msgpack 1.8.3 → 1.8.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed5705d96741dbe59f61d59de79d133dfead8636cbf8c9db51b684c425a52e34
-  data.tar.gz: 6fa2a89acb1a2ae0db5068fa59b483d2292e0b9ad681f9c3c058cf164dd28385
+  metadata.gz: 4a5aa259ac95b61218c0f1cf10a23195bf3c847c7b1423172f50ece723363905
+  data.tar.gz: 9b3369d91349618e125cef788f3051fd706bcbbf01a78ed2afcb82ecd6d0ecf5
 SHA512:
-  metadata.gz: 8edfe983aaee5230a1c1547e45894403c9c4435a65bbe4d88b4e9a800bb31467ad867526f4d54baf2cd6b7738cd9458104fc0caa772bba0dcbcb25c427002218
-  data.tar.gz: 3d282debd040b4f9b0f2a15c2c34068b64d01c696d1756f235c63078e54d5fcc2d1896f1b32321aa2c70ec67b8205eb608e841aff60eecd78a651e614016eac3
+  metadata.gz: 9feed41442045775173abfcae2d384b27904c44b81cd3674dfa18bfbf10558c9f77ea2f2ed51b694101a33e37761fa94553108fedb866d4834bbce697f96579a
+  data.tar.gz: ae0d30ca66f5f4e1e22fcfee2615bd91db00ddfe101e043a0753e32bc7252c42d9bbfc3b763d3a519f20fdbb28ad0be2f5071472ad8b7c6c4053ac7702875432

data/ChangeLog

@@ -1,3 +1,9 @@
+2026-07-28 1.8.4
+
+* Fix `MessagePack::Buffer` to stop using already released memory page.
+  This could have caused data to leak across buffers when using the MessagePack::Buffer API
+  directly.
+
 2026-06-10 1.8.3
 
 * Fix an integer overflow when parsing maps.
@@ -6,7 +12,7 @@
 
 * Fix `Buffer#clear` to properly reset memory chunks before adding them back to the pool.
   This could have caused data to leak across buffers when using the MessagePack::Buffer API
-  directly. [CVE-PENDING].
+  directly. [CVE-2026-54522].
 
 2026-05-28 1.8.1
 

data/ext/msgpack/buffer.c

@@ -127,6 +127,15 @@ void msgpack_buffer_mark(void *ptr)
 
 bool _msgpack_buffer_shift_chunk(msgpack_buffer_t* b)
 {
+    if(b->rmem_owner == &b->head->mem) {
+        /* the chunk that owns the rmem page is going away and takes the page
+         * with it. don't carve the remaining space out of a page that is
+         * already back in the pool. */
+        b->rmem_end = NULL;
+        b->rmem_last = NULL;
+        b->rmem_owner = NULL;
+    }
+
     _msgpack_buffer_chunk_destroy(b->head);
 
     if(b->head == &b->tail) {
@@ -264,6 +273,18 @@ static inline msgpack_buffer_chunk_t* _msgpack_buffer_alloc_new_chunk(msgpack_bu
     return chunk;
 }
 
+/* b->tail is copied into nc and then rebuilt, so the rmem page pointer moves
+ * to nc. the owner has to follow it: if it kept pointing at b->tail.mem, the
+ * transfer in _msgpack_buffer_chunk_malloc would degenerate into a
+ * self-assignment and the page would be released by nc while the rebuilt tail
+ * is still reading from it. */
+static inline void _msgpack_buffer_transfer_rmem_owner(msgpack_buffer_t* b, msgpack_buffer_chunk_t* nc)
+{
+    if(b->rmem_owner == &b->tail.mem) {
+        b->rmem_owner = &nc->mem;
+    }
+}
+
 static inline void _msgpack_buffer_add_new_chunk(msgpack_buffer_t* b)
 {
     if(b->head == &b->tail) {
@@ -275,6 +296,7 @@ static inline void _msgpack_buffer_add_new_chunk(msgpack_buffer_t* b)
         msgpack_buffer_chunk_t* nc = _msgpack_buffer_alloc_new_chunk(b);
 
         *nc = b->tail;
+        _msgpack_buffer_transfer_rmem_owner(b, nc);
         b->head = nc;
         nc->next = &b->tail;
 
@@ -295,6 +317,7 @@ static inline void _msgpack_buffer_add_new_chunk(msgpack_buffer_t* b)
 
