Keep a NUL byte ending a // comment as the end of input

With the default NUL handling (JSON_STRICT_NUL_HANDLING not set), a NUL
byte in the input is treated as the real end of input everywhere -
except when it immediately ends a `//` comment: scan_comment() matched
'\0' as a comment terminator like '\n', so the NUL was consumed as
part of the comment and scan() never saw it as end of input; the next
get() then kept reading past it. Multi-line comments and
JSON_STRICT_NUL_HANDLING=1 were unaffected, since there the NUL is
just part of the comment text.

Fix scan_comment() to leave the NUL unconsumed (unget()) instead of
returning it as part of the comment, so the following scan() reports
it as end of input, exactly as for a NUL anywhere else.

Fixes #5659.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/workflows/publish_documentation.yml

@@ -7,16 +7,6 @@ on:
       - develop
     paths:
       - docs/mkdocs/**
-      # the site also embeds these files via pymdownx.snippets
-      # (mkdocs.yml sets restrict_base_path: false for this)
-      - .clang-tidy
-      - .github/CODE_OF_CONDUCT.md
-      - .github/CONTRIBUTING.md
-      - .github/SECURITY.md
-      - cmake/clang_flags.cmake
-      - cmake/gcc_flags.cmake
-      - tests/fmt_formatter/project/main.cpp
-      - tools/astyle/.astylerc
   workflow_dispatch:
 
 # we don't want to have concurrent jobs, and we don't want to cancel running jobs to avoid broken publications
@@ -33,7 +23,7 @@ jobs:
       contents: write
 
     if: github.repository == 'nlohmann/json'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
@@ -41,8 +31,6 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
 
       - name: Install virtual environment
         run: make install_venv -C docs/mkdocs

.github/workflows/ubuntu.yml

@@ -346,8 +346,6 @@ jobs:
     container: intel/oneapi-hpckit:latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
       - name: Get latest CMake and ninja
         uses: lukka/get-cmake@fffaaafeea488556c2c12dad60690008bc1caacb # v4.4.2
       - name: Run CMake
@@ -360,8 +358,6 @@ jobs:
     container: nvcr.io/nvidia/nvhpc:25.5-devel-cuda12.9-ubuntu22.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
       - name: Get latest CMake and ninja
         uses: lukka/get-cmake@fffaaafeea488556c2c12dad60690008bc1caacb # v4.4.2
       - name: Run CMake

.github/workflows/windows.yml

@@ -87,8 +87,6 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
       - name: Get latest CMake and ninja
         uses: lukka/get-cmake@fffaaafeea488556c2c12dad60690008bc1caacb # v4.4.2
       - name: Set extra CXX_FLAGS for latest std_version
@@ -125,8 +123,6 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
       - name: Run CMake (Release)
         run: cmake -S . -B build -G "Visual Studio 18 2026" -A ARM64 -DJSON_BuildTests=On -DCMAKE_CXX_FLAGS="/W4 /WX"
         if: matrix.build_type == 'Release'

docs/Makefile

@@ -11,31 +11,20 @@ EXAMPLES = $(wildcard mkdocs/docs/examples/*.cpp)
 
 cxx_standard = $(lastword c++11 $(filter c++%, $(subst ., ,$1)))
 
-# common compile flags for the stand-alone example files
-EXAMPLE_CPPFLAGS = -I $(SRCDIR) -DJSON_USE_GLOBAL_UDLS=0
-EXAMPLE_WARNFLAGS = -Werror=deprecated-declarations
-
-# examples that document deprecated API and are allowed to use it
-DEPRECATED_EXAMPLES = $(addprefix mkdocs/docs/examples/, \
-	json_pointer__operator__equal_stringtype \
-	json_pointer__operator__notequal_stringtype \
-	json_pointer__operator_string_t)
-$(DEPRECATED_EXAMPLES:=.output) $(DEPRECATED_EXAMPLES:=.test): EXAMPLE_WARNFLAGS = -Wno-deprecated-declarations
-
 # create output from a stand-alone example file
 %.output: %.cpp
-	@echo "standard $(call cxx_standard,$(<:.cpp=))"
+	@echo "standard $(call cxx_standard $(<:.cpp=))"
 	$(MAKE) $(<:.cpp=) \
-		CPPFLAGS="$(EXAMPLE_CPPFLAGS)" \
-		CXXFLAGS="-std=$(call cxx_standard,$(<:.cpp=)) $(EXAMPLE_WARNFLAGS)"
+		CPPFLAGS="-I $(SRCDIR) -DJSON_USE_GLOBAL_UDLS=0" \
+		CXXFLAGS="-std=$(call cxx_standard,$(<:.cpp=)) -Wno-deprecated-declarations"
 	./$(<:.cpp=) > $@
 	rm $(<:.cpp=)
 
