nosj 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e602e52eed45bcb8699e1742827fabc72f8c3579ea04d47a4a4a10349542d201
-  data.tar.gz: a257dfe77c69f02330cb48be35dc08492eb6e09fc2c11cc177f88ca969f31ab0
+  metadata.gz: 7152dbc291ed6d291977555ba6a6b36f6d3d52dad57348a0baf8271212d1bb25
+  data.tar.gz: '083bd8ca6fac180455b4847c1634f4ac28455db8e6e85def4e14393700e3008f'
 SHA512:
-  metadata.gz: 5c012acd8c48dde81e6c46ec45a2e8c18c4d4b790866f506610c878353ca16e98bc313a0725cc1cabd5a3765325f9e3930a436c1d8ef574513df5abf4345c798
-  data.tar.gz: e4557199e32432b96e9d9f499fca2b9bf4f35cae723640bc02461625bb41c05efd8d9b8423f8695b3b8fca448658bfdcc12c0cb3780ead253b212098fc31f2a4
+  metadata.gz: 254595b89839c50a48adedc03f8ec70498cc0cf6876390565f3dd188cc5dfca564c498443d0091c23bbf6562bb11b1724a25c073fa9e76986b8b1779cc91765d
+  data.tar.gz: 4d321fb92d1199649dc10f84853aa3124e40cc642b3da680772f392c315374116f04d09882f4fd95f2c445941b384f15e23ab89fc3c735edebd8868855cb8582

data/CHANGELOG.md

@@ -1,3 +1,27 @@
+## [0.3.1] - 2026-07-17
+
+- Fixed: `NOSJ.minify` / `NOSJ.reformat` produced unparseable output
+  for a float that overflows to Infinity—a huge-exponent literal like
+  `1e999`, or a ~300-digit integer with an exponent (such literals
+  parse to Infinity even in strict mode, matching the `json` gem).
+  The pipe emitted a bare `Infinity` token; it now raises the same
+  `GeneratorError` that `generate` would
+  (`"Infinity not allowed in JSON"`). With `allow_nan: true` the
+  literal still passes through as `Infinity`. Found by fuzzing.
+- Fixed (second manifestation, also found by fuzzing): the same
+  unparseable output could appear with the overflowing literal hidden
+  behind a duplicate object key. Because the reformat pipe
+  deliberately preserves duplicate-key entries, it now refuses such
+  documents with the same `GeneratorError` even though
+  `generate(parse(x))` succeeds there (last-key-wins parsing discards
+  the shadowed value)—a documented divergence.
+- Differential fuzzing for the native extension (`ext/nosj/fuzz`):
+  three cargo-fuzz targets—reformat, NDJSON framing, and
+  byte-splicing/JSON Patch—each drive the real entry points on an
+  embedded Ruby VM and compare every input against pure-Ruby
+  reference implementations, with committed seed corpora and a weekly
+  CI workflow (`fuzz.yml`).
+
 ## [0.3.0] - 2026-07-17
 
 - Reformat without parsing. `NOSJ.minify(json, opts)` and

data/Cargo.lock

@@ -198,7 +198,7 @@ dependencies = [
 
 [[package]]
 name = "nosj_native"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "ahash",
  "magnus",

data/README.md

@@ -434,6 +434,11 @@ bundle exec rake bench:fast             # the sweep without retraining
 bundle exec rake "bench:ips[twitter]"   # multi-gem shoot-out (benchmark-ips); no args = full corpus
 ```
 
+The native layer is differentially fuzzed on an embedded VM
+(reformat pipe, NDJSON framing, splice/patch span arithmetic against
+pure-Ruby reference implementations)—see
+[ext/nosj/fuzz/README.md](ext/nosj/fuzz/README.md).
+
 ## Acknowledgements
 
 Thanks to [Jean Boussier](https://github.com/byroot), [Florian Frank](https://github.com/flori), [Hiroshi Shibata](https://github.com/hsbt), [Nobuyoshi Nakada](https://github.com/nobu), [Étienne Barrié](https://github.com/etiennebarrie), and the other authors and maintainers of the [json gem](https://github.com/ruby/json)—for their work on the gem itself, for optimization ideas, and for some of the JSON documents in the benchmark corpus.

