msgpack 1.8.6 → 1.8.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cc5fdca2a5a867c26e72649de9838ca9a7ee44e2e84d295215207edaa98d3629
-  data.tar.gz: 703a7d56d9d634b53020db638e578339296e6a9cbc3da0ee6d3c8efa7d5d58bb
+  metadata.gz: 65e7539211e49d3c0eeef7b22f588fc111cf0d3574a6f204e950ced43addc51a
+  data.tar.gz: 3fa655fa372b102bd136d0cf61c84f68bd4d9e0836cb14891d95bc2c239f0b01
 SHA512:
-  metadata.gz: d06ef9b19f1d8e3d18eb2bc05ed5cd26102bdd0cb60d1d8ac622d122da1d734cc2c17180f4b9c0fd75d093f0829ebd38ecab4f3a685d0cb3653a20cf5bbd78c4
-  data.tar.gz: d5f57a80f7a109703629c1965d87638675b478ca0f34ac8421836fbadde433cd108185094326cff0a4b9c7d59f53d07904a4569e9549ca6a500f0309ae58048a
+  metadata.gz: 8588f17a3fa9eec124a7ef874322fcf1aa90318cda81e463f3b7186267b3c82ec3ecf6fdd514a9d265cb40d781b7718551aa8278be25540fc9aaaaec085e851b
+  data.tar.gz: b224acfb0d31868e42e684e1263b11fed097054a359fc3437e1185130874e5f635dbb386b43b509b84c99caae86799dbf9517fc1e4ad5849788d824dab47699c

data/ChangeLog

@@ -1,3 +1,8 @@
+2026-10-30 1.8.7
+
+* Fix the Java version of the unpacker to never preallocate objects larger than
+  the buffered size (similar to the fix for the C unpacker in 1.8.1).
+
 2026-10-27 1.8.6
 
 * Fix use-after-free when a recursive extension proc rescues, skips or resets.

data/ext/java/org/msgpack/jruby/Decoder.java

@@ -137,11 +137,15 @@ public class Decoder implements Iterator<IRubyObject> {
   }
 
   private IRubyObject consumeArray(int size) {
-    IRubyObject[] elements = new IRubyObject[size];
+    int preallocatedSize = size;
+    if (preallocatedSize > buffer.remaining()) {
+      preallocatedSize = buffer.remaining();
+    }
+    RubyArray array = runtime.newArray(preallocatedSize);
     for (int i = 0; i < size; i++) {
-      elements[i] = next();
+      array.push(next());
     }
-    return runtime.newArray(elements);
+    return array;
   }
 
   private IRubyObject consumeHash(int size) {
@@ -184,9 +188,12 @@ public class Decoder implements Iterator<IRubyObject> {
   }
 
   private byte[] readBytes(int size) {
-    byte[] payload = new byte[size];
-    buffer.get(payload);
-    return payload;
+    if (buffer.remaining() >= size) {
+      byte[] payload = new byte[size];
+      buffer.get(payload);
+      return payload;
+    }
+    throw new BufferUnderflowException();
   }
 
   @Override

data/lib/msgpack/version.rb

@@ -1,5 +1,5 @@
 module MessagePack
-  VERSION = "1.8.6"
+  VERSION = "1.8.7"
   # Note for maintainers:
   #  Don't miss building/releasing the JRuby version (rake buld:java)
   #  See "How to build -java rubygems" in README for more details.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: msgpack
 version: !ruby/object:Gem::Version
-  version: 1.8.6
+  version: 1.8.7
 platform: ruby
 authors:
 - Sadayuki Furuhashi