msgpack 1.8.4 → 1.8.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a5aa259ac95b61218c0f1cf10a23195bf3c847c7b1423172f50ece723363905
-  data.tar.gz: 9b3369d91349618e125cef788f3051fd706bcbbf01a78ed2afcb82ecd6d0ecf5
+  metadata.gz: cc5fdca2a5a867c26e72649de9838ca9a7ee44e2e84d295215207edaa98d3629
+  data.tar.gz: 703a7d56d9d634b53020db638e578339296e6a9cbc3da0ee6d3c8efa7d5d58bb
 SHA512:
-  metadata.gz: 9feed41442045775173abfcae2d384b27904c44b81cd3674dfa18bfbf10558c9f77ea2f2ed51b694101a33e37761fa94553108fedb866d4834bbce697f96579a
-  data.tar.gz: ae0d30ca66f5f4e1e22fcfee2615bd91db00ddfe101e043a0753e32bc7252c42d9bbfc3b763d3a519f20fdbb28ad0be2f5071472ad8b7c6c4053ac7702875432
+  metadata.gz: d06ef9b19f1d8e3d18eb2bc05ed5cd26102bdd0cb60d1d8ac622d122da1d734cc2c17180f4b9c0fd75d093f0829ebd38ecab4f3a685d0cb3653a20cf5bbd78c4
+  data.tar.gz: d5f57a80f7a109703629c1965d87638675b478ca0f34ac8421836fbadde433cd108185094326cff0a4b9c7d59f53d07904a4569e9549ca6a500f0309ae58048a

data/ChangeLog

@@ -1,3 +1,16 @@
+2026-10-27 1.8.6
+
+* Fix use-after-free when a recursive extension proc rescues, skips or resets.
+* Speed up decoding of oversized integers.
+* Avoid excessive memory allocation from crafted container headers.
+
+2026-09-11 1.8.5
+
+* Prevent stack depth underflow when skipping from recursive unpacker.
+* Fix `Unpacker#skip_nil` to properly consume the buffer.
+* Fix some small difference in Factory registration of the Java implementation.
+* Fix some Factory/ext_type optimization edge cases.
+
 2026-07-28 1.8.4
 
 * Fix `MessagePack::Buffer` to stop using already released memory page.

data/ext/java/org/msgpack/jruby/Factory.java

@@ -59,6 +59,7 @@ public class Factory extends RubyObject {
     Factory clone = (Factory)super.dup();
     clone.extensionRegistry = extensionRegistry();
     clone.hasSymbolExtType = hasSymbolExtType;
+    clone.hasBigIntExtType = hasBigIntExtType;
     return clone;
   }
 
@@ -110,8 +111,8 @@ public class Factory extends RubyObject {
 
     extensionRegistry.put(extModule, (int) typeId, recursive, packerProc, unpackerProc);
 
-    if (extModule == runtime.getSymbol() && !packerProc.isNil()) {
-      hasSymbolExtType = true;
+    if (extModule == runtime.getSymbol()) {
+      hasSymbolExtType = packerProc != null && !packerProc.isNil();
     }
 
     if (options != null) {
@@ -122,6 +123,8 @@ public class Factory extends RubyObject {
         } else {
           throw runtime.newArgumentError("oversized_integer_extension: true is only for Integer class");
         }
+      } else if (extModule == runtime.getModule("Integer")) {
+        hasBigIntExtType = false;
       }
     }
 

data/ext/msgpack/buffer.h

@@ -237,14 +237,27 @@ void _msgpack_buffer_append_long_string(msgpack_buffer_t* b, VALUE string);
 
 static inline size_t msgpack_buffer_append_string(msgpack_buffer_t* b, VALUE string)
 {
-    size_t length;
-    char *ptr;
-    RSTRING_GETMEM(string, ptr, length);
+    size_t length = RSTRING_LEN(string);
 
     if(length > b->write_reference_threshold) {
         _msgpack_buffer_append_long_string(b, string);
-    } else {
-        msgpack_buffer_append(b, ptr, length);
+    } else if(length > 0) {
+        /* Making room can run io.write or trigger GC, either of which may free
+         * or shrink the string, so reserve the space first and only then read
+         * its pointer. */
+        msgpack_buffer_ensure_writable(b, length);
+        char *ptr;
+        size_t current;
+        RSTRING_GETMEM(string, ptr, current);
+        if(current > length) {
+            current = length;
+        }
+        memcpy(b->tail.last, ptr, current);
+        if(current < length) {
+            memset(b->tail.last + current, 0, length - current);
+        }
+        b->tail.last += length;
+        RB_GC_GUARD(string);
     }
 
     return length;

data/ext/msgpack/factory_class.c

@@ -121,7 +121,10 @@ static VALUE Factory_dup(VALUE self)
     msgpack_factory_t *fc = Factory_get(self);
     msgpack_factory_t *cloned_fc = Factory_get(clone);
 
