json 2.21.1 → 2.21.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd45f22d143e0edbca7ee9ba8209d10fd58f1b21f5e095d7a4c2938d12ea1041
-  data.tar.gz: 7104d723fe198b21508897a5583fcb513407595df0fdb0240c0343481cac7e06
+  metadata.gz: ea6afdf75f49e474e408c24daae4856891310979fbb10aa34ead66ad2fbf3321
+  data.tar.gz: 19eb129df23cde0ac607fa6ddf909d6ea5eaef0035b2180eea4c2c8a7a5c5ff0
 SHA512:
-  metadata.gz: 554e73a89035e122a9643ecdd611ca893dbcfee74d86b9dd1ed8ea1fb2d0ddfc84416458efeff5b71925922e8e59c1c60aa90a172a411c6a33e3069a41e328d5
-  data.tar.gz: 4746639e1e86fff01e23ecbc036bae1410e6e944687ad576daf297f4d50f792334d0bef5a2864b0f2fe7e32495d7c205be2b666c811985f7168d0c2c8b1892f8
+  metadata.gz: c2212cdac41569ebd41e83e6d1ea3324e944f6a8db0070a2805f2213da7341a05cc8eab4dc6d77852f30d31a8951f36d435fdb0aff647776eb8f42cee25113ef
+  data.tar.gz: b16fdb8a1f5384aa6e9064c7884c0f7ec96632bc2c1c6324cc2e902459e9ac94559ec691cf45dea30fc374fab74ce4e3a82f8bb9d0ec22e0ddd5357764076942

data/CHANGES.md

@@ -2,6 +2,10 @@
 
 ### Unreleased
 
+### 2026-07-31 (2.21.2)
+
+* Fix a use-after-free bug in `JSON::ResumableParser`. [GHSA-9hj4-r449-hfvc].
+
 ### 2026-07-13 (2.21.1)
 
 * Fix a compilation issue on Window and Microsoft Visual C++.

data/ext/json/ext/parser/extconf.rb

@@ -30,6 +30,12 @@ end
 
 append_cflags("-std=c99")
 
+# Disable function outlining on clang to prevent some of the repeated instructions
+# in json_eat_whitespace being outlined into function calls.
+# Note: This verifies '-mno-outline' is accepted as a valid compiler flag
+# and will not pass it if unsupported.
+append_cflags("-mno-outline")
+
 if enable_config('parser-use-simd', default=!ENV["JSON_DISABLE_SIMD"])
   load __dir__ + "/../simd/conf.rb"
 end

data/ext/json/ext/parser/parser.c

@@ -589,6 +589,8 @@ static inline char peek(JSON_ParserState *state)
 
 static void cursor_position(JSON_ParserState *state, long *line_out, long *column_out)
 {
+    JSON_ASSERT(!state->parser);
+    JSON_ASSERT(state->cursor);
     JSON_ASSERT(state->cursor <= state->end);
 
     // Redundant but helpful for hardening
@@ -621,10 +623,14 @@ static const unsigned int MAX_DEPRECATIONS = 5;
 
 static void emit_parse_warning(const char *message, JSON_ParserState *state)
 {
-    long line, column;
-    cursor_position(state, &line, &column);
-
-    VALUE warning = rb_sprintf("%s at line %ld column %ld", message, line, column);
+    VALUE warning;
+    if (state->parser) { // line and columns can't be accurate in resumable
+        warning = rb_utf8_str_new_cstr(message);
+    } else {
+        long line, column;
+        cursor_position(state, &line, &column);
+        warning = rb_sprintf("%s at line %ld column %ld", message, line, column);
+    }
     rb_funcall(mJSON, rb_intern("deprecation_warning"), 1, warning);
 }
 
@@ -2566,6 +2572,7 @@ static VALUE cResumableParser_parse(VALUE self)
     if (eos(&parser->state)) {
         json_str_clear(parser->buffer);
         parser->buffer = Qfalse;
+        parser->state.start = parser->state.cursor = parser->state.end = 0;
     }
     parser->in_use = false;
 

data/lib/json/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSON
-  VERSION = '2.21.1'
+  VERSION = '2.21.2'
 end

data/lib/json.rb

@@ -121,9 +121,11 @@ require 'json/common'
 # ====== Input Options
 #
 # Option +max_nesting+ (\Integer) specifies the maximum nesting depth allowed;
-# defaults to +100+; specify +false+ to disable depth checking.
+# defaults to +100+;
+# You can set it to +false+ to disable depth checking entirely, but that is dangerous
+# when parsing untrusted input.
 #
-# With the default, +false+:
+# With the default, +100+:
 #   source = '[0, [1, [2, [3]]]]'
 #   ruby = JSON.parse(source)
 #   ruby # => [0, [1, [2, [3]]]]
@@ -384,6 +386,15 @@ require 'json/common'
 #   # Raises JSON::NestingError (nesting of 2 is too deep):
 #   JSON.generate(obj, max_nesting: 2)
 #
+# With +false+:
+#   obj = []
+#   obj[0] = obj
+#   # Raises  SystemStackError: stack level too deep
+#   JSON.generate(obj, max_nesting: false)
+#
+# Setting +max_nesting+ to +false+ can lead to a stackoverflow and may leave the program
+# in an unrecoverable state. It is discouraged.
+#
 # ====== Escaping Options
 #
 # Options +script_safe+ (boolean) specifies wether <tt>'\u2028'</tt>, <tt>'\u2029'</tt>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: json
 version: !ruby/object:Gem::Version
-  version: 2.21.1
+  version: 2.21.2
 platform: ruby
 authors:
 - Florian Frank
@@ -84,7 +84,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.12
+rubygems_version: 4.0.16
 specification_version: 4
 summary: JSON Implementation for Ruby
 test_files: []