json 2.10.1 → 2.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc08bd5e3c83c4e731d37e18b5a32f9bf0049d896c483f1beb96af96f2daad18
-  data.tar.gz: ff215943fdccc5a5ed3f7390719aa5c43a18664e19f86d94226ff14c154cc354
+  metadata.gz: b909ed90787afa31835c9926529808ca3c6b161755e1f6126b7fe203231fa0c2
+  data.tar.gz: efd6a873e98f9e4b2b8c078210f141dfde5f3773884bd5851f228c184ff94ff7
 SHA512:
-  metadata.gz: e3bc85653be385e76842fa3f69671fccdc4235a32806f554cf8ec4a9ad697996be97d3aef52823b3c1f8839e1cd9a7893ab87360ca76d59b4ff704c75fcb655e
-  data.tar.gz: f2f09188afd38972e15e1c80c2c8c4efd14aee954d18ff83d4a6a993bd0f9d9c84362232c17abbc9bf3ffdfce062c79c75a6fccf124bdbd3345a202b76d50a26
+  metadata.gz: bff39363d5d7fa2f209d5bf97a5728738058bc83600b732d95487e263a5a3901b1e18d5c42d7d2be019ac55ef069a50cedc1d9a8d22b11e6061f2eef747dc94d
+  data.tar.gz: 693e480f8f2489e26c43eef56ad8977ab3f00fada03318a48b88ac55e2b82b15ffae92fd05dd47d86686fae39169b079f59a68fffc6efaf44ee3503a45060e30

data/CHANGES.md

@@ -1,5 +1,11 @@
 # Changes
 
+### 2025-03-12 (2.10.2)
+
+* Fix a potential crash in the C extension parser.
+* Raise a ParserError on all incomplete unicode escape sequence. This was the behavior until `2.10.0` unadvertently changed it.
+* Ensure document snippets that are included in parser errors don't include truncated multibyte characters.
+
 ### 2025-02-10 (2.10.1)
 
 * Fix a compatibility issue with `MultiJson.dump(obj, pretty: true)`: `no implicit conversion of false into Proc (TypeError)`.

data/ext/json/ext/parser/parser.c

@@ -341,6 +341,44 @@ static void rvalue_stack_eagerly_release(VALUE handle)
     }
 }
 
+
+#ifndef HAVE_STRNLEN
+static size_t strnlen(const char *s, size_t maxlen)
+{
+    char *p;
+    return ((p = memchr(s, '\0', maxlen)) ? p - s : maxlen);
+}
+#endif
+
+#define PARSE_ERROR_FRAGMENT_LEN 32
+#ifdef RBIMPL_ATTR_NORETURN
+RBIMPL_ATTR_NORETURN()
+#endif
+static void raise_parse_error(const char *format, const char *start)
+{
+    unsigned char buffer[PARSE_ERROR_FRAGMENT_LEN + 1];
+
+    size_t len = start ? strnlen(start, PARSE_ERROR_FRAGMENT_LEN) : 0;
+    const char *ptr = start;
+
+    if (len == PARSE_ERROR_FRAGMENT_LEN) {
+        MEMCPY(buffer, start, char, PARSE_ERROR_FRAGMENT_LEN);
+
+        while (buffer[len - 1] >= 0x80 && buffer[len - 1] < 0xC0) { // Is continuation byte
+            len--;
+        }
+
+        if (buffer[len - 1] >= 0xC0) { // multibyte character start
+            len--;
+        }
+
+        buffer[len] = '\0';
+        ptr = (const char *)buffer;
+    }
+
+    rb_enc_raise(enc_utf8, rb_path2class("JSON::ParserError"), format, ptr);
+}
+
 /* unicode */
 
 static const signed char digit_values[256] = {
@@ -362,21 +400,19 @@ static const signed char digit_values[256] = {
 
