    UBJSON: Z N T F i U I l L d D H C S [ {; BJData: the numeric markers and C.
-    The markers BJData excludes (F H N S T Z [ {) are the ones
-    binary_writer::is_bjdata_excluded_type_marker() lists; keep the two in sync.
+    UBJSON: Z N T F i U I l L d D H C S [ {; BJData: the numeric markers and C
+    (BJData's excluded markers are rejected separately).
     */
     bool is_valid_optimized_type(const char_int_type marker) const noexcept
     {
@@ -5112,6 +5085,20 @@ class binary_reader
         }
     }
 
+    /*!
+    @brief whether @a marker is excluded from BJData's optimized ND-array types
+    @return whether @a marker is one of 'F', 'H', 'N', 'S', 'T', 'Z', '[', '{'
+
+    Mirrors binary_writer's @ref binary_writer::is_bjdata_excluded_type_marker
+    "is_bjdata_excluded_type_marker()`, which encodes the same list the other
+    way; keep the two in sync.
+    */
+    static constexpr bool is_bjd_excluded_optimized_type(const char_int_type marker) noexcept
+    {
+        return marker == '[' || marker == '{' || marker == 'S' || marker == 'H'
+               || marker == 'T' || marker == 'F' || marker == 'N' || marker == 'Z';
+    }
+
     /*!
     @brief look up the ND-array element type name for a BJData dtype marker
     @return the type name ("uint8", "int8", ...), or nullptr if @a marker does

include/nlohmann/detail/input/json_sax.hpp

@@ -1303,7 +1303,7 @@ class json_sax_dom_parser : public json_sax_dom_error_state
         {
             // a new member is null and holds nothing: construct the value
             // over it instead of destroying and swapping
-            ::new (static_cast<void*>(&member)) BasicJsonType(std::forward<Value>(v));
+            construct_member(member, std::forward<Value>(v), std::is_nothrow_constructible < BasicJsonType, Value && > {});
         }
         else
         {
@@ -1312,6 +1312,25 @@ class json_sax_dom_parser : public json_sax_dom_error_state
         }
     }
 
+    /// a scalar cannot throw: construct it in place
+    template<typename Value>
+    JSON_HEDLEY_ALWAYS_INLINE
+    static void construct_member(BasicJsonType& member, Value&& v, std::true_type /*nothrow*/)
+    {
+        ::new (static_cast<void*>(&member)) BasicJsonType(std::forward<Value>(v));
+    }
+
+    /// creating a container or a string can throw, and a constructor that was
+    /// interrupted must not have touched the member (#5985): create the value
+    /// first, then move it over the member (the move constructor is noexcept)
+    template<typename Value>
+    JSON_HEDLEY_ALWAYS_INLINE
+    static void construct_member(BasicJsonType& member, Value&& v, std::false_type /*may throw*/)
+    {
+        BasicJsonType value(std::forward<Value>(v));
+        ::new (static_cast<void*>(&member)) BasicJsonType(std::move(value));
+    }
+
     /// a custom base class may care about the lifetime of the value
     template<typename Value>
     static void set_member(BasicJsonType& member, Value&& v, std::false_type /*custom base*/)

include/nlohmann/detail/output/binary_writer.hpp

@@ -3129,19 +3129,22 @@ class binary_writer
                 // negative fixnum
                 write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
             }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int8_t>::min)())
+            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int8_t>::min)() &&
+                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int8_t>::max)())
             {
                 // int 8
                 oa.write_character(to_char_type(0xD0));
                 write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
             }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int16_t>::min)())
+            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int16_t>::min)() &&
+                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int16_t>::max)())
             {
                 // int 16
                 oa.write_character(to_char_type(0xD1));
                 write_number(static_cast<std::int16_t>(j.m_data.m_value.number_integer));
             }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int32_t>::min)())
+            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int32_t>::min)() &&
+                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int32_t>::max)())
             {
                 // int 32
                 oa.write_character(to_char_type(0xD2));
@@ -4057,7 +4060,7 @@ class binary_writer
     Containers, strings, high-precision numbers, booleans and null cannot be
     declared as the single type of an optimized container in BJData; such a
     container is written unoptimized. The reader rejects them with the same
-    list (binary_reader::is_valid_optimized_type()).
+    list (binary_reader::is_bjd_excluded_optimized_type()).
     */
     static constexpr bool is_bjdata_excluded_type_marker(const CharType marker) noexcept
     {

single_include/nlohmann/json.hpp

@@ -16948,7 +16948,7 @@ class json_sax_dom_parser : public json_sax_dom_error_state
         {
             // a new member is null and holds nothing: construct the value
             // over it instead of destroying and swapping
-            ::new (static_cast<void*>(&member)) BasicJsonType(std::forward<Value>(v));
+            construct_member(member, std::forward<Value>(v), std::is_nothrow_constructible < BasicJsonType, Value && > {});
         }
         else
         {
@@ -16957,6 +16957,25 @@ class json_sax_dom_parser : public json_sax_dom_error_state
         }
     }
 