data/ext/nosj/Cargo.toml

@@ -5,7 +5,7 @@
 # required by lib/nosj.rb as "nosj/nosj" (Init_nosj set explicitly in
 # lib.rs). Gem name, module, and API are plain nosj.
 name = "nosj_native"
-version = "0.3.0"
+version = "0.3.1"
 edition = "2021"
 authors = ["Yaroslav Markin <yaroslav@markin.net>"]
 license = "MIT"

data/ext/nosj/fuzz/Cargo.toml

@@ -0,0 +1,41 @@
+[package]
+name = "nosj-ruby-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+# Must match the extension's own magnus line so cargo unifies the
+# rb-sys link (one libruby, one VM).
+magnus = { git = "https://github.com/matsadler/magnus", features = ["embed", "rb-sys"] }
+# The extension as an rlib; its lib target is named `nosj` (the bundle
+# name), so rename the dependency to keep fuzz code readable.
+nosj_ext = { path = "..", package = "nosj_native" }
+
+# Prevent this from being interpreted as part of a parent workspace.
+[workspace]
+
+[[bin]]
+name = "reformat"
+path = "fuzz_targets/reformat.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "lines"
+path = "fuzz_targets/lines.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "patch"
+path = "fuzz_targets/patch.rs"
+test = false
+doc = false
+bench = false

data/ext/nosj/fuzz/fuzz_targets/lines.rs

@@ -0,0 +1,9 @@
+//! NDJSON framing vs one parse per line, plus a generate_lines
+//! round-trip over whatever the streaming side yielded.
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    nosj_ruby_fuzz::drive("lines_case", data);
+});

data/ext/nosj/fuzz/fuzz_targets/patch.rs

@@ -0,0 +1,10 @@
+//! Byte-splicing edits and RFC 6902 patch vs a pure-Ruby tree
+//! reference. Input is "document \0 spec": an object spec drives
+//! splice, an array spec drives patch.
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    nosj_ruby_fuzz::drive("patch_case", data);
+});

data/ext/nosj/fuzz/fuzz_targets/reformat.rs

@@ -0,0 +1,10 @@
+//! Reformat pipe vs whole-document parse: acceptance must agree
+//! (valid?/stats included), minify must round-trip and be idempotent,
+//! pretty must round-trip.
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    nosj_ruby_fuzz::drive("reformat_case", data);
+});

data/ext/nosj/fuzz/src/lib.rs

@@ -0,0 +1,48 @@
+//! Shared harness for the extension fuzz targets: boot one embedded
+//! Ruby VM per process, register the extension exactly as `require
+//! "nosj/nosj"` would, and load the Ruby-side differential checks.
+//!
+//! The targets exercise the gem-side byte-manipulation layers the
+//! parser crate's own fuzzers never see (reformat, NDJSON framing,
+//! splice/patch span arithmetic). The checking logic lives in
+//! prelude.rb; a raised Ruby exception surfaces here as an Err and
+//! aborts the run.
+
+use std::sync::Once;
+
+use magnus::prelude::*;
+use magnus::{RModule, Ruby, Value};
+
+static VM: Once = Once::new();
+
+const PRELUDE: &str = include_str!("prelude.rb");
+
+/// Run one fuzz iteration with the VM up and the checks defined.
+/// libFuzzer drives every input on the same thread, which is the
+/// thread the VM was initialized on.
+pub fn with_vm<F: FnOnce(&Ruby, RModule)>(f: F) {
+    VM.call_once(|| {
+        let cluster = unsafe { magnus::embed::init() };
+        // The VM must outlive every future iteration.
+        std::mem::forget(cluster);
+        let ruby = Ruby::get().expect("VM just initialized on this thread");
+        unsafe { nosj_ext::Init_nosj() };
+        ruby.eval::<Value>(PRELUDE).expect("fuzz prelude must load");
+    });
+    let ruby = Ruby::get().expect("fuzz iterations run on the VM thread");
+    let checks = ruby
+        .define_module("NOSJFuzz")
+        .expect("prelude defines NOSJFuzz");
+    f(&ruby, checks);
+}
+
+/// Feed raw bytes to a single-argument check; any raised exception
+/// (an assertion failure or an unexpected error class) aborts.