 # compare created output with current output of the example files
 %.test: %.cpp
 	$(MAKE) $(<:.cpp=) \
-		CPPFLAGS="$(EXAMPLE_CPPFLAGS)" \
-		CXXFLAGS="-std=$(call cxx_standard,$(<:.cpp=)) $(EXAMPLE_WARNFLAGS)"
+		CPPFLAGS="-I $(SRCDIR) -DJSON_USE_GLOBAL_UDLS=0" \
+		CXXFLAGS="-std=$(call cxx_standard,$(<:.cpp=)) -Wno-deprecated-declarations"
 	./$(<:.cpp=) > $@
 	diff $@ $(<:.cpp=.output)
 	rm $(<:.cpp=) $@

docs/docset/Info.plist

@@ -13,7 +13,7 @@
     <key>dashIndexFilePath</key>
     <string>index.html</string>
     <key>DashDocSetFallbackURL</key>
-    <string>https://json.nlohmann.me/</string>
+    <string>https://nlohmann.github.io/json/</string>
     <key>isJavaScriptEnabled</key>
     <true/>
 </dict>

docs/docset/Makefile

@@ -52,25 +52,35 @@ install_docset_zeal: JSON_for_Modern_C++.docset
 	mkdir -p $$docset_root; \
 	cp -r JSON_for_Modern_C++.docset $$docset_root/
 
-# both targets below compare the docset search index with the mkdocs page
-# set. They share the same normalization (docs/foo/index.md and
-# docs/foo.md both become foo/index.html, the URL mkdocs itself would
-# give the page; the top-level index.md is excluded, as it is not part
-# of the hand-curated docSet.sql) and use comm(1) on two sorted lists
-# instead of running a sqlite3 query, or an O(n*m) nested shell loop,
-# once per page.
-DOCSET_INDEX_PATHS=$(shell sqlite3 docSet.dsidx "SELECT DISTINCT path FROM searchIndex" | sort)
-DOCSET_PAGE_PATHS=$(shell echo '$(MKDOCS_PAGES)' | tr ' ' '\n' | grep -v '^index\.md$$' | $(SED) -E 's@/index\.md$$@/index.html@; s@\.md$$@/index.html@' | sort)
-
 # list mkdocs pages missing from the docset index
 .PHONY: list_missing_pages
 list_missing_pages: docSet.dsidx
-	@comm -23 <(echo '$(DOCSET_PAGE_PATHS)' | tr ' ' '\n') <(echo '$(DOCSET_INDEX_PATHS)' | tr ' ' '\n')
+	@for page in $(MKDOCS_PAGES); do \
+		case "$$page" in \
+			*/index.md) path=$${page/\/index.md/} ;; \
+			*)          path=$${page/.md/}        ;; \
+		esac; \
+		if [ "x$$page" != "xindex.md" -a "x$$(sqlite3 docSet.dsidx "SELECT COUNT(*) FROM searchIndex WHERE path='$$path/index.html'")" = "x0" ]; then \
+			echo $$page; \
+		fi \
+	done
 
 # list paths in the docset index without a corresponding mkdocs page
 .PHONY: list_removed_paths
 list_removed_paths: docSet.dsidx
-	@comm -13 <(echo '$(DOCSET_PAGE_PATHS)' | tr ' ' '\n') <(echo '$(DOCSET_INDEX_PATHS)' | tr ' ' '\n')
+	@for path in $$(sqlite3 docSet.dsidx "SELECT path FROM searchIndex"); do \
+		page=$${path/\/index.html/.md}; \
+		page_index=$${path/index.html/index.md}; \
+		page_found=0; \
+		for p in $(MKDOCS_PAGES); do \
+			if [ "x$$p" = "x$$page" -o "x$$p" = "x$$page_index" ]; then \
+				page_found=1; \
+			fi \
+		done; \
+		if [ "x$$page_found" = "x0" ]; then \
+			echo $$path; \
+		fi \
+	done
 