+    /// a scalar cannot throw: construct it in place
+    template<typename Value>
+    JSON_HEDLEY_ALWAYS_INLINE
+    static void construct_member(BasicJsonType& member, Value&& v, std::true_type /*nothrow*/)
+    {
+        ::new (static_cast<void*>(&member)) BasicJsonType(std::forward<Value>(v));
+    }
+
+    /// creating a container or a string can throw, and a constructor that was
+    /// interrupted must not have touched the member (#5985): create the value
+    /// first, then move it over the member (the move constructor is noexcept)
+    template<typename Value>
+    JSON_HEDLEY_ALWAYS_INLINE
+    static void construct_member(BasicJsonType& member, Value&& v, std::false_type /*may throw*/)
+    {
+        BasicJsonType value(std::forward<Value>(v));
+        ::new (static_cast<void*>(&member)) BasicJsonType(std::move(value));
+    }
+
     /// a custom base class may care about the lifetime of the value
     template<typename Value>
     static void set_member(BasicJsonType& member, Value&& v, std::false_type /*custom base*/)
@@ -18351,8 +18370,8 @@ class binary_reader
     nested document could declare a length that disagrees with where its
     terminator actually falls and quietly hand the bytes in between to the
     enclosing document. A well-formed document is at least 5 bytes (the prefix
-    plus the terminator); open_bson_document() rejects a smaller size before
-    it is stored, so @a document_size is never negative here.
+    plus the terminator); the equality also rejects those impossible sizes,
+    since at least 5 bytes are always consumed.
 
     @param[in] document_start  value of chars_read before the size prefix
     @param[in] document_size   the declared document size
@@ -18360,7 +18379,7 @@ class binary_reader
     */
     bool check_bson_document_size(const std::size_t document_start, const std::int32_t document_size)
     {
-        if (JSON_HEDLEY_UNLIKELY(static_cast<std::size_t>(document_size) != chars_read - document_start))
+        if (JSON_HEDLEY_UNLIKELY(document_size < 0 || static_cast<std::size_t>(document_size) != chars_read - document_start))
         {
             return bson_document_size_error(document_size, chars_read - document_start);
         }
@@ -18474,13 +18493,11 @@ class binary_reader
 
             const std::size_t element_type_parse_position = chars_read;
             // an array's elements are named "0", "1", ... in the wire format,
-            // and those names are not passed on: they are skipped, and only
-            // checked if error_handler_t::strict must reject ill-formed UTF-8
+            // and those names are not passed on: they are skipped unless
+            // error_handler_t::strict must reject ill-formed UTF-8 in them
             const bool is_object = container_stack.back().is_object;
             key.clear();
-            if (JSON_HEDLEY_UNLIKELY(!(is_object || error_handler != error_handler_t::strict
-                                       ? get_bson_cstr(key, is_object)
-                                       : check_bson_cstr(key, std::integral_constant<bool, bulk_scan> {}))))
+            if (JSON_HEDLEY_UNLIKELY(!get_bson_cstr(key, is_object || error_handler == error_handler_t::strict)))
             {
                 return false;
             }
@@ -18504,7 +18521,7 @@ class binary_reader
     @param[in] store  whether the characters are needed; if not (the names of
                       an array's elements), they are skipped and @a result may
                       be left unchanged, and they are not checked against
-                      @ref error_handler (@ref check_bson_cstr checks them)
+                      @ref error_handler
     @return `true` if the \\x00-byte indicating the end of the string was
              encountered before the EOF; false` indicates an unexpected EOF.
     */
@@ -18563,42 +18580,6 @@ class binary_reader
         return true;
     }
 
