[yumasansansan]

json_validate() (php_json_validate_ex()) runs the same scanner and grammar as json_decode() with a separate set of parser methods that build no values, and was not covered by any fuzzer. For JSON_OBJECT_AS_ARRAY (with and without JSON_INVALID_UTF8_IGNORE), decoding fails exactly when validation fails, apart from running out of memory, which cannot happen in this fuzzer. Decoding to objects is excluded, as it additionally rejects property names starting with a NUL byte. The fuzzer now asserts that both agree.

The fuzzer keeps its depth of 10, which is lower than the default of 512, so that deeply nested inputs fail quickly and the depth limit is reached with small inputs. This is now documented in a comment.

Replaying the checked-in sapi/fuzzer/corpus/json (no fuzzing): edge coverage 1211 → 1252, and the assertion holds for every seed. The input format is unchanged.

[ndossche]

Some possibilities for the lower limit:

• Gain more exec/s by failing more quickly with deeply nested data
• Test depth limit edge case handling quicker

[yumasansansan]

Good points, I measured it. Time per input for the same input run 3000 times (ASan build):

Input	depth 10	depth 512
flat JSON	132 µs	131 µs
array nested 500 levels	76 µs	4955 µs
4000 times [	80 µs	704 µs

On the checked-in corpus, the higher depth only adds 5 edges (1252 → 1257), while json_validate() adds 41 (1211 → 1252). So I went back to a depth of 10, now with a comment explaining why, and json_validate() uses the same depth. I updated the title and the description.