mirror of
https://github.com/nlohmann/json.git
synced 2026-11-10 22:31:02 +00:00
Niels Lohmann
61a37849c9
dump() batches float tokens of 16 or 17 digits with at least 8 fraction digits. A damaged image loaded with image_check::bounds can record a token with no digit before the point and 17 after it, which no JSON number has. Its q = -17 is outside the range of locate_token(), which then read fives[17] past its 17 entries; on x86-64 the resulting digits had 18 digits and failed the assertion of write_decimal() (OSS-Fuzz issue 583898810, json_view_image_fuzzer). The batch now takes 8 to 16 fraction digits, which every valid token of 16 or 17 digits has, so it batches the same tokens of valid documents. Signed-off-by: Niels Lohmann <mail@nlohmann.me>