-    /*!
-    @brief skip a C-style string that error_handler_t::strict must check
-
-    The names of an array's elements are not passed on. On contiguous input,
-    a well-formed name is checked in place and skipped without being copied.
-    Otherwise (no \\x00-byte in the input that can be scanned, or ill-formed
-    UTF-8), it is read by @ref get_bson_cstr, which reports the error.
-
-    @param[in,out] result  an empty string, which may receive the name
-    @return whether the name was read and is well-formed
-    */
-    bool check_bson_cstr(string_t& result, std::true_type /*bulk*/)
-    {
-        const std::size_t remaining = ia.bulk_remaining();
-        if (remaining != 0)
-        {
-            const auto* const data = reinterpret_cast<const unsigned char*>(ia.bulk_data());
-            const std::size_t length = find_zero_byte(data, remaining);
-            if (length != remaining && JSON_HEDLEY_LIKELY(valid_utf8_string(data, length)))
-            {
-                // consume the string and its \x00-byte, as get_bson_cstr does
-                ia.bulk_skip(length + 1);
-                chars_read += length + 1;
-                current = 0x00;
-                return true;
-            }
-        }
-        return get_bson_cstr(result);
-    }
-
-    /// input that is not contiguous: the name is read and checked byte by byte
-    bool check_bson_cstr(string_t& result, std::false_type /*bulk*/)
-    {
-        return get_bson_cstr(result);
-    }
-
     /// input that is not contiguous: C-style strings are read byte by byte
     bool get_bson_cstr_bulk(string_t& /*result*/, const bool /*store*/, std::false_type /*bulk*/) const noexcept
     {
@@ -21090,6 +21071,8 @@ class binary_reader
         if (size_and_type.first != npos)
         {
             if (size_and_type.second != 0)
+            {
+                if (size_and_type.second != 'N')
                 {
                     for (std::size_t i = 0; i < size_and_type.first; ++i)
                     {
@@ -21100,6 +21083,7 @@ class binary_reader
                         dim.push_back(dimlen);
                     }
                 }
+            }
             else
             {
                 for (std::size_t i = 0; i < size_and_type.first; ++i)
@@ -21299,9 +21283,11 @@ class binary_reader
                     // follow the documented _ArrayType_, _ArraySize_, _ArrayData_ order
                     if (ndarray_dtype != 0)
                     {
-                        // every optimized type marker is_valid_optimized_type() accepts for BJData has a name
                         const char* type_name = bjd_type_name(ndarray_dtype);
-                        JSON_ASSERT(type_name != nullptr);
+                        if (JSON_HEDLEY_UNLIKELY(type_name == nullptr))
+                        {
+                            return unexpected_byte("invalid byte", "type");
+                        }
 
                         string_t type_key = "_ArrayType_";
                         string_t type = type_name; // sax->string() takes a reference
@@ -21384,6 +21370,12 @@ class binary_reader
         if (current == '$')
         {
             result.second = get();  // must not ignore 'N', because 'N' maybe the type
+            if (input_format == input_format_t::bjdata
+                    && JSON_HEDLEY_UNLIKELY(is_bjd_excluded_optimized_type(result.second)))
+            {
+                return optimized_type_error();
+            }
+
             if (JSON_HEDLEY_UNLIKELY(!unexpect_eof("type")))
             {
                 return false;
@@ -21411,7 +21403,7 @@ class binary_reader
             // an ndarray was read here only if the flag flipped; when it was
             // seeded true, get_ubjson_size_value() already rejected the nested
             // dimension vector
-            if (is_ndarray && !inside_ndarray)
+            if (input_format == input_format_t::bjdata && is_ndarray && !inside_ndarray)
             {
                 result.second |= (1 << 8); // use bit 8 to indicate ndarray, all UBJSON and BJData markers should be ASCII letters
             }
@@ -21421,7 +21413,7 @@ class binary_reader
         if (current == '#')
         {
             const bool is_error = get_ubjson_size_value(result.first, is_ndarray);
-            if (is_ndarray && !inside_ndarray)
+            if (input_format == input_format_t::bjdata && is_ndarray && !inside_ndarray)
             {
                 return last_byte_error(exception_id::unexpected_byte, "ndarray requires both type and size", "size");
             }
@@ -21595,6 +21587,7 @@ class binary_reader
     JSON_HEDLEY_NEVER_INLINE
     bool parse_ubjson_typed_run(std::size_t& remaining, const char_int_type type, std::true_type /*bulk*/)
     {
+        const bool bjdata = input_format == input_format_t::bjdata;
         switch (type)
         {
             case 'U':
@@ -21608,11 +21601,11 @@ class binary_reader
             case 'L':
                 return parse_ubjson_typed_run<std::int64_t>(remaining);
             case 'u':
-                return parse_ubjson_typed_run<std::uint16_t>(remaining);
+                return !bjdata || parse_ubjson_typed_run<std::uint16_t>(remaining);
             case 'm':
-                return parse_ubjson_typed_run<std::uint32_t>(remaining);
+                return !bjdata || parse_ubjson_typed_run<std::uint32_t>(remaining);
             case 'M':
-                return parse_ubjson_typed_run<std::uint64_t>(remaining);
+                return !bjdata || parse_ubjson_typed_run<std::uint64_t>(remaining);
             case 'd':
                 return parse_ubjson_typed_run<float>(remaining);
             case 'D':
@@ -21693,7 +21686,7 @@ class binary_reader
         // if bit-8 of size_and_type.second is set to 1, encode bjdata ndarray as an object in JData annotated array format (https://github.com/NeuroJSON/jdata):
         // {"_ArrayType_" : "typeid", "_ArraySize_" : [n1, n2, ...], "_ArrayData_" : [v1, v2, ...]}
 