 .PHONY: clean
 clean:

docs/docset/README.md

@@ -7,11 +7,10 @@ documentation browsers like [Dash](https://kapeli.com/dash), [Velocity](https://
 The docset can be created with
 
 ```sh
-make JSON_for_Modern_C++.docset
+make nlohmann_json.docset
 ```
 
-The generated folder `JSON_for_Modern_C++.docset` can then be opened in the documentation browser. `make all` builds a
-`JSON_for_Modern_C++.tgz` archive instead, and `make install_docset_zeal` installs the docset for Zeal directly.
+The generated folder `nlohmann_json.docset` can then be opened in the documentation browser.
 
 A recent version is also part of the [Dash user contributions](https://github.com/Kapeli/Dash-User-Contributions/tree/master/docsets/JSON_for_Modern_C%2B%2B).
 

docs/mkdocs/docs/api/basic_json/number_integer_t.md

@@ -51,7 +51,7 @@ range will yield over/underflow when used in a constructor. During deserializati
 will automatically be stored as [`number_unsigned_t`](number_unsigned_t.md) or [`number_float_t`](number_float_t.md).
 
 [RFC 8259](https://tools.ietf.org/html/rfc8259) further states:
-> Note that when such software is used, numbers that are integers and are in the range [-2<sup>53</sup>+1, 2<sup>53</sup>-1] are
+> Note that when such software is used, numbers that are integers and are in the range $[-2^{53}+1, 2^{53}-1]$ are
 > interoperable in the sense that implementations will agree exactly on their numeric values.
 
 As this range is a subrange of the exactly supported range [INT64_MIN, INT64_MAX], this class's integer type is

docs/mkdocs/docs/api/basic_json/number_unsigned_t.md

@@ -52,7 +52,7 @@ when used in a constructor. During deserialization, too large or small integer n
 as [`number_integer_t`](number_integer_t.md) or [`number_float_t`](number_float_t.md).
 
 [RFC 8259](https://tools.ietf.org/html/rfc8259) further states:
-> Note that when such software is used, numbers that are integers and are in the range [-2<sup>53</sup>+1, 2<sup>53</sup>-1] are
+> Note that when such software is used, numbers that are integers and are in the range $[-2^{53}+1, 2^{53}-1]$ are
 > interoperable in the sense that implementations will agree exactly on their numeric values.
 
 As this range is a subrange (when considered in conjunction with the `number_integer_t` type) of the exactly supported

docs/mkdocs/docs/api/basic_json/parse_error.md

@@ -54,7 +54,7 @@ classDiagram
 
 ## Notes
 
-For an input with <i>n</i> bytes, 1 is the index of the first character and <i>n</i>+1 is the index of the terminating null byte
+For an input with $n$ bytes, 1 is the index of the first character and $n+1$ is the index of the terminating null byte
 or the end of file. This also holds true when reading a byte vector for binary formats.
 
 ## Examples

docs/mkdocs/docs/examples/parse__iterator_pair.link

@@ -0,0 +1 @@
+<a target="_blank" href="https://wandbox.org/permlink/hUJYo1HWmfTBLMGn"><b>online</b></a>

docs/mkdocs/docs/examples/parse__pointers.link

@@ -0,0 +1 @@
+<a target="_blank" href="https://wandbox.org/permlink/AWbpa8e1xRV3y4MM"><b>online</b></a>

docs/mkdocs/docs/features/binary_formats/bjdata.md

@@ -61,7 +61,7 @@ The library uses the following mapping from JSON values types to BJData types ac
 
     The following values can **not** be converted to a BJData value:
 
-      - strings with more than 18446744073709551615 bytes, i.e., 2<sup>64</sup>-1 bytes (theoretical)
+      - strings with more than 18446744073709551615 bytes, i.e., $2^{64}-1$ bytes (theoretical)
 
