From b67b3e2a5b2a6539ab3b705e74a6d22fbe5a43df Mon Sep 17 00:00:00 2001
From: nonradicals <129570627+NonRadical@users.noreply.github.com>
Date: Thu, 14 May 2026 16:25:56 -0400
Subject: [PATCH] Fixed integer parse bug around max int32 and uint32.

For a range of integers around max int32 and uint32, the current implementation can "miss" that the accumulated integer will overflow due to the evaluation of the potential overflow happening before the accumulation is done. Example values that experience this issue are 4,294,967,296 (max uint32 + 1) and 2,147,483,648 (max int32 + 1).
---
 include/rapidjson/reader.h | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/rapidjson/reader.h b/include/rapidjson/reader.h
index f7ef610244..1b3c05f5a7 100644
--- a/include/rapidjson/reader.h
+++ b/include/rapidjson/reader.h
@@ -1497,6 +1497,9 @@ class GenericReader {
 
             if (minus)
                 while (RAPIDJSON_LIKELY(s.Peek() >= '0' && s.Peek() <= '9')) {
+                    i = i * 10 + static_cast<unsigned>(s.TakePush() - '0');
+                    significandDigit++;
+                    
                     if (RAPIDJSON_UNLIKELY(i >= 214748364)) { // 2^31 = 2147483648
                         if (RAPIDJSON_LIKELY(i != 214748364 || s.Peek() > '8')) {
                             i64 = i;
@@ -1504,11 +1507,12 @@ class GenericReader {
                             break;
                         }
                     }
-                    i = i * 10 + static_cast<unsigned>(s.TakePush() - '0');
-                    significandDigit++;
                 }
             else
                 while (RAPIDJSON_LIKELY(s.Peek() >= '0' && s.Peek() <= '9')) {
+                    i = i * 10 + static_cast<unsigned>(s.TakePush() - '0');
+                    significandDigit++;
+                    
                     if (RAPIDJSON_UNLIKELY(i >= 429496729)) { // 2^32 - 1 = 4294967295
                         if (RAPIDJSON_LIKELY(i != 429496729 || s.Peek() > '5')) {
                             i64 = i;
@@ -1516,8 +1520,6 @@ class GenericReader {
                             break;
                         }
                     }
-                    i = i * 10 + static_cast<unsigned>(s.TakePush() - '0');
-                    significandDigit++;
                 }
         }
         // Parse NaN or Infinity here