Merge branch '2.x' into 3.x

Author: cowtowncoder

release-notes/VERSION

@@ -15,6 +15,11 @@ JSON library.
 === Releases ===
 ------------------------------------------------------------------------
 
+3.1.0 (not yet released)
+
+#1548: `StreamReadConstraints.maxDocumentLength` not checked when
+  creating parser with fixed buffer
+
 3.1.0-rc1 (27-Jan-2026)
 
 #784: Optional leading plus sign not included in textual value of any

release-notes/VERSION-2.x

@@ -14,6 +14,11 @@ a pure JSON library.
 === Releases ===
 ------------------------------------------------------------------------
 
+2.21.1 (not yet released)
+
+#1548: `StreamReadConstraints.maxDocumentLength` not checked when
+  creating parser with fixed buffer
+
 2.21.0 (18-Jan-2026)
 
 #363: UTF-8 decoding should fail on Surrogate characters (0xD800 - 0xDFFF)

src/main/java/tools/jackson/core/json/JsonFactory.java

@@ -422,6 +422,8 @@ protected JsonParser _createParser(ObjectReadContext readCtxt, IOContext ioCtxt,
             boolean recyclable) throws JacksonException
     {
         _checkRangeBoundsForCharArray(data, offset, len);
+        // [core#1548] Validate doc length up front for fixed buffers
+        _streamReadConstraints.validateDocumentLength(len);
         return new ReaderBasedJsonParser(readCtxt, ioCtxt,
                 readCtxt.getStreamReadFeatures(_streamReadFeatures),
                 readCtxt.getFormatReadFeatures(_formatReadFeatures),
@@ -436,6 +438,8 @@ protected JsonParser _createParser(ObjectReadContext readCtxt, IOContext ioCtxt,
         throws JacksonException
     {
         _checkRangeBoundsForByteArray(data, offset, len);
+        // [core#1548] Validate doc length up front for fixed buffers
+        _streamReadConstraints.validateDocumentLength(len);
         return new ByteSourceJsonBootstrapper(ioCtxt, data, offset, len)
                 .constructParser(readCtxt,
                         readCtxt.getStreamReadFeatures(_streamReadFeatures),

src/test/java/tools/jackson/core/unittest/constraints/LargeDocReadTest.java

@@ -5,6 +5,7 @@
 import org.junit.jupiter.api.Test;
 
 import tools.jackson.core.JsonParser;
+import tools.jackson.core.ObjectReadContext;
 import tools.jackson.core.StreamReadConstraints;
 import tools.jackson.core.exc.StreamConstraintsException;
 import tools.jackson.core.json.JsonFactory;
@@ -54,6 +55,14 @@ void largeNameWithSmallLimitBytes() throws Exception
         } catch (StreamConstraintsException e) {
             verifyMaxDocLen(JSON_F_DOC_10K, e);
         }
+        // [core#1548] validate for fixed buffer too
+        try (JsonParser p = JSON_F_DOC_10K.createParser(ObjectReadContext.empty(),
+                utf8Bytes(doc))) {
+            consumeTokens(p);
+            fail("expected StreamConstraintsException");
+        } catch (StreamConstraintsException e) {
+            verifyMaxDocLen(JSON_F_DOC_10K, e);
+        }
     }
 
     @Test
@@ -66,6 +75,14 @@ void largeNameWithSmallLimitChars() throws Exception
         } catch (StreamConstraintsException e) {
             verifyMaxDocLen(JSON_F_DOC_10K, e);
         }
+        // [core#1548] validate for fixed buffer too
+        try (JsonParser p = JSON_F_DOC_10K.createParser(ObjectReadContext.empty(),
+                doc.toCharArray())) {
+            consumeTokens(p);
+            fail("expected StreamConstraintsException");
+        } catch (StreamConstraintsException e) {
+            verifyMaxDocLen(JSON_F_DOC_10K, e);
+        }
     }
 
     @Test