 !!! info "Unused BJData markers"
 

docs/mkdocs/docs/features/types/index.md

@@ -273,7 +273,7 @@ When the default type is used, the maximal unsigned integer number that can be s
 
 [RFC 8259](https://tools.ietf.org/html/rfc8259) further states:
 
-> Note that when such software is used, numbers that are integers and are in the range [-2<sup>53</sup>+1, 2<sup>53</sup>-1] are interoperable in the sense that implementations will agree exactly on their numeric values.
+> Note that when such software is used, numbers that are integers and are in the range $[-2^{53}+1, 2^{53}-1]$ are interoperable in the sense that implementations will agree exactly on their numeric values.
 
 As this range is a subrange of the exactly supported range [`INT64_MIN`, `INT64_MAX`], this class's integer type is interoperable.
 

docs/mkdocs/docs/features/types/number_handling.md

@@ -48,7 +48,7 @@ On number interoperability, the following remarks are made:
     for numeric magnitude and precision than is widely available.
     
     Note that when such software is used, numbers that are integers and
-    are in the range [-2<sup>53</sup>+1, 2<sup>53</sup>-1] are interoperable in the
+    are in the range $[-2^{53}+1, 2^{53}-1]$ are interoperable in the
     sense that implementations will agree exactly on their numeric
     values.
 
@@ -95,9 +95,9 @@ This is the same behavior as the code `#!c double x = 3.141592653589793238462643
 
 !!! success "Interoperability"
 
-    - The library is interoperable with respect to the specification, because its supported range [-2<sup>63</sup>, 2<sup>64</sup>-1] is
-      larger than the described range [-2<sup>53</sup>+1, 2<sup>53</sup>-1].
-    - All integers outside the range [-2<sup>63</sup>, 2<sup>64</sup>-1], as well as floating-point numbers are stored as `double`.
+    - The library is interoperable with respect to the specification, because its supported range $[-2^{63}, 2^{64}-1]$ is
+      larger than the described range $[-2^{53}+1, 2^{53}-1]$.
+    - All integers outside the range $[-2^{63}, 2^{64}-1]$, as well as floating-point numbers are stored as `double`.
       This also concurs with the specification above.
 
 ### Zeros

docs/mkdocs/docs/integration/package_managers.md

@@ -678,11 +678,11 @@ to install the [nlohmann-json](https://ports.macports.org/port/nlohmann-json/) p
     1. Create the following files:
 
         ```cpp title="example.cpp"
-        --8<-- "integration/macports/example.cpp"
+        --8<-- "integration/homebrew/example.cpp"
         ```
 
         ```cmake title="CMakeLists.txt"
-        --8<-- "integration/macports/CMakeLists.txt"
+        --8<-- "integration/homebrew/CMakeLists.txt"
         ```
 
     2. Install the package:

docs/mkdocs/mkdocs.yml

@@ -349,6 +349,7 @@ markdown_extensions:
   - toc:
       permalink: true
   - md_in_html
+  - pymdownx.arithmatex
   - pymdownx.betterem:
       smart_enable: all
   - pymdownx.caret
@@ -440,3 +441,6 @@ plugins:
 
 extra_css:
   - css/custom.css
+
+extra_javascript:
+  - https://cdnjs.cloudflare.com/ajax/libs/mathjax/2.7.0/MathJax.js?config=TeX-MML-AM_CHTML

docs/mkdocs/scripts/check_structure.py

@@ -79,9 +79,9 @@ def check_structure() -> None:
                     report("whitespace/line_length", f"{file}:{lineno+1} ({current_section})", f"line is too long ({len(line)} vs. 160 chars)")
 
                 # sections in `<!-- NOLINT -->` comments are treated as present
-                nolint_match = re.match(r"<!--\s*NOLINT\s+(.*?)\s*-->", line)
-                if nolint_match:
-                    current_section = nolint_match.group(1)
+                if line.startswith("<!-- NOLINT"):
+                    current_section = line.strip("<!-- NOLINT")
+                    current_section = current_section.strip(" -->")
                     existing_sections.append(current_section)
 