+pub fn drive(check: &str, data: &[u8]) {
+    with_vm(|ruby, checks| {
+        let input = ruby.str_from_slice(data);
+        if let Err(e) = checks.funcall::<_, _, Value>(check, (input,)) {
+            panic!("{check}: {e}");
+        }
+    });
+}

data/ext/nosj/fuzz/src/prelude.rb

@@ -0,0 +1,400 @@
+# frozen_string_literal: true
+
+# Differential checks for the extension fuzz targets. Only the native
+# layer is loaded (Init_nosj, no lib/nosj.rb), so the error classes the
+# extension looks up by name are defined here first.
+module NOSJ
+  class Error < StandardError; end
+  class ParserError < Error; end
+  class GeneratorError < Error; end
+  class NestingError < Error; end
+  class PatchError < Error; end
+end
+
+module NOSJFuzz
+  # A reference-side rejection: the case must fail natively too.
+  RefFail = Class.new(StandardError)
+
+  PARSE_FAIL = [NOSJ::ParserError, NOSJ::NestingError].freeze
+  EDIT_FAIL = (PARSE_FAIL + [NOSJ::PatchError, NOSJ::GeneratorError,
+    KeyError, ArgumentError, TypeError]).freeze
+  PRETTY = {indent: "  ", space: " ", object_nl: "\n", array_nl: "\n"}.freeze
+  # A copy op can double the document (copy root into a child), so a
+  # long op list can grow it exponentially; keep runs tractable.
+  MAX_PATCH_OPS = 12
+
+  module_function
+
+  def utf8(bytes) = bytes.dup.force_encoding(Encoding::UTF_8)
+
+  def try_parse(s, opts = nil)
+    [:ok, NOSJ.parse_native(s, opts)]
+  rescue *PARSE_FAIL
+    [:err, nil]
+  end
+
+  # --- reformat: minify/reformat vs parse-then-generate ---------------
+
+  def reformat_case(bytes)
+    s = utf8(bytes)
+    status, value = try_parse(s)
+
+    unless NOSJ.valid_native(s, nil) == (status == :ok)
+      raise "valid? disagrees with parse on acceptance"
+    end
+    stats_ok = begin
+      NOSJ.stats_native(s, nil)
+      true
+    rescue *PARSE_FAIL
+      false
+    end
+    raise "stats disagrees with parse on acceptance" unless stats_ok == (status == :ok)
+
+    min_status, min = begin
+      [:ok, NOSJ.reformat_native(s, nil)]
+    rescue *PARSE_FAIL
+      [:err, nil]
+    rescue NOSJ::GeneratorError
+      [:generator, nil]
+    end
+
+    if status == :err
+      # The pipe may abort with GeneratorError (lone-surrogate key,
+      # non-finite float) before the parser reaches whatever made the
+      # whole document unparseable; any refusal is a refusal.
+      raise "reformat accepted what parse refused" unless [:err, :generator].include?(min_status)
+      return
+    end
+    if min_status == :generator
+      # On a document parse accepts, only an overflow-to-Infinity
+      # float (1e999, a 300-digit integer with a small exponent, maybe
+      # hidden behind a duplicate key parse would discard) or a
+      # lone-surrogate object key may abort the pipe. Rerunning with
+      # allow_nan separates them: it lifts the float refusal but not
+      # the key refusal, and the key requires a \u escape.