+    cloned_fc->has_bigint_ext_type = fc->has_bigint_ext_type;
     cloned_fc->has_symbol_ext_type = fc->has_symbol_ext_type;
+    cloned_fc->optimized_symbol_ext_type = fc->optimized_symbol_ext_type;
+    cloned_fc->symbol_ext_type = fc->symbol_ext_type;
     cloned_fc->pkrg = fc->pkrg;
     msgpack_unpacker_ext_registry_borrow(fc->ukrg, &cloned_fc->ukrg);
     msgpack_packer_ext_registry_dup(clone, &fc->pkrg, &cloned_fc->pkrg);
@@ -230,12 +233,13 @@ static VALUE Factory_register_type_internal(VALUE self, VALUE rb_ext_type, VALUE
     }
 
     if(ext_module == rb_cSymbol) {
-        if(NIL_P(options) || RTEST(rb_hash_aref(options, ID2SYM(rb_intern("packer"))))) {
-            fc->has_symbol_ext_type = true;
-        }
-        if(RTEST(options) && RTEST(rb_hash_aref(options, ID2SYM(rb_intern("optimized_symbols_parsing"))))) {
-            fc->optimized_symbol_ext_type = true;
-        }
+        fc->symbol_ext_type = ext_type;
+        fc->has_symbol_ext_type = NIL_P(options) || RTEST(packer_proc);
+        fc->optimized_symbol_ext_type = RTEST(options) && RTEST(rb_hash_aref(options, ID2SYM(rb_intern("optimized_symbols_parsing"))));
+    }
+
+    if(ext_module == rb_cInteger) {
+        fc->has_bigint_ext_type = false;
     }
 
     if(RTEST(options)) {
@@ -246,7 +250,6 @@ static VALUE Factory_register_type_internal(VALUE self, VALUE rb_ext_type, VALUE
                 rb_raise(rb_eArgError, "oversized_integer_extension: true is only for Integer class");
             }
         }
-
         if(RTEST(rb_hash_aref(options, ID2SYM(rb_intern("recursive"))))) {
             flags |= MSGPACK_EXT_RECURSIVE;
         }

data/ext/msgpack/packer_class.c

@@ -235,7 +235,7 @@ static VALUE Packer_write_extension(VALUE self, VALUE obj)
 
     VALUE rb_ext_type = RSTRUCT_GET(obj, 0);
     if(!RB_TYPE_P(rb_ext_type, T_FIXNUM)) {
-        rb_raise(rb_eRangeError, "integer %s too big to convert to `signed char'", RSTRING_PTR(rb_String(rb_ext_type)));
+        rb_raise(rb_eRangeError, "integer %"PRIsVALUE" too big to convert to `signed char'", rb_ext_type);
     }
 
     int ext_type = FIX2INT(rb_ext_type);

data/ext/msgpack/unpacker.c

@@ -74,9 +74,13 @@ static inline VALUE rb_hash_new_capa_inline(long capa)
 #define rb_hash_new_capa rb_hash_new_capa_inline
 #endif
 
-static inline int16_t initial_buffer_size(long size)
+static inline int16_t initial_buffer_size(msgpack_unpacker_t* uk, long count, size_t bytes_per_element)
 {
-    return (size > INITIAL_BUFFER_CAPACITY_MAX) ? INITIAL_BUFFER_CAPACITY_MAX : size;
+    size_t available = msgpack_buffer_all_readable_size(UNPACKER_BUFFER_(uk)) / bytes_per_element;
+    if((size_t)count > available) {
+        count = (long)available;
+    }
+    return (count > INITIAL_BUFFER_CAPACITY_MAX) ? INITIAL_BUFFER_CAPACITY_MAX : count;
 }
 
 void msgpack_unpacker_static_init(void)
@@ -110,6 +114,7 @@ static inline void _msgpack_unpacker_free_stack(msgpack_unpacker_stack_t* stack)
         }
         stack->data = NULL;
         stack->depth = 0;
+        stack->floor = 0;
     }
 }
 
@@ -169,7 +174,7 @@ void _msgpack_unpacker_reset(msgpack_unpacker_t* uk)
     uk->head_byte = HEAD_BYTE_REQUIRED;
 
