mirror of
https://github.com/nlohmann/json.git
synced 2026-10-15 10:47:13 +00:00
Niels Lohmann
467670aa7a
The bulk string scanner, the SWAR searches, the UTF-8 prefix validator, the 8-digit number loop, the 8-byte indentation skip, and the BSON/BON8 bulk string readers load several bytes at a time from contiguous input. ASan misses over-reads into the slack of the same heap allocation, and fuzzers rarely end an input exactly at a page boundary. The new test copies each input directly in front of, and directly behind, an inaccessible page (mmap/mprotect on POSIX, VirtualAlloc/VirtualProtect on Windows), so reading even one byte outside the input crashes. It covers the string-scan functions directly and json::parse, accept, sax_parse (with and without comments) and all binary readers through the public API, with inputs ending at every byte of strings, escapes, UTF-8 sequences, numbers, literals, indentation runs, and binary documents. Each result must match parsing the same input from a std::string. Signed-off-by: Niels Lohmann <mail@nlohmann.me>