+      begin
+        NOSJ.reformat_native(s, {allow_nan: true})
+      rescue NOSJ::GeneratorError
+        raise "GeneratorError without a \\u escape in source" unless s.include?("\\u")
+      end
+      return
+    end
+    raise "reformat refused what parse accepted" unless min_status == :ok
+
+    reparsed = stage("reparse minify output #{min.inspect[0, 200]}") do
+      NOSJ.parse_native(min, nil)
+    end
+    raise "minify does not round-trip: #{min.inspect[0, 200]}" unless reparsed.eql?(value)
+    raise "minify is not idempotent" unless stage("re-minify") {
+      NOSJ.reformat_native(min, nil)
+    } == min
+    pretty = stage("pretty") { NOSJ.reformat_native(s, PRETTY) }
+    raise "pretty does not round-trip" unless stage("reparse pretty") {
+      NOSJ.parse_native(pretty, nil)
+    }.eql?(value)
+    nil
+  end
+
+  # Rebrand an exception from a must-succeed stage with its context;
+  # these are harness violations, not expected refusals.
+  def stage(name)
+    yield
+  rescue => e
+    raise "#{name} failed: #{e.class}: #{e.message}"
+  end
+
+  # --- lines: each_line vs one parse per line -------------------------
+
+  def lines_case(bytes)
+    s = utf8(bytes)
+    yielded = []
+    status = begin
+      NOSJ.each_line_native(s, nil) { |v| yielded << v }
+      :ok
+    rescue *PARSE_FAIL
+      :err
+    end
+
+    unless s.valid_encoding?
+      raise "each_line accepted invalid UTF-8" unless status == :err
+      raise "each_line yielded before the encoding gate" unless yielded.empty?
+      return
+    end
+
+    reference = []
+    ref_status = :ok
+    s.split("\n", -1).each do |line|
+      next if line.match?(/\A[ \t\r]*\z/)
+      line_status, value = try_parse(line)
+      if line_status == :err
+        ref_status = :err
+        break
+      end
+      reference << value
+    end
+
+    unless status == ref_status
+      raise "acceptance: each_line #{status}, per-line parse #{ref_status}"
+    end
+    # On error the values yielded before the bad line must still match.
+    raise "yielded values diverge from per-line parses" unless yielded.eql?(reference)
+
+    if status == :ok && !yielded.empty?
+      begin
+        ndjson = NOSJ.generate_lines_native(yielded, nil)
+      rescue NOSJ::GeneratorError
+        return # WTF-8 strings (lone surrogates) are not generable
+      end
+      back = []
+      NOSJ.each_line_native(ndjson, nil) { |v| back << v }
+      raise "generate_lines does not round-trip" unless back.eql?(yielded)
+    end
+    nil
+  end
+
+  # --- patch/splice: raw-byte editing vs tree editing -----------------
+
+  # Input is "document \0 spec"; a spec parsing to an object fuzzes
+  # splice (pointer => value), an array fuzzes RFC 6902 patch.
+  #
+  # The reference tree parses under the default nesting cap, so
+  # deeper-than-100 documents are exercised for crashes only, like
+  # malformed ones: resolution scans just the bytes some pointer needs
+  # (documented crate semantics), so the native side may legitimately
+  # succeed where whole-document parsing refuses.
+  def patch_case(bytes)
+    doc_bytes, sep, spec_bytes = bytes.partition("\0")
+    return if sep.empty?
+    doc = utf8(doc_bytes)
+    spec_status, spec = try_parse(utf8(spec_bytes))
+    return unless spec_status == :ok
+    # Replacement values with broken encoding (lone surrogates) raise
+    # GeneratorError on insertion; the reference cannot mirror that.
+    return unless deep_valid_encoding?(spec)
+
+    tree_status, tree = try_parse(doc)
+    # Duplicate keys: raw-byte resolution sees the first occurrence,
+    # tree materialization keeps the last; the two sides cannot agree.