 static uint32_t unescape_unicode(const unsigned char *p)
 {
-    const uint32_t replacement_char = 0xFFFD;
-
     signed char b;
     uint32_t result = 0;
     b = digit_values[p[0]];
-    if (b < 0) return replacement_char;
+    if (b < 0) raise_parse_error("incomplete unicode character escape sequence at '%s'", (char *)p - 2);
     result = (result << 4) | (unsigned char)b;
     b = digit_values[p[1]];
-    if (b < 0) return replacement_char;
+    if (b < 0) raise_parse_error("incomplete unicode character escape sequence at '%s'", (char *)p - 2);
     result = (result << 4) | (unsigned char)b;
     b = digit_values[p[2]];
-    if (b < 0) return replacement_char;
+    if (b < 0) raise_parse_error("incomplete unicode character escape sequence at '%s'", (char *)p - 2);
     result = (result << 4) | (unsigned char)b;
     b = digit_values[p[3]];
-    if (b < 0) return replacement_char;
+    if (b < 0) raise_parse_error("incomplete unicode character escape sequence at '%s'", (char *)p - 2);
     result = (result << 4) | (unsigned char)b;
     return result;
 }
@@ -440,34 +476,6 @@ typedef struct JSON_ParserStateStruct {
 
 static const rb_data_type_t JSON_ParserConfig_type;
 
-#ifndef HAVE_STRNLEN
-static size_t strnlen(const char *s, size_t maxlen)
-{
-    char *p;
-    return ((p = memchr(s, '\0', maxlen)) ? p - s : maxlen);
-}
-#endif
-
-#define PARSE_ERROR_FRAGMENT_LEN 32
-#ifdef RBIMPL_ATTR_NORETURN
-RBIMPL_ATTR_NORETURN()
-#endif
-static void raise_parse_error(const char *format, const char *start)
-{
-    char buffer[PARSE_ERROR_FRAGMENT_LEN + 1];
-
-    size_t len = start ? strnlen(start, PARSE_ERROR_FRAGMENT_LEN) : 0;
-    const char *ptr = start;
-
-    if (len == PARSE_ERROR_FRAGMENT_LEN) {
-        MEMCPY(buffer, start, char, PARSE_ERROR_FRAGMENT_LEN);
-        buffer[PARSE_ERROR_FRAGMENT_LEN] = '\0';
-        ptr = buffer;
-    }
-
-    rb_enc_raise(enc_utf8, rb_path2class("JSON::ParserError"), format, ptr);
-}
-
 static const bool whitespace[256] = {
     [' '] = 1,
     ['\t'] = 1,
@@ -600,7 +608,7 @@ static VALUE json_string_unescape(JSON_ParserState *state, const char *string, c
     buffer = RSTRING_PTR(result);
     bufferStart = buffer;
 
-    while ((pe = memchr(pe, '\\', stringEnd - pe))) {
+    while (pe < stringEnd && (pe = memchr(pe, '\\', stringEnd - pe))) {
         unescape = (char *) "?";
         unescape_len = 1;
         if (pe > p) {

data/lib/json/common.rb

@@ -152,10 +152,13 @@ module JSON
     end
 
     def detailed_message(...)
+      # Exception#detailed_message doesn't exist until Ruby 3.2
+      super_message = defined?(super) ? super : message
+
       if @invalid_object.nil?
-        super
+        super_message
       else
-        "#{super}\nInvalid object: #{@invalid_object.inspect}"
+        "#{super_message}\nInvalid object: #{@invalid_object.inspect}"
       end
     end
   end
@@ -840,7 +843,7 @@ module JSON
 
     opts = JSON.dump_default_options
     opts = opts.merge(:max_nesting => limit) if limit
-    opts = merge_dump_options(opts, **kwargs) if kwargs
+    opts = opts.merge(kwargs) if kwargs
 
     begin
       State.generate(obj, opts, anIO)
@@ -854,15 +857,6 @@ module JSON
     string.encode(to, from)
   end
 
-  def merge_dump_options(opts, strict: NOT_SET)
-    opts = opts.merge(strict: strict) if NOT_SET != strict
-    opts
-  end
-
-  class << self
-    private :merge_dump_options
-  end
-
   # JSON::Coder holds a parser and generator configuration.
   #
   #   module MyApp

data/lib/json/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSON
-  VERSION = '2.10.1'
+  VERSION = '2.10.2'
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: json
 version: !ruby/object:Gem::Version
-  version: 2.10.1
+  version: 2.10.2
 platform: ruby
 authors:
 - Florian Frank
 bindir: bin
 cert_chain: []
-date: 2025-02-10 00:00:00.000000000 Z
+date: 2025-03-12 00:00:00.000000000 Z
 dependencies: []
 description: This is a JSON implementation as a Ruby extension in C.
 email: flori@ping.de