-        if ((size_and_type.second & (1 << 8)) != 0)
+        if (input_format == input_format_t::bjdata && size_and_type.first != npos && (size_and_type.second & (1 << 8)) != 0)
         {
             size_and_type.second &= ~(static_cast<char_int_type>(1) << 8);  // use bit 8 to indicate ndarray, here we remove the bit to restore the type marker
 
@@ -21752,7 +21745,7 @@ class binary_reader
         }
 
         // If BJData type marker is 'B' decode as binary
-        if (size_and_type.first != npos && size_and_type.second == 'B')
+        if (input_format == input_format_t::bjdata && size_and_type.first != npos && size_and_type.second == 'B')
         {
             binary_t result;
             return get_binary(size_and_type.first, result) && sax->binary(result);
@@ -21801,7 +21794,7 @@ class binary_reader
         }
 
         // do not accept ND-array size in objects in BJData
-        if ((size_and_type.second & (1 << 8)) != 0)
+        if (input_format == input_format_t::bjdata && size_and_type.first != npos && (size_and_type.second & (1 << 8)) != 0)
         {
             return last_byte_error(exception_id::unexpected_byte, "BJData object does not support ND-array size in optimized format", "object");
         }
@@ -23082,9 +23075,8 @@ class binary_reader
   JSON_PRIVATE_UNLESS_TESTED:
     /*!
     @brief check whether @a marker is a type marker that may follow '$'
-    UBJSON: Z N T F i U I l L d D H C S [ {; BJData: the numeric markers and C.
-    The markers BJData excludes (F H N S T Z [ {) are the ones
-    binary_writer::is_bjdata_excluded_type_marker() lists; keep the two in sync.
+    UBJSON: Z N T F i U I l L d D H C S [ {; BJData: the numeric markers and C
+    (BJData's excluded markers are rejected separately).
     */
     bool is_valid_optimized_type(const char_int_type marker) const noexcept
     {
@@ -23119,6 +23111,20 @@ class binary_reader
         }
     }
 
+    /*!
+    @brief whether @a marker is excluded from BJData's optimized ND-array types
+    @return whether @a marker is one of 'F', 'H', 'N', 'S', 'T', 'Z', '[', '{'
+
+    Mirrors binary_writer's @ref binary_writer::is_bjdata_excluded_type_marker
+    "is_bjdata_excluded_type_marker()`, which encodes the same list the other
+    way; keep the two in sync.
+    */
+    static constexpr bool is_bjd_excluded_optimized_type(const char_int_type marker) noexcept
+    {
+        return marker == '[' || marker == '{' || marker == 'S' || marker == 'H'
+               || marker == 'T' || marker == 'F' || marker == 'N' || marker == 'Z';
+    }
+
     /*!
     @brief look up the ND-array element type name for a BJData dtype marker
     @return the type name ("uint8", "int8", ...), or nullptr if @a marker does
@@ -31076,19 +31082,22 @@ class binary_writer
                 // negative fixnum
                 write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
             }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int8_t>::min)())
+            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int8_t>::min)() &&
+                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int8_t>::max)())
             {
                 // int 8
                 oa.write_character(to_char_type(0xD0));
                 write_number(static_cast<std::int8_t>(j.m_data.m_value.number_integer));
             }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int16_t>::min)())
+            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int16_t>::min)() &&
+                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int16_t>::max)())
             {
                 // int 16
                 oa.write_character(to_char_type(0xD1));
                 write_number(static_cast<std::int16_t>(j.m_data.m_value.number_integer));
             }
-            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int32_t>::min)())
+            else if (j.m_data.m_value.number_integer >= (std::numeric_limits<std::int32_t>::min)() &&
+                     j.m_data.m_value.number_integer <= (std::numeric_limits<std::int32_t>::max)())
             {
                 // int 32
                 oa.write_character(to_char_type(0xD2));
@@ -32004,7 +32013,7 @@ class binary_writer
     Containers, strings, high-precision numbers, booleans and null cannot be
     declared as the single type of an optimized container in BJData; such a
     container is written unoptimized. The reader rejects them with the same
-    list (binary_reader::is_valid_optimized_type()).
+    list (binary_reader::is_bjd_excluded_optimized_type()).
     */
     static constexpr bool is_bjdata_excluded_type_marker(const CharType marker) noexcept
     {