+    if tree_status == :ok && NOSJ.stats_native(doc, nil)[:keys] != count_keys(tree)
+      return
+    end
+
+    case spec
+    when Hash
+      splice_case(doc, tree_status, tree, spec)
+    when Array
+      return if spec.length > MAX_PATCH_OPS
+      rfc6902_case(doc, tree_status, tree, spec)
+    end
+    nil
+  end
+
+  def splice_case(doc, tree_status, tree, edits)
+    native_status, result = begin
+      [:ok, NOSJ.splice_native(doc, edits, nil)]
+    rescue *EDIT_FAIL
+      [:err, nil]
+    end
+    return unless tree_status == :ok
+
+    ref_status, ref = begin
+      [:ok, ref_splice(tree, edits)]
+    rescue RefFail
+      [:err, nil]
+    end
+    unless native_status == ref_status
+      raise "splice acceptance: native #{native_status}, reference #{ref_status}"
+    end
+    return unless native_status == :ok
+    got = NOSJ.parse_native(result, {max_nesting: false})
+    raise "splice result diverges from reference" unless got.eql?(ref)
+  end
+
+  def rfc6902_case(doc, tree_status, tree, ops)
+    native_status, result = begin
+      [:ok, NOSJ.patch_native(doc, ops, nil)]
+    rescue *EDIT_FAIL
+      [:err, nil]
+    end
+    return unless tree_status == :ok
+
+    ref_status, ref = begin
+      [:ok, ref_patch(tree, ops)]
+    rescue RefFail
+      [:err, nil]
+    end
+    unless native_status == ref_status
+      raise "patch acceptance: native #{native_status}, reference #{ref_status}"
+    end
+    return unless native_status == :ok
+    got = NOSJ.parse_native(result, {max_nesting: false})
+    raise "patch result diverges from reference" unless got.eql?(ref)
+  end
+
+  # --- the pure-Ruby reference implementations ------------------------
+
+  def ref_splice(tree, edits)
+    token_lists = edits.keys.map { |ptr| ptr_tokens(ptr) }
+    token_lists.combination(2) do |a, b|
+      short, long = (a.length <= b.length) ? [a, b] : [b, a]
+      raise RefFail if long[0, short.length] == short
+    end
+    box = [tree]
+    edits.each_value.with_index do |value, i|
+      toks = token_lists[i]
+      if toks.empty?
+        box[0] = value
+      else
+        parent = ref_resolve(box[0], toks[0..-2])
+        case parent
+        when Hash
+          raise RefFail unless parent.key?(toks[-1])
+          parent[toks[-1]] = value
+        when Array
+          parent[strict_index(toks[-1], parent.size)] = value
+        else
+          raise RefFail
+        end
+      end
+    end
+    box[0]
+  end
+
+  def ref_patch(tree, ops)
+    box = [tree]
+    ops.each do |op|
+      raise RefFail unless op.is_a?(Hash)
+      name = op["op"]
+      raise RefFail unless name.is_a?(String)
+      path = op["path"]
+      raise RefFail unless path.is_a?(String)
+      case name
+      when "add" then ref_add(box, ptr_tokens(path), fetch_value(op))
+      when "replace" then ref_replace(box, ptr_tokens(path), fetch_value(op))
+      when "remove" then ref_remove(box, ptr_tokens(path))
+      when "move"
+        from = op["from"]
+        raise RefFail unless from.is_a?(String)
+        # The native side short-circuits these before validating the
+        # pointers, in this order; mirror it exactly.
+        next if path == from
+        raise RefFail if path.start_with?("#{from}/") || from.empty?
+        from_toks = ptr_tokens(from)
+        moved = ref_resolve(box[0], from_toks)
+        ref_remove(box, from_toks)
+        ref_add(box, ptr_tokens(path), moved)
+      when "copy"
+        from = op["from"]
+        raise RefFail unless from.is_a?(String)
+        ref_add(box, ptr_tokens(path), deep_dup(ref_resolve(box[0], ptr_tokens(from))))
+      when "test"
+        raise RefFail unless ref_resolve(box[0], ptr_tokens(path)) == fetch_value(op)
+      else
+        raise RefFail
+      end
+    end
+    box[0]
+  end
+
+  def ptr_tokens(ptr)
+    return [] if ptr.empty?
+    raise RefFail unless ptr.start_with?("/")
+    # RFC 6901 unescape order: ~1 before ~0, matching the native side.
