Niels Lohmann e9df748dc4 Stop the BON8 writer overflowing the stack on deep values ...

to_bon8() recursed once per nesting level, so a value the iterative
BON8 reader accepts (e.g. ~24k nested one-element arrays) crashed on
the way back out. #5781 bounded the CBOR, MessagePack, and UBJSON/BJData
writers, but BON8 was merged before it and was not covered.

Apply the same scheme: recurse for the first recursion_depth_limit()
levels, then finish the value with write_bon8_iterative, which keeps
the open containers on a heap stack (reusing binary_container_frame)
and writes the 0xFE closer when it leaves a container with more than
four elements. The output is byte-for-byte unchanged.

Fixes https://issues.oss-fuzz.com/issues/572238015

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

2026-10-10 20:07:56 +02:00

..

json_fwd.hpp

Store maps with enum keys as objects (opt-in) (#5600)

2026-10-04 17:54:05 +02:00

json_literals.hpp

Move the user-defined string literals to <nlohmann/json_literals.hpp> and add JSON_NO_AUTOMATIC_UDLS (#5610)

2026-09-30 20:08:17 +02:00

json.hpp

Stop the BON8 writer overflowing the stack on deep values

2026-10-10 20:07:56 +02:00