tests/src/unit-allocator.cpp

@@ -12,6 +12,7 @@
 #include <nlohmann/json.hpp>
 using nlohmann::json;
 
+#include <limits>
 #include <valarray>
 #if JSON_HAS_RANGES
     #include <ranges>
@@ -790,7 +791,7 @@ TEST_CASE("a failed allocation leaves the value unchanged")
 #if JSON_HAS_RANGES && !defined(__MINGW32__)
         const std::vector<int> numbers = {1, 2};
         next_construct_fails = true;
-        CHECK_THROWS_AS(nlohmann::to_json(j, numbers | std::views::filter([](int /*unused*/)
+        CHECK_THROWS_AS(nlohmann::to_json(j, numbers | std::views::filter([](int /*unused*/) noexcept
         {
             return true;
         })), std::bad_alloc&);
@@ -804,3 +805,172 @@ TEST_CASE("a failed allocation leaves the value unchanged")
 #endif
 }
 #endif
+
+#if !defined(JSON_NOEXCEPTION)
+namespace
+{
+// the allocation numbered sweep_fail_at (counted from 1) throws; 0 never fails
+std::size_t sweep_allocations = 0;
+std::size_t sweep_fail_at = 0;
+std::ptrdiff_t sweep_live = 0;
+
+template<class T>
+struct sweep_allocator
+{
+    using value_type = T;
+
+    sweep_allocator() = default;
+    template<class U> sweep_allocator(const sweep_allocator<U>& /*unused*/) noexcept {}
+
+    T* allocate(std::size_t n)
+    {
+        if (sweep_fail_at != 0 && ++sweep_allocations == sweep_fail_at)
+        {
+            throw std::bad_alloc();
+        }
+        ++sweep_live;
+        return std::allocator<T>().allocate(n);
+    }
+
+    void deallocate(T* p, std::size_t n) noexcept
+    {
+        --sweep_live;
+        std::allocator<T>().deallocate(p, n);
+    }
+
+    // GCC 4.8's std::map calls these on the allocator directly instead of
+    // going through std::allocator_traits
+    std::size_t max_size() const noexcept
+    {
+        return (std::numeric_limits<std::size_t>::max)() / sizeof(T);
+    }
+
+    template<class U, class... Args>
+    void construct(U* p, Args&& ... args) noexcept(noexcept(::new (static_cast<void*>(p)) U(std::forward<Args>(args)...)))
+    {
+        ::new (static_cast<void*>(p)) U(std::forward<Args>(args)...);
+    }
+
+    template<class U>
+    void destroy(U* p) noexcept
+    {
+        static_cast<void>(p); // unused for trivially destructible types
+        p->~U();
+    }
+
+    template <class U>
+    struct rebind
+    {
+        using other = sweep_allocator<U>;
+    };
+
+    bool operator==(const sweep_allocator& /*unused*/) const noexcept
+    {
+        return true;
+    }
+    bool operator!=(const sweep_allocator& /*unused*/) const noexcept
+    {
+        return false;
+    }
+};
+
+// run make() with the allocation numbered k failing, for k = 1, 2, ...: every
+// failure must be a std::bad_alloc and must not leave anything behind, and
+// the first k without a failure must yield the value made without failures
+template<class BasicJsonType, class Make>
+void sweep_allocations_of(const Make& make)
+{
+    sweep_fail_at = 0;
+    const BasicJsonType expected = make();
+    const std::ptrdiff_t live_before = sweep_live;
+
+    std::size_t failures = 0;
+    for (std::size_t k = 1; k < 10000; ++k)
+    {
+        sweep_allocations = 0;
+        sweep_fail_at = k;
+        try
+        {
+            const BasicJsonType result = make();
+            sweep_fail_at = 0;
+            CHECK(result == expected);