     /*memset(uk->stack, 0, sizeof(msgpack_unpacker_t) * uk->stack.depth);*/
-    uk->stack.depth = 0;
+    msgpack_unpacker_stack_rewind(uk);
     uk->last_object = Qnil;
     uk->reading_raw = Qnil;
     uk->reading_raw_remaining = 0;
@@ -386,9 +391,16 @@ static inline int read_raw_body_begin(msgpack_unpacker_t* uk, int raw_type)
                  * instead of raising StackError like every other container type. */
                 return PRIMITIVE_STACK_TOO_DEEP;
             }
+            size_t barrier_depth = uk->stack.depth;
+            size_t saved_floor = uk->stack.floor;
             int raised;
+
+            uk->stack.floor = barrier_depth;
             obj = protected_proc_call(proc, 1, &uk->self, &raised);
-            msgpack_unpacker_stack_pop(uk);
+            uk->stack.floor = saved_floor;
+
+            /* Not --depth: the proc may return with entries left above the barrier. */
+            uk->stack.depth = barrier_depth - 1;
 
             if (raised) {
                 uk->last_object = rb_errinfo();
@@ -473,14 +485,14 @@ static int read_primitive(msgpack_unpacker_t* uk)
         if(count == 0) {
             return object_complete(uk, rb_ary_new());
         }
-        return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(count)));
+        return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(uk, count, 1)));
 
     SWITCH_RANGE(b, 0x80, 0x8f)  // FixMap
         int count = b & 0x0f;
         if(count == 0) {
             return object_complete(uk, rb_hash_new());
         }
-        return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(count)));
+        return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(uk, count, 2)));
 
     SWITCH_RANGE(b, 0xc0, 0xdf)  // Variable
         switch(b) {
@@ -703,7 +715,7 @@ static int read_primitive(msgpack_unpacker_t* uk)
                 if(count == 0) {
                     return object_complete(uk, rb_ary_new());
                 }
-                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(count)));
+                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(uk, count, 1)));
             }
 
         case 0xdd:  // array 32
@@ -713,7 +725,7 @@ static int read_primitive(msgpack_unpacker_t* uk)
                 if(count == 0) {
                     return object_complete(uk, rb_ary_new());
                 }
-                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(count)));
+                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(uk, count, 1)));
             }
 
         case 0xde:  // map 16
@@ -723,7 +735,7 @@ static int read_primitive(msgpack_unpacker_t* uk)
                 if(count == 0) {
                     return object_complete(uk, rb_hash_new());
                 }
-                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(count)));
+                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(uk, count, 2)));
             }
 
         case 0xdf:  // map 32
@@ -733,7 +745,7 @@ static int read_primitive(msgpack_unpacker_t* uk)
                 if(count == 0) {
                     return object_complete(uk, rb_hash_new());
                 }
-                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(count)));
+                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(uk, count, 2)));
             }
 
         default:
@@ -886,6 +898,10 @@ int msgpack_unpacker_skip(msgpack_unpacker_t* uk, size_t target_stack_depth)
         container_completed:
         {
             msgpack_unpacker_stack_entry_t* top = _msgpack_unpacker_stack_entry_top(uk);
+            if(top->type == STACK_TYPE_RECURSIVE) {
+                STACK_FREE(uk);
+                return PRIMITIVE_OBJECT_COMPLETE;
+            }
 
             /* this section optimized out */
             // TODO object_complete still creates objects which should be optimized out
@@ -911,8 +927,8 @@ int msgpack_unpacker_skip_nil(msgpack_unpacker_t* uk)
         return b;
     }
     if(b == 0xc0) {
+        reset_head_byte(uk);
         return 1;
     }
     return 0;
 }
-

data/ext/msgpack/unpacker.h

@@ -43,6 +43,7 @@ typedef struct {
 
 struct msgpack_unpacker_stack_t {
     size_t depth;
+    size_t floor;
     size_t capacity;
     msgpack_unpacker_stack_entry_t *data;
 };
@@ -109,6 +110,11 @@ static inline void msgpack_unpacker_set_allow_unknown_ext(msgpack_unpacker_t* uk
     uk->allow_unknown_ext = enable;
 }
 
+static inline void msgpack_unpacker_stack_rewind(msgpack_unpacker_t* uk)
+{
+    uk->stack.depth = uk->stack.floor;
+}
+
 
 /* error codes */
 #define PRIMITIVE_CONTAINER_START 1

data/ext/msgpack/unpacker_class.c

@@ -165,7 +165,7 @@ static VALUE Unpacker_allow_unknown_ext_p(VALUE self)
 