+    ptr.split("/", -1).drop(1).map { |t| t.gsub("~1", "/").gsub("~0", "~") }
+  end
+
+  def strict_index(token, size, insert: false)
+    raise RefFail unless token.match?(/\A(?:0|[1-9][0-9]*)\z/)
+    i = token.to_i
+    in_range = i < size || (insert && i == size)
+    raise RefFail unless in_range
+    i
+  end
+
+  def ref_resolve(node, toks)
+    toks.each do |t|
+      case node
+      when Hash
+        raise RefFail unless node.key?(t)
+        node = node[t]
+      when Array
+        node = node[strict_index(t, node.size)]
+      else
+        raise RefFail
+      end
+    end
+    node
+  end
+
+  def ref_add(box, toks, value)
+    return box[0] = value if toks.empty?
+    parent = ref_resolve(box[0], toks[0..-2])
+    case parent
+    when Hash
+      parent[toks[-1]] = value
+    when Array
+      i = (toks[-1] == "-") ? parent.size : strict_index(toks[-1], parent.size, insert: true)
+      parent.insert(i, value)
+    else
+      raise RefFail
+    end
+  end
+
+  def ref_replace(box, toks, value)
+    return box[0] = value if toks.empty?
+    parent = ref_resolve(box[0], toks[0..-2])
+    case parent
+    when Hash
+      raise RefFail unless parent.key?(toks[-1])
+      parent[toks[-1]] = value
+    when Array
+      parent[strict_index(toks[-1], parent.size)] = value
+    else
+      raise RefFail
+    end
+  end
+
+  def ref_remove(box, toks)
+    raise RefFail if toks.empty?
+    parent = ref_resolve(box[0], toks[0..-2])
+    case parent
+    when Hash
+      raise RefFail unless parent.key?(toks[-1])
+      parent.delete(toks[-1])
+    when Array
+      parent.delete_at(strict_index(toks[-1], parent.size))
+    else
+      raise RefFail
+    end
+  end
+
+  def fetch_value(op)
+    raise RefFail unless op.key?("value")
+    op["value"]
+  end
+
+  def deep_dup(v)
+    case v
+    when Hash then v.transform_values { |e| deep_dup(e) }
+    when Array then v.map { |e| deep_dup(e) }
+    else v
+    end
+  end
+
+  def deep_valid_encoding?(v)
+    case v
+    when String then v.valid_encoding?
+    when Array then v.all? { |e| deep_valid_encoding?(e) }
+    when Hash then v.all? { |k, e| deep_valid_encoding?(k) && deep_valid_encoding?(e) }
+    else true
+    end
+  end
+
+  def count_keys(v)
+    case v
+    when Hash then v.size + v.sum { |_, e| count_keys(e) }
+    when Array then v.sum { |e| count_keys(e) }
+    else 0
+    end
+  end
+end

data/ext/nosj/src/gen/opts.rs

@@ -14,7 +14,7 @@ pub(crate) struct GenConfig {
     /// 0 = unlimited.
     pub(super) max_nesting: usize,
     pub(super) start_depth: usize,
-    pub(super) allow_nan: bool,
+    pub(crate) allow_nan: bool,
     pub(super) strict: bool,
     /// ActiveSupport walk semantics: non-native values recurse through
     /// as_json instead of splicing to_json, and non-finite floats emit

data/ext/nosj/src/parse.rs

@@ -147,6 +147,11 @@ fn finish_drive(
             ruby,
             "source sequence is illegal/malformed utf-8".into(),
         )),
+        // Also reformat-pipe-only, kept total for the same reason.
+        Err(nosj::DriveError::Sink(SinkAbort::NonFiniteFloat(spelling))) => Err(parser_error(
+            ruby,
+            format!("{spelling} not allowed in JSON"),
+        )),
         Err(nosj::DriveError::Parse(e)) => Err(parser_error_at(
             ruby,
             source,

data/ext/nosj/src/reformat.rs

@@ -44,6 +44,9 @@ struct PipeSink<'a> {
     max_nesting: usize,
     /// For re-escaping WTF-8 string content (see [`quote_wtf8`]).
     mode: EscapeMode,
+    /// Non-finite floats pass through as literals only when the
+    /// generate side allows them; see [`PipeSink::float`].
