fix array index overflow in set_at_pointer

include/boost/json/impl/pointer.ipp

@@ -455,6 +455,12 @@ value::set_at_pointer(
                 if( n >= opts.max_created_elements )
                     return nullptr;
 
+                // arr.size() + n + 1 equals index + 1; reject the value that
+                // would wrap so the resize count and the returned pointer stay
+                // in bounds
+                if( index == std::size_t(-1) )
+                    return nullptr;
+
                 arr.resize( arr.size() + n + 1 );
             }
 

test/pointer.cpp

@@ -312,6 +312,26 @@ class pointer_test
         BOOST_TEST( *result == 0 );
         BOOST_TEST( result == &jv.at_pointer("/4") );
 
+        // an index equal to std::size_t(-1) makes the element count index + 1
+        // wrap to zero; the array must not be resized and no pointer past its
+        // end may be returned
+        opts = {};
+        opts.max_created_elements = std::size_t(-1);
+        jv = array{0};
+        {
+            std::string const ptr =
+                "/" + std::to_string(std::size_t(-1));
+            BOOST_TEST_THROWS_WITH_LOCATION( jv.set_at_pointer(ptr, 1, opts) );
+            BOOST_TEST(( jv == array{0} ));
+
+            system::error_code ec;
+            result = jv.set_at_pointer(ptr, 1, ec, opts);
+            BOOST_TEST( !result );
+            BOOST_TEST( ec == error::not_found );
+            BOOST_TEST( hasLocation(ec) );
+            BOOST_TEST(( jv == array{0} ));
+        }
+
         opts = {};
         opts.create_arrays = false;
         opts.create_objects = false;