msgpack 1.8.5 → 1.8.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a5462dff41bc8885570f42b59092d6e02729500a9a873aa15ead68ed8872ccb
-  data.tar.gz: 3fcc99b85b8ece0dd0158f2ee511784a789f41ab9d3bafd9f6fc006ccd3b9061
+  metadata.gz: cc5fdca2a5a867c26e72649de9838ca9a7ee44e2e84d295215207edaa98d3629
+  data.tar.gz: 703a7d56d9d634b53020db638e578339296e6a9cbc3da0ee6d3c8efa7d5d58bb
 SHA512:
-  metadata.gz: 3cb8969960d3d2de3beb39503cb33259ac169f27397d75f981a2563bf14700e4359ca30f2fc6357bf848b707546dc0c692385250c186496e2ef7d5546809bab3
-  data.tar.gz: 5cb7b9154e12839ee504c5630d3cee504558206ea63fb54236fc7433191a763267a7fce29a43157d59507f0cc1d4b5b88ba62607571ce98ca1175aa911c1c338
+  metadata.gz: d06ef9b19f1d8e3d18eb2bc05ed5cd26102bdd0cb60d1d8ac622d122da1d734cc2c17180f4b9c0fd75d093f0829ebd38ecab4f3a685d0cb3653a20cf5bbd78c4
+  data.tar.gz: d5f57a80f7a109703629c1965d87638675b478ca0f34ac8421836fbadde433cd108185094326cff0a4b9c7d59f53d07904a4569e9549ca6a500f0309ae58048a

data/ChangeLog

@@ -1,3 +1,9 @@
+2026-10-27 1.8.6
+
+* Fix use-after-free when a recursive extension proc rescues, skips or resets.
+* Speed up decoding of oversized integers.
+* Avoid excessive memory allocation from crafted container headers.
+
 2026-09-11 1.8.5
 
 * Prevent stack depth underflow when skipping from recursive unpacker.

data/ext/msgpack/buffer.h

@@ -237,14 +237,27 @@ void _msgpack_buffer_append_long_string(msgpack_buffer_t* b, VALUE string);
 
 static inline size_t msgpack_buffer_append_string(msgpack_buffer_t* b, VALUE string)
 {
-    size_t length;
-    char *ptr;
-    RSTRING_GETMEM(string, ptr, length);
+    size_t length = RSTRING_LEN(string);
 
     if(length > b->write_reference_threshold) {
         _msgpack_buffer_append_long_string(b, string);
-    } else {
-        msgpack_buffer_append(b, ptr, length);
+    } else if(length > 0) {
+        /* Making room can run io.write or trigger GC, either of which may free
+         * or shrink the string, so reserve the space first and only then read
+         * its pointer. */
+        msgpack_buffer_ensure_writable(b, length);
+        char *ptr;
+        size_t current;
+        RSTRING_GETMEM(string, ptr, current);
+        if(current > length) {
+            current = length;
+        }
+        memcpy(b->tail.last, ptr, current);
+        if(current < length) {
+            memset(b->tail.last + current, 0, length - current);
+        }
+        b->tail.last += length;
+        RB_GC_GUARD(string);
     }
 
     return length;

data/ext/msgpack/unpacker.c

@@ -74,9 +74,13 @@ static inline VALUE rb_hash_new_capa_inline(long capa)
 #define rb_hash_new_capa rb_hash_new_capa_inline
 #endif
 
-static inline int16_t initial_buffer_size(long size)
+static inline int16_t initial_buffer_size(msgpack_unpacker_t* uk, long count, size_t bytes_per_element)
 {
-    return (size > INITIAL_BUFFER_CAPACITY_MAX) ? INITIAL_BUFFER_CAPACITY_MAX : size;
+    size_t available = msgpack_buffer_all_readable_size(UNPACKER_BUFFER_(uk)) / bytes_per_element;
+    if((size_t)count > available) {
+        count = (long)available;
+    }
+    return (count > INITIAL_BUFFER_CAPACITY_MAX) ? INITIAL_BUFFER_CAPACITY_MAX : count;
 }
 
 void msgpack_unpacker_static_init(void)
@@ -110,6 +114,7 @@ static inline void _msgpack_unpacker_free_stack(msgpack_unpacker_stack_t* stack)
         }
         stack->data = NULL;
         stack->depth = 0;
+        stack->floor = 0;
     }
 }
 
@@ -169,7 +174,7 @@ void _msgpack_unpacker_reset(msgpack_unpacker_t* uk)
     uk->head_byte = HEAD_BYTE_REQUIRED;
 
     /*memset(uk->stack, 0, sizeof(msgpack_unpacker_t) * uk->stack.depth);*/
-    uk->stack.depth = 0;
+    msgpack_unpacker_stack_rewind(uk);
     uk->last_object = Qnil;
     uk->reading_raw = Qnil;
     uk->reading_raw_remaining = 0;
@@ -387,13 +392,14 @@ static inline int read_raw_body_begin(msgpack_unpacker_t* uk, int raw_type)
                 return PRIMITIVE_STACK_TOO_DEEP;
             }
             size_t barrier_depth = uk->stack.depth;
+            size_t saved_floor = uk->stack.floor;
             int raised;
+
+            uk->stack.floor = barrier_depth;
             obj = protected_proc_call(proc, 1, &uk->self, &raised);
+            uk->stack.floor = saved_floor;
 