 NORETURN(static void raise_unpacker_error(msgpack_unpacker_t *uk, int r))
 {
-    uk->stack.depth = 0;
+    msgpack_unpacker_stack_rewind(uk);
     switch(r) {
     case PRIMITIVE_EOF:
         rb_raise(rb_eEOFError, "end of buffer reached");

data/lib/msgpack/bigint.rb

@@ -5,7 +5,8 @@ module MessagePack
     # We split the bigint in 32bits chunks so that individual part fits into
     # a MRI immediate Integer.
     CHUNK_BITLENGTH = 32
-    FORMAT = 'CL>*'
+    CHUNK_FORMAT = 'L>*'
+    FORMAT = "C#{CHUNK_FORMAT}"
 
     if Integer.instance_method(:[]).arity != 1 # Ruby 2.7 and newer
       # Starting from Ruby 2.7 we can address arbitrary bitranges inside an Integer with Integer#[]
@@ -56,12 +57,7 @@ module MessagePack
       parts = data.unpack(FORMAT)
 
       sign = parts.shift
-      sum = parts.pop.to_i
-
-      parts.reverse_each do |part|
-        sum = sum << CHUNK_BITLENGTH
-        sum += part
-      end
+      sum = parts.reverse.pack(CHUNK_FORMAT).unpack1('H*').to_i(16)
 
       sign == 0 ? sum : -sum
     end

data/lib/msgpack/factory.rb

@@ -14,10 +14,12 @@ module MessagePack
           options[:packer] = packer.to_sym.to_proc
         when Method
           options[:packer] = packer.to_proc
-        when packer.respond_to?(:call)
-          options[:packer] = packer.method(:call).to_proc
         else
-          raise ::TypeError, "expected :packer argument to be a callable object, got: #{packer.inspect}"
+          if packer.respond_to?(:call)
+            options[:packer] = packer.method(:call).to_proc
+          else
+            raise ::TypeError, "expected :packer argument to be a callable object, got: #{packer.inspect}"
+          end
         end
 
         case unpacker = options[:unpacker]
@@ -27,10 +29,12 @@ module MessagePack
           options[:unpacker] = klass.method(unpacker).to_proc
         when Method
           options[:unpacker] = unpacker.to_proc
-        when packer.respond_to?(:call)
-          options[:unpacker] = unpacker.method(:call).to_proc
         else
-          raise ::TypeError, "expected :unpacker argument to be a callable object, got: #{unpacker.inspect}"
+          if unpacker.respond_to?(:call)
+            options[:unpacker] = unpacker.method(:call).to_proc
+          else
+            raise ::TypeError, "expected :unpacker argument to be a callable object, got: #{unpacker.inspect}"
+          end
         end
       end
 
@@ -51,7 +55,7 @@ module MessagePack
           type = ary[0]
           packer_proc = ary[1]
           unpacker_proc = nil
-          if unpacker.has_key?(type)
+          if unpacker.has_key?(type) && unpacker[type][0] == klass
             unpacker_proc = unpacker.delete(type)[1]
           end
           list << {type: type, class: klass, packer: packer_proc, unpacker: unpacker_proc}
@@ -85,7 +89,7 @@ module MessagePack
 
     def type_registered?(klass_or_type, selector=:both)
       case klass_or_type
-      when Class
+      when Module
         klass = klass_or_type
         registered_types(selector).any?{|entry| klass <= entry[:class] }
       when Integer

data/lib/msgpack/packer.rb

@@ -23,7 +23,7 @@ module MessagePack
 
     def type_registered?(klass_or_type)
       case klass_or_type
-      when Class
+      when Module
         klass = klass_or_type
         registered_types.any?{|entry| klass <= entry[:class] }
       when Integer

data/lib/msgpack/unpacker.rb

@@ -27,7 +27,7 @@ module MessagePack
 
     def type_registered?(klass_or_type)
       case klass_or_type
-      when Class
+      when Module
         klass = klass_or_type
         registered_types.any?{|entry| klass == entry[:class] }
       when Integer

data/lib/msgpack/version.rb

@@ -1,5 +1,5 @@
 module MessagePack
-  VERSION = "1.8.4"
+  VERSION = "1.8.6"
   # Note for maintainers:
   #  Don't miss building/releasing the JRuby version (rake buld:java)
   #  See "How to build -java rubygems" in README for more details.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: msgpack
 version: !ruby/object:Gem::Version
-  version: 1.8.4
+  version: 1.8.6
 platform: ruby
 authors:
 - Sadayuki Furuhashi
@@ -98,7 +98,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: MessagePack, a binary-based efficient data interchange format.
 test_files: []