json 2.21.0 → 2.21.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 778c5ab5faa1a727c1c453ef34351537fd77dbb9a2f176abc15f6861391baab9
-  data.tar.gz: 37f10916f3608596b4665564f61ee872bd647617048c0d593a4d2c917acc87df
+  metadata.gz: ea6afdf75f49e474e408c24daae4856891310979fbb10aa34ead66ad2fbf3321
+  data.tar.gz: 19eb129df23cde0ac607fa6ddf909d6ea5eaef0035b2180eea4c2c8a7a5c5ff0
 SHA512:
-  metadata.gz: 36af0bdf70e46b374bb7d0ad209e946fffa367f2316a279249295aff233c4b187d69fa65753db29ffb20639e828896fd18e33e6060ecb0908f3a85b170c53443
-  data.tar.gz: d148e9ef5ea0b428a562d422acb9357c8a061dada945eacb37b2c97e10c9c050253624881b16a4de547a7705011493db83a442afe230b828f9935a522c86c08d
+  metadata.gz: c2212cdac41569ebd41e83e6d1ea3324e944f6a8db0070a2805f2213da7341a05cc8eab4dc6d77852f30d31a8951f36d435fdb0aff647776eb8f42cee25113ef
+  data.tar.gz: b16fdb8a1f5384aa6e9064c7884c0f7ec96632bc2c1c6324cc2e902459e9ac94559ec691cf45dea30fc374fab74ce4e3a82f8bb9d0ec22e0ddd5357764076942

data/CHANGES.md

@@ -2,6 +2,14 @@
 
 ### Unreleased
 
+### 2026-07-31 (2.21.2)
+
+* Fix a use-after-free bug in `JSON::ResumableParser`. [GHSA-9hj4-r449-hfvc].
+
+### 2026-07-13 (2.21.1)
+
+* Fix a compilation issue on Window and Microsoft Visual C++.
+
 ### 2026-07-12 (2.21.0)
 
 * `JSON.generate` now accept a `sort_keys` option, which takes either a boolean or a block.

data/ext/json/ext/parser/extconf.rb

@@ -15,22 +15,6 @@ have_func("rb_hash_new_capa", "ruby.h") # RUBY_VERSION >= 3.2
 have_func("rb_hash_bulk_insert", "ruby.h") # Missing on TruffleRuby
 have_func("ruby_xfree_sized", "ruby.h") # RUBY_VERSION >= 4.1
 
-def have_builtin_func(name, check_expr, opt = "", &b)
-  checking_for checking_message(name.funcall_style, nil, opt) do
-    if try_compile(<<SRC, opt, &b)
-int foo;
-int main() { #{check_expr}; return 0; }
-SRC
-      $defs.push(format("-DHAVE_BUILTIN_%s", name.tr_cpp))
-      true
-    else
-      false
-    end
-  end
-end
-
-have_builtin_func("__builtin_clzll", "__builtin_clzll(0)")
-
 if have_header("x86intrin.h")
   have_func("_lzcnt_u64", "x86intrin.h")
 end
@@ -46,6 +30,12 @@ end
 
 append_cflags("-std=c99")
 
+# Disable function outlining on clang to prevent some of the repeated instructions
+# in json_eat_whitespace being outlined into function calls.
+# Note: This verifies '-mno-outline' is accepted as a valid compiler flag
+# and will not pass it if unsupported.
+append_cflags("-mno-outline")
+
 if enable_config('parser-use-simd', default=!ENV["JSON_DISABLE_SIMD"])
   load __dir__ + "/../simd/conf.rb"
 end

data/ext/json/ext/parser/parser.c

@@ -589,6 +589,8 @@ static inline char peek(JSON_ParserState *state)
 
 static void cursor_position(JSON_ParserState *state, long *line_out, long *column_out)
 {
+    JSON_ASSERT(!state->parser);
+    JSON_ASSERT(state->cursor);
     JSON_ASSERT(state->cursor <= state->end);
 
     // Redundant but helpful for hardening
@@ -621,10 +623,14 @@ static const unsigned int MAX_DEPRECATIONS = 5;
 
 static void emit_parse_warning(const char *message, JSON_ParserState *state)
 {
-    long line, column;
-    cursor_position(state, &line, &column);
-
-    VALUE warning = rb_sprintf("%s at line %ld column %ld", message, line, column);
+    VALUE warning;
+    if (state->parser) { // line and columns can't be accurate in resumable
+        warning = rb_utf8_str_new_cstr(message);
+    } else {
+        long line, column;
+        cursor_position(state, &line, &column);
+        warning = rb_sprintf("%s at line %ld column %ld", message, line, column);
+    }
     rb_funcall(mJSON, rb_intern("deprecation_warning"), 1, warning);
 }
 
@@ -2566,6 +2572,7 @@ static VALUE cResumableParser_parse(VALUE self)
     if (eos(&parser->state)) {
         json_str_clear(parser->buffer);
         parser->buffer = Qfalse;
+        parser->state.start = parser->state.cursor = parser->state.end = 0;
     }
     parser->in_use = false;
 

data/lib/json/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSON
-  VERSION = '2.21.0'
+  VERSION = '2.21.2'
 end

data/lib/json.rb

@@ -121,9 +121,11 @@ require 'json/common'
 # ====== Input Options
 #
 # Option +max_nesting+ (\Integer) specifies the maximum nesting depth allowed;
-# defaults to +100+; specify +false+ to disable depth checking.
+# defaults to +100+;
+# You can set it to +false+ to disable depth checking entirely, but that is dangerous
+# when parsing untrusted input.
 #
-# With the default, +false+:
+# With the default, +100+:
 #   source = '[0, [1, [2, [3]]]]'
 #   ruby = JSON.parse(source)
 #   ruby # => [0, [1, [2, [3]]]]
@@ -384,6 +386,15 @@ require 'json/common'
 #   # Raises JSON::NestingError (nesting of 2 is too deep):
 #   JSON.generate(obj, max_nesting: 2)
 #
+# With +false+:
+#   obj = []
+#   obj[0] = obj
+#   # Raises  SystemStackError: stack level too deep
+#   JSON.generate(obj, max_nesting: false)
+#
+# Setting +max_nesting+ to +false+ can lead to a stackoverflow and may leave the program
+# in an unrecoverable state. It is discouraged.
+#
 # ====== Escaping Options
 #
 # Options +script_safe+ (boolean) specifies wether <tt>'\u2028'</tt>, <tt>'\u2029'</tt>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: json
 version: !ruby/object:Gem::Version
-  version: 2.21.0
+  version: 2.21.2
 platform: ruby
 authors:
 - Florian Frank
@@ -84,7 +84,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.12
+rubygems_version: 4.0.16
 specification_version: 4
 summary: JSON Implementation for Ruby
 test_files: []