Bound non-null-terminated value scanners against end of input

[stephenberry]

Summary

A class of JSON value scanners dereference *it without an end check, relying on the trailing '\0' sentinel that only exists for null-terminated buffers. When opts.null_terminated = false (no sentinel), truncated or boundary input reads past the end of the buffer — a heap-buffer-overflow under ASAN on an exact-size buffer.

This is the same bug class as the recent minified skip_ws end-guard work, but in scanners that never route through skip_ws, so they were not covered. Each fix preserves null-terminated behavior — the gated guards compile out entirely, and the few loop restructures are behavior-equivalent — and bounds only the non-null-terminated path.

Fixes

Scanner	File	Reached via
skip_number (non-validating)	util/parse.hpp	glz::raw_json field / value skip
skip_number_with_validation	util/parse.hpp	get_view_json / validate_json numbers
number_of_array_elements	json/read.hpp	resizable non-emplace_back arrays (e.g. std::forward_list)
skip_string (non-padded, validating)	util/parse.hpp	get_view_json / validate_json strings
NDJSON read_new_lines	json/ndjson.hpp	read_ndjson with null_terminated = false
handle_slice (JMESPath array slices)	json/jmespath.hpp	read_jmespath slices with null_terminated = false
enum-by-name reader (reflective)	json/read.hpp	reflect_enums enum values (C++26 P2996) with null_terminated = false

• skip_number / skip_string: gated via if constexpr (not Opts.null_terminated) (their opts structs gain a null_terminated field); zero overhead on the default path.
• skip_number_with_validation: unconditional it != end guards on the standalone *it reads (the find_if_not scans were already end-bounded).
• number_of_array_elements: if constexpr (not Opts.null_terminated) end-checks before each dereference; compiles out by default.
• NDJSON read_new_lines: gated; the null-terminated path is unchanged.
• handle_slice (both the tuple and resizable-array overloads): a local at_end() guard — if constexpr (not Opts.null_terminated), so it compiles out by default — runs before each structural ] / , scan. Covers the partial-read path, the read-all fallback (negative step / negative indices), and the skip-to-slice-start pre-scan.
• enum-by-name reader: the key scan had its operands reversed (*it dereferenced before the it != end bound); swapped, plus a guard on the post-scan ++it for an unterminated key. Gated behind GLZ_REFLECTION26 + reflect_enums.

Scope note

This hardens the null_terminated = false contract. Reading a non-null-terminated buffer under default options (null_terminated = true, e.g. a std::string_view/std::span over an exact-size region with no terminator) remains unsupported, as it is for the rest of the reader — the value parsers rely on the sentinel there.

Tests

• non_null_terminated_scanner_bounds (tests/json_test): exercises each scanner above at its buffer boundary (truncated and complete inputs over exact-size buffers).
• non_null_terminated_slice_bounds (tests/jmespath): feeds every truncation prefix of a complete array through an exact-size buffer (tuple and vector targets, partial-read and read-all paths); the complete array still resolves.
• reflect_enums non-null-terminated bounds (tests/p2996_test): reads an unterminated reflective enum key over an exact-size buffer and asserts an error. With the unbounded scan, a valid name lacking its closing quote over-reads and wrongly succeeds, so the error assertion pins the bounded behavior even where that CI job runs without sanitizers; it runs in the dedicated C++26 reflection CI.

The JSON suites run under the existing ASAN CI job, which is what catches the over-reads. Verified locally: json_test passes under ASAN (685 tests, 0 failures), and the jmespath suite passes under ASAN (18 tests, 136 asserts); each pre-fix over-read was reproduced and is resolved.