Merge branch '2.21' into 2.x

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -14,6 +14,11 @@ a pure JSON library.
 === Releases ===
 ------------------------------------------------------------------------
 
+2.21.1 (not yet released)
+
+#1548: `StreamReadConstraints.maxDocumentLength` not checked when
+  creating parser with fixed buffer
+
 2.21.0 (18-Jan-2026)
 
 #363: UTF-8 decoding should fail on Surrogate characters (0xD800 - 0xDFFF)

src/main/java/com/fasterxml/jackson/core/JsonFactory.java

@@ -1944,6 +1944,8 @@ protected JsonParser _createParser(Reader r, IOContext ctxt) throws IOException
      */
     protected JsonParser _createParser(char[] data, int offset, int len, IOContext ctxt,
             boolean recyclable) throws IOException {
+        // [core#1548] Validate doc length upfront for fixed buffers
+        _streamReadConstraints.validateDocumentLength(len);
         return new ReaderBasedJsonParser(ctxt, _parserFeatures, null, _objectCodec,
                 _rootCharSymbols.makeChild(),
                         data, offset, offset+len, recyclable);
@@ -1971,6 +1973,8 @@ protected JsonParser _createParser(char[] data, int offset, int len, IOContext c
      */
     protected JsonParser _createParser(byte[] data, int offset, int len, IOContext ctxt) throws IOException
     {
+        // [core#1548] Validate doc length upfront for fixed buffers
+        _streamReadConstraints.validateDocumentLength(len);
         return new ByteSourceJsonBootstrapper(ctxt, data, offset, len).constructParser(_parserFeatures,
                 _objectCodec, _byteSymbolCanonicalizer, _rootCharSymbols, _factoryFeatures);
     }

src/test/java/com/fasterxml/jackson/core/constraints/LargeDocReadTest.java

@@ -52,6 +52,13 @@ void largeNameWithSmallLimitBytes() throws Exception
         } catch (StreamConstraintsException e) {
             verifyMaxDocLen(JSON_F_DOC_10K, e);
         }
+        // [core#1548] validate for fixed buffer too
+        try (JsonParser p = JSON_F_DOC_10K.createParser(utf8Bytes(doc))) {
+            consumeTokens(p);
+            fail("expected StreamConstraintsException");
+        } catch (StreamConstraintsException e) {
+            verifyMaxDocLen(JSON_F_DOC_10K, e);
+        }
     }
 
     @Test
@@ -64,6 +71,13 @@ void largeNameWithSmallLimitChars() throws Exception
         } catch (StreamConstraintsException e) {
             verifyMaxDocLen(JSON_F_DOC_10K, e);
         }
+        // [core#1548] validate for fixed buffer too
+        try (JsonParser p = JSON_F_DOC_10K.createParser(doc.toCharArray())) {
+            consumeTokens(p);
+            fail("expected StreamConstraintsException");
+        } catch (StreamConstraintsException e) {
+            verifyMaxDocLen(JSON_F_DOC_10K, e);
+        }
     }
 
     @Test