parse_number accepts the result of Rust's f64 parser without checking finiteness. A syntactically valid large exponent such as 1e9999 can produce infinity. The writer replaces non-finite Json::Num values with null, so parse/write can silently change a number into a different JSON type. The existing f64 representation needs a clear unsupported-range error rather than silent conversion.
Source evidence at the head of #520:
Acceptance:
API/reference context: JSON permits implementations to bound numeric range, section 6.
Related: #351 is independent string-decoding work.
Audit status: identified by static source inspection; the scenarios above have not been executed during this audit. The permalink fixes the reviewed revision; this report does not claim the defect was introduced by #520.
parse_numberaccepts the result of Rust's f64 parser without checking finiteness. A syntactically valid large exponent such as1e9999can produce infinity. The writer replaces non-finiteJson::Numvalues withnull, so parse/write can silently change a number into a different JSON type. The existing f64 representation needs a clear unsupported-range error rather than silent conversion.Source evidence at the head of #520:
s.parse::<f64>()if n.is_finite()Acceptance:
API/reference context: JSON permits implementations to bound numeric range, section 6.
Related: #351 is independent string-decoding work.
Audit status: identified by static source inspection; the scenarios above have not been executed during this audit. The permalink fixes the reviewed revision; this report does not claim the defect was introduced by #520.