                 # check if sections are correct
@@ -97,7 +97,7 @@ def check_structure() -> None:
                             if len(unexpected):
                                 report("style/numbering", f"{file}:{lineno} ({current_section})", f'unexpected overloads: {", ".join([f"({x})" for x in unexpected])}')
 
-                    current_section = line[3:]
+                    current_section = line.strip("## ")
                     existing_sections.append(current_section)
 
                     if current_section in expected_sections:
@@ -141,7 +141,7 @@ def check_structure() -> None:
                 # check that non-example admonitions have titles
                 untitled_admonition = re.match(r"^(\?\?\?|!!!) ([^ ]+)$", line)
                 if untitled_admonition and untitled_admonition.group(2) != "example":
-                    report("style/admonition_title", f"{file}:{lineno+1} ({current_section})", f'"{untitled_admonition.group(2)}" admonitions should have a title')
+                    report("style/admonition_title", f"{file}:{lineno} ({current_section})", f'"{untitled_admonition.group(2)}" admonitions should have a title')
 
                 previous_line = line
 

include/nlohmann/detail/input/lexer.hpp

@@ -975,10 +975,15 @@ class lexer : public lexer_base<BasicJsonType>
                         case '\n':
                         case '\r':
                         case char_traits<char_type>::eof():
+                            return true;
+
 #if !JSON_STRICT_NUL_HANDLING
                         case '\0':
-#endif
+                            // a NUL byte is the end of the input (see scan()),
+                            // so leave it for scan() to see
+                            unget();
                             return true;
+#endif
 
                         default:
                             break;

single_include/nlohmann/json.hpp

@@ -10067,10 +10067,15 @@ class lexer : public lexer_base<BasicJsonType>
                         case '\n':
                         case '\r':
                         case char_traits<char_type>::eof():
+                            return true;
+
 #if !JSON_STRICT_NUL_HANDLING
                         case '\0':
-#endif
+                            // a NUL byte is the end of the input (see scan()),
+                            // so leave it for scan() to see
+                            unget();
                             return true;
+#endif
 
                         default:
                             break;

tests/src/unit-class_parser.cpp

@@ -592,6 +592,45 @@ TEST_CASE("parser class")
 
                 // parsing from a string literal is unaffected either way
                 CHECK(json::parse("123") == json(123));
+
+                // a NUL byte that ends a // comment ends the input just
+                // like a NUL byte anywhere else (issue #5659); before the
+                // fix, the NUL was consumed as part of the comment, and
+                // scanning continued with whatever followed it
+                {
+                    // same as "//c" alone (real end of input after the
+                    // comment), rather than continuing with "[1]"
+                    std::string s1 = "//c";
+                    s1.push_back('\0');
+                    s1 += "[1]";
+                    json _; // NOLINT(readability-identifier-naming)
+                    CHECK_THROWS_WITH_AS(_ = json::parse(s1, nullptr, true, true),
+                                         "[json.exception.parse_error.101] parse error at line 1, column 4: syntax error while parsing value - unexpected end of input; expected '[', '{', or a literal",
+                                         json::parse_error&);
+                    CHECK_FALSE(json::accept(s1, true, true));
+                }
+
+                {
+                    // same as "[1, //c" alone, rather than continuing with " 2]"
+                    std::string s2 = "[1, //c";
+                    s2.push_back('\0');
+                    s2 += " 2]";
+                    json _; // NOLINT(readability-identifier-naming)
+                    CHECK_THROWS_WITH_AS(_ = json::parse(s2, nullptr, true, true),
+                                         "[json.exception.parse_error.101] parse error at line 1, column 8: syntax error while parsing value - unexpected end of input; expected '[', '{', or a literal",
+                                         json::parse_error&);
+                    CHECK_FALSE(json::accept(s2, true, true));
+                }
+
+                {
+                    // same as "1 //c" alone: the comment (and the NUL that
+                    // ends it) is ignored, and "x" is never reached
+                    std::string s3 = "1 //c";
+                    s3.push_back('\0');
+                    s3 += "x";
+                    CHECK(json::parse(s3, nullptr, true, true) == json(1));
+                    CHECK(json::accept(s3, true, true));
+                }
             }
 #endif