+    allow_nan: bool,
 }
 
 const HEX_DIGITS: &[u8; 16] = b"0123456789abcdef";
@@ -127,17 +130,28 @@ impl nosj::Sink for PipeSink<'_> {
     fn float(&mut self, value: f64) -> Result<(), SinkAbort> {
         if value.is_finite() {
             self.w.float(value);
+            return Ok(());
+        }
+        let spelling = if value.is_nan() {
+            "NaN"
+        } else if value > 0.0 {
+            "Infinity"
         } else {
-            // Reached only when the parse accepted them (allow_nan);
-            // the gem's literals go straight through.
-            self.w.value_raw(if value.is_nan() {
-                b"NaN"
-            } else if value > 0.0 {
-                b"Infinity"
-            } else {
-                b"-Infinity"
-            });
+            "-Infinity"
+        };
+        // Not just the allow_nan keywords: a huge-exponent literal
+        // (1e999) parses to Infinity in strict mode too, and generate
+        // refuses to emit it. Gem parity either way. The parser only
+        // delivers the f64, never the original digits, so passing the
+        // source spelling through is not an option. One asymmetry
+        // follows: the pipe streams duplicate-key entries that
+        // parse's last-key-wins would discard, so a document with an
+        // overflowing literal shadowed by a duplicate key raises here
+        // even though generate(parse(x)) would succeed.
+        if !self.allow_nan {
+            return Err(SinkAbort::NonFiniteFloat(spelling));
         }
+        self.w.value_raw(spelling.as_bytes());
         Ok(())
     }
 
@@ -238,6 +252,7 @@ fn reformat_over(ruby: &Ruby, input: &[u8], opts: Value) -> Result<RString, Erro
             depth: 0,
             max_nesting: po.max_nesting,
             mode: gcfg.mode,
+            allow_nan: gcfg.allow_nan,
         };
         let result = PULL_STATE.with(|state_cell| {
             let mut state = state_cell.borrow_mut();
@@ -259,6 +274,10 @@ fn reformat_over(ruby: &Ruby, input: &[u8], opts: Value) -> Result<RString, Erro
                 nosj_exception(ruby, "GeneratorError"),
                 "source sequence is illegal/malformed utf-8",
             )),
+            Err(nosj::DriveError::Sink(SinkAbort::NonFiniteFloat(spelling))) => Err(Error::new(
+                nosj_exception(ruby, "GeneratorError"),
+                format!("{spelling} not allowed in JSON"),
+            )),
             Err(nosj::DriveError::Sink(_)) => {
                 Err(parser_error(ruby, "reformat pass aborted".into()))
             }

data/ext/nosj/src/sink.rs

@@ -28,6 +28,11 @@ pub(crate) enum SinkAbort {
     /// equivalent broken-coderange string. (String VALUES re-escape
     /// as \uXXXX instead.)
     BrokenUtf8Output,
+    /// The reformat pipe met a non-finite float without `allow_nan`.
+    /// Parsing accepts huge-exponent literals like 1e999 as Infinity
+    /// even in strict mode (gem parity), but generation refuses them;
+    /// carries the JSON spelling for the gem-exact error message.
+    NonFiniteFloat(&'static str),
 }
 
 /// `RB_INT2FIX` ported from Ruby's public inline headers: fixnums are

data/lib/nosj/version.rb

@@ -2,5 +2,5 @@
 
 module NOSJ
   # The gem version.
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: nosj
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Yaroslav Markin
@@ -46,6 +46,12 @@ files:
 - README.md
 - ext/nosj/Cargo.toml
 - ext/nosj/extconf.rb
+- ext/nosj/fuzz/Cargo.toml
+- ext/nosj/fuzz/fuzz_targets/lines.rs
+- ext/nosj/fuzz/fuzz_targets/patch.rs
+- ext/nosj/fuzz/fuzz_targets/reformat.rs
+- ext/nosj/fuzz/src/lib.rs
+- ext/nosj/fuzz/src/prelude.rb
 - ext/nosj/src/errors.rs
 - ext/nosj/src/files.rs
 - ext/nosj/src/gen/errors.rs