+            break;
+        }
+        catch (const std::bad_alloc&)
+        {
+            sweep_fail_at = 0;
+            ++failures;
+        }
+        CHECK(sweep_live == live_before);
+    }
+    sweep_fail_at = 0;
+    CHECK(failures > 10);
+    CHECK(sweep_live == live_before);
+}
+} // namespace
+
+TEST_CASE("parse() survives a failing allocation at every point (#5985)")
+{
+    // strings beyond the small string buffer, nested objects and arrays
+    const std::string text = R"({"a":"a long string that does not fit into the small string buffer1","b":[1,2,[3,{"k":"another string that is longer than any small string buffer"}]],"c":{"x":1,"y":{"z":[]},"w":"yet another string that does not fit into a small buffer"},"d":1,"b":[[],{}]})";
+
+    using sweep_json = nlohmann::json::with_allocator_t<sweep_allocator>;
+    using sweep_ordered_json = nlohmann::ordered_json::with_allocator_t<sweep_allocator>;
+
+    SECTION("json")
+    {
+        sweep_allocations_of<sweep_json>([&]
+        {
+            return sweep_json::parse(text);
+        });
+    }
+
+    SECTION("ordered_json")
+    {
+        sweep_allocations_of<sweep_ordered_json>([&]
+        {
+            return sweep_ordered_json::parse(text);
+        });
+    }
+
+    // With iterator debugging (MSVC STL debug builds, also used by clang-cl),
+    // containers allocate a debug proxy through the allocator inside their
+    // noexcept move constructors, so failing that allocation terminates the
+    // program instead of throwing std::bad_alloc. Nothing to check there.
+#if !(defined(_ITERATOR_DEBUG_LEVEL) && _ITERATOR_DEBUG_LEVEL > 0)
+    SECTION("parser callback")
+    {
+        const auto keep_all = [](int /*depth*/, sweep_json::parse_event_t /*event*/, sweep_json& /*parsed*/) noexcept
+        {
+            return true;
+        };
+        sweep_allocations_of<sweep_json>([&]
+        {
+            return sweep_json::parse(text, keep_all);
+        });
+
+        const auto drop_d = [](int /*depth*/, sweep_json::parse_event_t event, sweep_json & parsed)
+        {
+            return event != sweep_json::parse_event_t::key || parsed != "d";
+        };
+        sweep_allocations_of<sweep_json>([&]
+        {
+            return sweep_json::parse(text, drop_d);
+        });
+    }
+#endif
+
+    SECTION("sax_parse into an existing value")
+    {
+        // a failed parse leaves the target in a state that is safe to destroy
+        using sax_t = nlohmann::detail::json_sax_dom_parser<sweep_json, nlohmann::detail::iterator_input_adapter<const char*>>;
+        sweep_allocations_of<sweep_json>([&]() -> sweep_json
+        {
+            sweep_json value;
+            sax_t sax(value, false);
+            static_cast<void>(sweep_json::sax_parse(text, &sax));
+            return value;
+        });
+    }
+}
+#endif

tests/src/unit-bjdata.cpp

@@ -78,25 +78,23 @@ TEST_CASE("BJData")
 {
     SECTION("binary_reader BJData lookup tables")
     {
-        // bjd_type_name() is static; is_valid_optimized_type() needs a BJData reader
+        // both lookups are static member functions
         std::vector<std::uint8_t> const data;
         using reader_t = nlohmann::detail::binary_reader<json, decltype(nlohmann::detail::input_adapter(data))>;
 
