From 7dd8e80ba910c9351dae504cc1f7523e5de735d0 Mon Sep 17 00:00:00 2001 From: Ramya Eliger Date: Mon, 13 Jul 2026 18:22:16 +0530 Subject: [PATCH 1/2] fix overflow check in parse_number_token --- include/boost/json/impl/pointer.ipp | 6 +++--- test/pointer.cpp | 8 ++++++++ 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/include/boost/json/impl/pointer.ipp b/include/boost/json/impl/pointer.ipp index d07c48082..0256c0c47 100644 --- a/include/boost/json/impl/pointer.ipp +++ b/include/boost/json/impl/pointer.ipp @@ -200,14 +200,14 @@ parse_number_token( return {}; } - std::size_t new_result = result * 10 + d; - if( new_result < result ) + // guard against std::size_t overflow in result * 10 + d + if( result > (std::size_t(-1) - d) / 10 ) { BOOST_JSON_FAIL(ec, error::token_overflow); return {}; } - result = new_result; + result = result * 10 + d; } return result; diff --git a/test/pointer.cpp b/test/pointer.cpp index ef4c12bb2..6b658befc 100644 --- a/test/pointer.cpp +++ b/test/pointer.cpp @@ -231,6 +231,14 @@ class pointer_test jv.find_pointer(s, ec); BOOST_TEST(ec == error::token_overflow); BOOST_TEST(hasLocation(ec)); + + // a token an order of magnitude past max() still overflows size_t + string s2 = "/foo/"; + s2 += std::to_string((std::numeric_limits::max)()); + s2 += '9'; + jv.find_pointer(s2, ec); + BOOST_TEST(ec == error::token_overflow); + BOOST_TEST(hasLocation(ec)); } void From 66df6987f7a25fd2c7310ebe3384b439edca1748 Mon Sep 17 00:00:00 2001 From: Ramya Eliger Date: Fri, 17 Jul 2026 15:40:32 +0530 Subject: [PATCH 2/2] split overflow guard into multiply and add checks --- include/boost/json/impl/pointer.ipp | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/include/boost/json/impl/pointer.ipp b/include/boost/json/impl/pointer.ipp index 0256c0c47..0004c85d7 100644 --- a/include/boost/json/impl/pointer.ipp +++ b/include/boost/json/impl/pointer.ipp @@ -200,15 +200,19 @@ parse_number_token( return {}; } - // guard against std::size_t overflow in result * 10 + d - if( result > (std::size_t(-1) - d) / 10 ) + if( result > std::size_t(-1) / 10 ) { BOOST_JSON_FAIL(ec, error::token_overflow); return {}; } + result *= 10; - result = result * 10 + d; - + if( result > std::size_t(-1) - d ) + { + BOOST_JSON_FAIL(ec, error::token_overflow); + return {}; + } + result += d; } return result; }