From 48fa92ffa96be1a47e2960dba1d0d916c7bd892d Mon Sep 17 00:00:00 2001
From: Niels Lohmann <mail@nlohmann.me>
Date: Sun, 1 Nov 2026 08:38:15 +0100
Subject: [PATCH] json_view: copy the frame in value_path instead of holding a
 reference

The reference into the frame stack was only used before pop_back() and
push_back(), but a later change could read it after them. Copy the frame and
advance it through stack.back(), as the other stack walks do.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>
---
 include/nlohmann/detail/view/errors.hpp | 8 ++++----
 single_include/nlohmann/json_view.hpp   | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/include/nlohmann/detail/view/errors.hpp b/include/nlohmann/detail/view/errors.hpp
index 597073e1a..2fb051774 100644
--- a/include/nlohmann/detail/view/errors.hpp
+++ b/include/nlohmann/detail/view/errors.hpp
@@ -115,8 +115,8 @@ bool value_path(const document_data& d, const node* target, std::vector<std::str
     // (tokens[i] leads from stack[i] to stack[i + 1], or to the target)
     for (;;)
     {
-        // (f is not used after the stack changes: pop_back() below, push_back() at the end)
-        frame& f = stack.back();
+        // a copy: pop_back() and push_back() below change the stack
+        const frame f = stack.back();
         if (f.pos == f.end)
         {
             stack.pop_back();
@@ -150,8 +150,8 @@ bool value_path(const document_data& d, const node* target, std::vector<std::str
             tokens.push_back(token);
             return true;
         }
-        f.pos = document_data::after(entry);
-        ++f.index;
+        stack.back().pos = document_data::after(entry);
+        ++stack.back().index;
         if (is_container(*child) && (nav::editable() || (target > child && target < child + child->next)))
         {
             tokens.push_back(token);
diff --git a/single_include/nlohmann/json_view.hpp b/single_include/nlohmann/json_view.hpp
index 4cfe38d6f..0c4ca4aa2 100644
--- a/single_include/nlohmann/json_view.hpp
+++ b/single_include/nlohmann/json_view.hpp
@@ -4621,8 +4621,8 @@ bool value_path(const document_data& d, const node* target, std::vector<std::str
     // (tokens[i] leads from stack[i] to stack[i + 1], or to the target)
     for (;;)
     {
-        // (f is not used after the stack changes: pop_back() below, push_back() at the end)
-        frame& f = stack.back();
+        // a copy: pop_back() and push_back() below change the stack
+        const frame f = stack.back();
         if (f.pos == f.end)
         {
             stack.pop_back();
@@ -4656,8 +4656,8 @@ bool value_path(const document_data& d, const node* target, std::vector<std::str
             tokens.push_back(token);
             return true;
         }
-        f.pos = document_data::after(entry);
-        ++f.index;
+        stack.back().pos = document_data::after(entry);
+        ++stack.back().index;
         if (is_container(*child) && (nav::editable() || (target > child && target < child + child->next)))
         {
             tokens.push_back(token);