stephenberry/glaze v6.5.1

on GitHub

Security Enhancements

BEVE/CBOR DoS Protection (#2194)

Binary formats like BEVE and CBOR encode length headers indicating how many elements follow. Previously, a malicious actor could craft a message claiming billions of elements but containing minimal data, causing memory exhaustion before validation.

Glaze now validates length headers against remaining buffer size before any memory allocation:

// Malicious buffer claiming 1 billion strings but containing only a few bytes
std::vector<std::string> result;
auto ec = glz::read_beve(result, malicious_buffer);
// ec.ec == glz::error_code::invalid_length
// No memory was allocated - attack prevented

Protection applies to strings, typed arrays, generic arrays, and maps/objects.

User-Configurable Allocation Limits (#2195)

New compile-time options for stricter memory control:

struct secure_opts : glz::opts
{
   uint32_t format = glz::BEVE;
   size_t max_string_length = 1024;    // Max 1KB per string
   size_t max_array_size = 10000;      // Max 10,000 elements per array
   size_t max_map_size = 1000;         // Max 1,000 entries per map
};

auto ec = glz::read<secure_opts{}>(obj, buffer);

New glz::max_length wrapper for per-field limits:

template <>
struct glz::meta<UserInput>
{
   using T = UserInput;
   static constexpr auto value = object(
      "username", glz::max_length<&T::username, 64>,  // Max 64 chars
      "scores", glz::max_length<&T::scores, 100>      // Max 100 elements
   );
};

See Security Documentation for best practices.

New Features

Bounded Buffer Overflow Detection (#2189)

Writing to fixed-size buffers (like std::array or std::span) now returns error_code::buffer_overflow instead of undefined behavior when capacity is exceeded:

std::array<char, 32> buffer{};
auto ec = glz::write_json(large_object, buffer);
if (ec.ec == glz::error_code::buffer_overflow) {
   // Handle insufficient buffer space
}

allocate_raw_pointers Option (#2196)

New compile-time option to allow allocating memory for null raw pointers during deserialization:

struct alloc_opts : glz::opts {
   bool allocate_raw_pointers = true;
};

std::vector<MyStruct*> vec;
auto ec = glz::read<alloc_opts{}>(vec, json);
// vec now contains allocated pointers - caller must delete them

By default, Glaze refuses to allocate raw pointers to prevent memory leaks. See Nullable Types for details.

Compatibility

iOS Support for Older Versions (#2197)

Added compatibility guards for std::to_chars/std::from_chars floating-point support, which is unavailable on iOS < 16.3. This affects only float128_t serialization; regular float and double types use Glaze's built-in implementation and work on all iOS versions.

Build

• Removed old Boost::system linkage (#2193)

Full Changelog: v6.5.0...v6.5.1