ohler55/oj v3.17.5

on GitHub

What's Changed

Most of this release comes out of a security review of the C extension. There are no API changes.

Memory safety

• Fix hash flooding by seeding the key hash per process by @Watson1978 in #1053
• Fix a one byte buffer over-read on a trailing backslash by @Watson1978 in #1054
• Fix two length underflows that cause an unbounded buffer over-read by @Watson1978 in #1055
• Fix a SEGV from type confusion in class path resolution by @Watson1978 in #1056
• Fix uninitialized stack memory leaking into the class name error by @Watson1978 in #1057
• Fix output buffer overflows when writing indentation by @Watson1978 in #1058
• Fix doc path limit by @ohler55 in #1061
• Fix the use-after-free of a key when the value stack grows by @Watson1978 in #1062
• Fix the buffer over-read when a document ends where a key belongs by @Watson1978 in #1063
• Fix the id from a circular reference being used unchecked by @Watson1978 in #1064
• Fix the SEGV dumping an exception that was never raised by @Watson1978 in #1068
• Fix the stack buffer overflow writing the error location by @Watson1978 in #1071
• Fix the read error in Oj::Parser#file being taken as a huge read by @Watson1978 in #1072
• Fix the truncated float format copying stack bytes into the output by @Watson1978 in #1073
• Fix the double free of the default create_id when a call passes nil by @Watson1978 in #1074
• Fix the buffer over-read of an odd attribute name and the leak of its args by @Watson1978 in #1075
• Fix the SEGV reading a truncated document with Oj::Parser#file and the descriptor it leaks by @Watson1978 in #1076
• Fix the SEGV from a malformed number in Oj::Doc by @Watson1978 in #1077
• Fix the stack overflow from a long key with :only or :except by @Watson1978 in #1078
• Fix the odd module match being decided by uninitialized memory by @Watson1978 in #1079
• Fix :float_format taking directives it has no argument for by @Watson1978 in #1083

Memory leaks

• Fix the leak of an escaped hash key in the streaming parser by @Watson1978 in #1067
• Fix memory leak of the parser create_id when it is set again by @Watson1978 in #1085
• Fix memory leak of the parser when Oj::Parser.new or .safe raises by @Watson1978 in #1086

Parsing and dumping

• Fix a safe parser limit of 4 being ignored by @Watson1978 in #1065
• Fix the exponent bound being checked after it is narrowed by @Watson1978 in #1066
• Fix a long first token being rejected and the grown reader buffer leaking by @Watson1978 in #1069
• Fix the safe parser limits being dropped when an option is set by @Watson1978 in #1070
• Fix the custom mode dump of an unraised exception opening with "{," by @Watson1978 in #1082
• Fix the wab mode time load being an offset out on Windows by @Watson1978 in #1088
• Fix Oj::Doc dropping the exponent of a number with no decimal point by @Watson1978 in #1089

Rails

• Fix Rails to_json(only:/except:) dropping the include_root wrapper (#1020) and methods: keys (#1008) by @Watson1978 in #1039
• Pass the as_json options to every element of a container (#1008) by @Watson1978 in #1040
• Share the global rails state with an encoder instead of copying it per encoder by @Watson1978 in #1049
• Hand as_json a copy of the options instead of the encoder's own hash by @Watson1978 in #1050

Documentation

• Rename the documented :skip_null_byte option to :omit_null_byte by @Watson1978 in #1041
• Update InstallOptions doc: SIMD is auto-detected, drop --with-sse42 by @Watson1978 in #1042
• Fix the documented minimum Ruby version (2.4+ -> 2.7+) by @Watson1978 in #1043
• Fix Parser.md benchmark conclusions to reference :usual, not :saj by @Watson1978 in #1044
• Fix docs that called :custom the default mode by @Watson1978 in #1045
• Fix the documented type of the :safe option (String -> Boolean) by @Watson1978 in #1046
• Fix the claim that no methods are called on a loaded Object by @Watson1978 in #1080
• Fix the 3.17.5 changelog entry saying only "Fixed multiple issues" by @Watson1978 in #1091

Tests and CI

• Add the ActiveSupport 8 test suite so the rails_8 CI job runs it by @Watson1978 in #1047
• Add the ActiveSupport 8.1 test suite and guard the #985 regression by @Watson1978 in #1051
• Fix rake never running the test/test_*.rb suite by @Watson1978 in #1084
• Add a job timeout to the workflows by @Watson1978 in #1087
• Fix the pre-1970 time tests being skipped on Windows for a limit that no longer applies by @Watson1978 in #1090
• Fix the SyntaxError in test_object.rb that fails every CI job by @Watson1978 in #1060

Full Changelog: v3.17.4...v3.17.5