-            /* The user proc can drive the unpacker itself (Unpacker#read, #skip,
-             * or a rescued error) and leave stack.depth anywhere, including 0.
-             * Restore it to just below the barrier we pushed instead of an
-             * unconditional decrement, which would underflow to SIZE_MAX. */
+            /* Not --depth: the proc may return with entries left above the barrier. */
             uk->stack.depth = barrier_depth - 1;
 
             if (raised) {
@@ -479,14 +485,14 @@ static int read_primitive(msgpack_unpacker_t* uk)
         if(count == 0) {
             return object_complete(uk, rb_ary_new());
         }
-        return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(count)));
+        return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(uk, count, 1)));
 
     SWITCH_RANGE(b, 0x80, 0x8f)  // FixMap
         int count = b & 0x0f;
         if(count == 0) {
             return object_complete(uk, rb_hash_new());
         }
-        return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(count)));
+        return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(uk, count, 2)));
 
     SWITCH_RANGE(b, 0xc0, 0xdf)  // Variable
         switch(b) {
@@ -709,7 +715,7 @@ static int read_primitive(msgpack_unpacker_t* uk)
                 if(count == 0) {
                     return object_complete(uk, rb_ary_new());
                 }
-                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(count)));
+                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(uk, count, 1)));
             }
 
         case 0xdd:  // array 32
@@ -719,7 +725,7 @@ static int read_primitive(msgpack_unpacker_t* uk)
                 if(count == 0) {
                     return object_complete(uk, rb_ary_new());
                 }
-                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(count)));
+                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_ARRAY, count, rb_ary_new2(initial_buffer_size(uk, count, 1)));
             }
 
         case 0xde:  // map 16
@@ -729,7 +735,7 @@ static int read_primitive(msgpack_unpacker_t* uk)
                 if(count == 0) {
                     return object_complete(uk, rb_hash_new());
                 }
-                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(count)));
+                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(uk, count, 2)));
             }
 
         case 0xdf:  // map 32
@@ -739,7 +745,7 @@ static int read_primitive(msgpack_unpacker_t* uk)
                 if(count == 0) {
                     return object_complete(uk, rb_hash_new());
                 }
-                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(count)));
+                return _msgpack_unpacker_stack_push(uk, STACK_TYPE_MAP_KEY, count*2, rb_hash_new_capa(initial_buffer_size(uk, count, 2)));
             }
 
         default:
@@ -892,6 +898,10 @@ int msgpack_unpacker_skip(msgpack_unpacker_t* uk, size_t target_stack_depth)
         container_completed:
         {
             msgpack_unpacker_stack_entry_t* top = _msgpack_unpacker_stack_entry_top(uk);
+            if(top->type == STACK_TYPE_RECURSIVE) {
+                STACK_FREE(uk);
+                return PRIMITIVE_OBJECT_COMPLETE;
+            }
 
             /* this section optimized out */
             // TODO object_complete still creates objects which should be optimized out

data/ext/msgpack/unpacker.h

@@ -43,6 +43,7 @@ typedef struct {
 
 struct msgpack_unpacker_stack_t {
     size_t depth;
+    size_t floor;
     size_t capacity;
     msgpack_unpacker_stack_entry_t *data;
 };
@@ -109,6 +110,11 @@ static inline void msgpack_unpacker_set_allow_unknown_ext(msgpack_unpacker_t* uk
     uk->allow_unknown_ext = enable;
 }
 
+static inline void msgpack_unpacker_stack_rewind(msgpack_unpacker_t* uk)
+{
+    uk->stack.depth = uk->stack.floor;
+}
+
 
 /* error codes */
 #define PRIMITIVE_CONTAINER_START 1

data/ext/msgpack/unpacker_class.c

@@ -165,7 +165,7 @@ static VALUE Unpacker_allow_unknown_ext_p(VALUE self)
 
 NORETURN(static void raise_unpacker_error(msgpack_unpacker_t *uk, int r))
 {
-    uk->stack.depth = 0;
+    msgpack_unpacker_stack_rewind(uk);
     switch(r) {
     case PRIMITIVE_EOF:
         rb_raise(rb_eEOFError, "end of buffer reached");

data/lib/msgpack/bigint.rb

@@ -5,7 +5,8 @@ module MessagePack
     # We split the bigint in 32bits chunks so that individual part fits into
     # a MRI immediate Integer.
     CHUNK_BITLENGTH = 32
-    FORMAT = 'CL>*'
+    CHUNK_FORMAT = 'L>*'
+    FORMAT = "C#{CHUNK_FORMAT}"
 
     if Integer.instance_method(:[]).arity != 1 # Ruby 2.7 and newer
       # Starting from Ruby 2.7 we can address arbitrary bitranges inside an Integer with Integer#[]
@@ -56,12 +57,7 @@ module MessagePack
       parts = data.unpack(FORMAT)
 
       sign = parts.shift
-      sum = parts.pop.to_i
-
-      parts.reverse_each do |part|
-        sum = sum << CHUNK_BITLENGTH
-        sum += part
-      end
+      sum = parts.reverse.pack(CHUNK_FORMAT).unpack1('H*').to_i(16)
 
       sign == 0 ? sum : -sum
     end

data/lib/msgpack/version.rb

@@ -1,5 +1,5 @@
 module MessagePack
-  VERSION = "1.8.5"
+  VERSION = "1.8.6"
   # Note for maintainers:
   #  Don't miss building/releasing the JRuby version (rake buld:java)
   #  See "How to build -java rubygems" in README for more details.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: msgpack
 version: !ruby/object:Gem::Version
-  version: 1.8.5
+  version: 1.8.6
 platform: ruby
 authors:
 - Sadayuki Furuhashi
@@ -98,7 +98,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: MessagePack, a binary-based efficient data interchange format.
 test_files: []