fix(fuzz): use the real reader settings keys in the fuzzer (#1730)
The fuzzer set most CharReaderBuilder settings under names with a
trailing underscore ("allowComments_", "strictRoot_", ...), which
newCharReader() does not read, and set failIfExtra twice. As a result
only failIfExtra and collectComments ever varied; every other reader
mode was stuck at its default.
Use the real key names, give the duplicate failIfExtra bit to skipBom,
and add an optional small stackLimit (bit 11, value from the upper 16
bits) so the depth-limit error paths are reachable. Abort if
CharReaderBuilder::validate() rejects the settings, so a misspelled key
fails loudly instead of silently disabling a mode.
The FuzzTest unit test only passed "{}", which is shorter than the
4-byte settings header and returned before touching any settings.
Exercise no settings, all settings, and a tiny stack limit.
In a local 2-minute libFuzzer run from test/data seeds, json_reader.cpp
edge coverage goes from 465 to 570 of 1996.
JSON is a lightweight data-interchange format. It can represent numbers, strings, ordered sequences of values, and collections of name/value pairs.
JsonCpp is a C++ library that allows manipulating JSON values, including serialization and deserialization to and from strings. It can also preserve existing comment in deserialization/serialization steps, making it a convenient format to store user input files.
JsonCpp is a mature project in maintenance mode. Our priority is providing a stable, reliable JSON library for the long tail of C++ development.
JsonCpp remains a primary choice for developers who require comment preservation and support for legacy toolchains where modern C++ standards are unavailable. The library is intended to be a reliable dependency that does not require frequent updates or major migration efforts.
1.y.z (master): Actively maintained. Requires C++11.
0.y.z: Legacy support for pre-C++11 compilers. Maintenance is limited to critical security fixes.
00.11.z: Discontinued.
Major versions maintain binary compatibility. Critical security fixes are accepted for both the master and 0.y.z branches.
[!NOTE] Package manager ports (vcpkg, Conan, etc.) are community-maintained. Please report outdated versions or missing generators to their respective repositories.
meson wrap install jsoncpp
For projects requiring a single-header approach, JsonCpp provides a script to generate an amalgamated source and header file.
You can generate the amalgamated files by running the following Python script from the top-level directory:
python3 amalgamate.py
This will generate a dist directory containing jsoncpp.cpp, json/json.h, and json/json-forwards.h. You can then drop these files directly into your project's source tree and compile jsoncpp.cpp alongside your other source files.
The API reference is generated with Doxygen from the master branch on every push. To build it locally, run python3 doxybuild.py --open from the top-level directory (see doc/readme.txt). Additional information is available on the Project Wiki.
JsonCpp is licensed under the MIT license, or public domain where recognized. See LICENSE for details.