json: reject overflowing quoted float values

.changes/unreleased/fixed-20260901-014638.yaml

@@ -0,0 +1,3 @@
+kind: Fixed
+body: '**ProtoJSON float fields now reject finite quoted values that overflow `f32` instead of silently decoding to infinity.**'
+time: 2026-09-01T01:46:38.536387+02:00

buffa/src/json_helpers.rs

@@ -1217,12 +1217,22 @@ pub mod float {
                     "NaN" => Ok(f32::NAN),
                     "Infinity" => Ok(f32::INFINITY),
                     "-Infinity" => Ok(f32::NEG_INFINITY),
-                    _ => v.parse::<f32>().map_err(|_| {
-                        E::invalid_value(
-                            serde::de::Unexpected::Str(v),
-                            &r#"a float, or "NaN", "Infinity", "-Infinity""#,
-                        )
-                    }),
+                    _ => {
+                        let value = v.parse::<f64>().map_err(|_| {
+                            E::invalid_value(
+                                serde::de::Unexpected::Str(v),
+                                &r#"a float, or "NaN", "Infinity", "-Infinity""#,
+                            )
+                        })?;
+                        let value_f32 = value as f32;
+                        if value.is_finite() && !value_f32.is_finite() {
+                            return Err(E::invalid_value(
+                                serde::de::Unexpected::Str(v),
+                                &"a finite f32 value",
+                            ));
+                        }
+                        Ok(value_f32)
+                    }
                 }
             }
 

buffa/src/json_helpers/tests.rs

@@ -389,6 +389,27 @@ fn float_deserializes_neg_infinity_string() {
     assert_eq!(val.0, f32::NEG_INFINITY);
 }
 
+#[test]
+fn float_rejects_quoted_finite_overflow() {
+    for json in [r#""3.5e38""#, r#""-3.5e38""#] {
+        assert!(
+            serde_json::from_str::<SerdeFloat>(json).is_err(),
+            "quoted finite overflow should be rejected: {json}"
+        );
+    }
+}
+
+#[test]
+fn float_accepts_quoted_values_near_f32_limit() {
+    for (json, expected) in [
+        (r#""3.4028235e38""#, f32::MAX),
+        (r#""-3.4028235e38""#, -f32::MAX),
+    ] {
+        let val: SerdeFloat = serde_json::from_str(json).unwrap();
+        assert_eq!(val.0, expected, "quoted boundary value: {json}");
+    }
+}
+
 // ── double ──────────────────────────────────────────────────────────────
 
 #[test]