-        // the markers BJData excludes as optimized types must match
-        // binary_writer's is_bjdata_excluded_type_marker(), which encodes the
-        // same 8 markers
-        reader_t reader(nlohmann::detail::input_adapter(data), json::input_format_t::bjdata);
+        // the excluded optimized-type markers must match binary_writer's
+        // is_bjdata_excluded_type_marker(), which encodes the same 8 markers
         for (const char marker :
-                {'[', '{', 'S', 'H', 'T', 'F', 'N', 'Z', 'x'
+                {'[', '{', 'S', 'H', 'T', 'F', 'N', 'Z'
                 })
         {
-            CHECK(!reader.is_valid_optimized_type(static_cast<unsigned char>(marker)));
+            CHECK(reader_t::is_bjd_excluded_optimized_type(static_cast<unsigned char>(marker)));
         }
         for (const char marker :
-                {'U', 'i', 'u', 'I', 'm', 'l', 'M', 'L', 'd', 'D', 'C', 'B', 'h'
+                {'U', 'i', 'u', 'I', 'm', 'l', 'M', 'L', 'd', 'D', 'C', 'B', 'x'
                 })
         {
-            CHECK(reader.is_valid_optimized_type(static_cast<unsigned char>(marker)));
+            CHECK(!reader_t::is_bjd_excluded_optimized_type(static_cast<unsigned char>(marker)));
         }
 
         // every dtype marker must round-trip to its ND-array type name

tests/src/unit-bson.cpp

@@ -23,7 +23,6 @@ using nlohmann::json;
 #include <cstdint>
 #include <fstream>
 #include <limits>
-#include <list>
 #include <sstream>
 #include <vector>
 #include "make_test_data_available.hpp"
@@ -1200,31 +1199,6 @@ TEST_CASE("BSON keys from contiguous and stream input")
             from_stream = e.what();
         }
         CHECK(from_vector == from_stream);
-
-        // error_handler_t::strict checks the array element names in place on
-        // contiguous input and byte by byte otherwise; the names are
-        // well-formed, so both give the same value or error as above
-        std::string strict_from_vector;
-        std::string strict_from_list;
-        try
-        {
-            strict_from_vector = json::from_bson(input, true, true, json::error_handler_t::strict).dump();
-        }
-        catch (const json::parse_error& e)
-        {
-            strict_from_vector = e.what();
-        }
-        try
-        {
-            const std::list<std::uint8_t> list(input.begin(), input.end());
-            strict_from_list = json::from_bson(list.begin(), list.end(), true, true, json::error_handler_t::strict).dump();
-        }
-        catch (const json::parse_error& e)
-        {
-            strict_from_list = e.what();
-        }
-        CHECK(strict_from_vector == from_vector);
-        CHECK(strict_from_list == from_vector);
     }
 }
 
@@ -1253,18 +1227,6 @@ TEST_CASE("BSON array element names")
 
     std::istringstream stream(std::string(reinterpret_cast<const char*>(bson.data()), bson.size()));
     CHECK(json::from_bson(stream) == expected);
-
-    // input that is not contiguous reads the names byte by byte and must reject
-    // the same name
-    const std::list<std::uint8_t> list(bson.begin(), bson.end());
-    CHECK_THROWS_WITH_AS(_ = json::from_bson(list.begin(), list.end(), true, true, json::error_handler_t::strict), "[json.exception.parse_error.113] parse error at byte 14: syntax error while parsing BSON key: invalid string: ill-formed UTF-8 byte", json::parse_error&);
-
-    // without exceptions, the rejected name ends the parse
-    CHECK(json::from_bson(bson, true, false, json::error_handler_t::strict).is_discarded());
-
-    // well-formed names pass the check without being stored
-    const json valid = {{"a", {true, false, {{"k", json::array({1, 2})}}}}};
-    CHECK(json::from_bson(json::to_bson(valid), true, true, json::error_handler_t::strict) == valid);
 }
 #endif
 

tests/src/unit-json_view_builder.cpp

@@ -692,7 +692,7 @@ TEST_CASE("json_view builder: fraction digits")
             check_same(number);
             check_same("[" + number + "]");
             std::string pair;
-            pair.reserve((number.size() * 2) + 3);
+            pair.reserve(number.size() * 2 + 3);
             pair += '[';
             pair += number;
             pair += ',';

tests/src/unit-json_view_positions.cpp

@@ -521,8 +521,7 @@ TEST_CASE("json_view exceptions name the path and the bytes of the value")
         std::string text = "7";
         for (int level = 0; level < 40; ++level)
         {
-            text.insert(0, R"([[1, [2]], )");
-            text += R"(, {"k": [3, {"l": [4]}]}, [5, [6, [7]]]])";
+            text = R"([[1, [2]], )" + text + R"(, {"k": [3, {"l": [4]}]}, [5, [6, [7]]]])";
         }
         CAPTURE(text)
         const json j = json::parse(text);