         /* rebuild tail */
         *nc = b->tail;
+        _msgpack_buffer_transfer_rmem_owner(b, nc);
         before_tail->next = nc;
         nc->next = &b->tail;
     }

data/ext/msgpack/packer.h

@@ -25,11 +25,6 @@
 #define MSGPACK_PACKER_IO_FLUSH_THRESHOLD_TO_WRITE_STRING_BODY (1024)
 #endif
 
-#ifndef UNREACHABLE_RETURN
-// Ruby 2.5
-#define UNREACHABLE_RETURN() return
-#endif
-
 struct msgpack_packer_t;
 typedef struct msgpack_packer_t msgpack_packer_t;
 
@@ -418,7 +413,6 @@ static inline void msgpack_packer_write_string_value(msgpack_packer_t* pk, VALUE
 
     if(RB_UNLIKELY(len > 0xffffffffL)) {
         rb_raise(rb_eArgError, "size of string is too long to pack: %lu bytes should be <= %ld", len, 0xffffffffL);
-        UNREACHABLE_RETURN();
     }
 
     if (RB_UNLIKELY(pk->compatibility_mode)) {

data/ext/msgpack/unpacker.c

@@ -211,7 +211,7 @@ static inline int object_complete(msgpack_unpacker_t* uk, VALUE object)
     return PRIMITIVE_OBJECT_COMPLETE;
 }
 
-static inline int object_complete_symbol(msgpack_unpacker_t* uk, VALUE object)
+static inline int object_complete_frozen(msgpack_unpacker_t* uk, VALUE object)
 {
     uk->last_object = object;
     reset_head_byte(uk);
@@ -222,9 +222,9 @@ static inline int object_complete_ext(msgpack_unpacker_t* uk, int ext_type, VALU
 {
     if (uk->optimized_symbol_ext_type && ext_type == uk->symbol_ext_type) {
         if (RB_UNLIKELY(NIL_P(str))) { // empty extension is returned as Qnil
-            return object_complete_symbol(uk, ID2SYM(rb_intern3("", 0, rb_utf8_encoding())));
+            return object_complete_frozen(uk, ID2SYM(rb_intern3("", 0, rb_utf8_encoding())));
         }
-        return object_complete_symbol(uk, rb_str_intern(str));
+        return object_complete_frozen(uk, rb_str_intern(str));
     }
 
     int ext_flags;
@@ -378,7 +378,14 @@ static inline int read_raw_body_begin(msgpack_unpacker_t* uk, int raw_type)
             reset_head_byte(uk);
             uk->reading_raw_remaining = 0;
 
-            _msgpack_unpacker_stack_push(uk, STACK_TYPE_RECURSIVE, 1, Qnil);
+            if(_msgpack_unpacker_stack_push(uk, STACK_TYPE_RECURSIVE, 1, Qnil) < 0) {
+                /* Recursive extensions re-enter msgpack_unpacker_read() through the
+                 * user proc, consuming a full C stack frame per nesting level. If we
+                 * ignore a failed push (stack already at MSGPACK_UNPACKER_STACK_CAPACITY)
+                 * the recursion continues unbounded and exhausts the C stack (SIGSEGV)
+                 * instead of raising StackError like every other container type. */
+                return PRIMITIVE_STACK_TOO_DEEP;
+            }
             int raised;
             obj = protected_proc_call(proc, 1, &uk->self, &raised);
             msgpack_unpacker_stack_pop(uk);
@@ -398,7 +405,7 @@ static inline int read_raw_body_begin(msgpack_unpacker_t* uk, int raw_type)
         int ret;
         if ((uk->optimized_symbol_ext_type && uk->symbol_ext_type == raw_type)) {
             VALUE symbol = msgpack_buffer_read_top_as_symbol(UNPACKER_BUFFER_(uk), length, raw_type != RAW_TYPE_BINARY);
-            ret = object_complete_symbol(uk, symbol);
+            ret = object_complete_frozen(uk, symbol);
         } else if (is_reading_map_key(uk) && raw_type == RAW_TYPE_STRING) {
            /* don't use zerocopy for hash keys but get a frozen string directly
             * because rb_hash_aset freezes keys and it causes copying */
@@ -409,7 +416,7 @@ static inline int read_raw_body_begin(msgpack_unpacker_t* uk, int raw_type)
                 } else {
                     key = msgpack_buffer_read_top_as_symbol(UNPACKER_BUFFER_(uk), length, true);
                 }
-                ret = object_complete_symbol(uk, key);
+                ret = object_complete_frozen(uk, key);
             } else {
                 if (uk->use_key_cache) {
                     key = msgpack_buffer_read_top_as_interned_string(UNPACKER_BUFFER_(uk), &uk->key_cache, length);
@@ -450,10 +457,10 @@ static int read_primitive(msgpack_unpacker_t* uk)
 
     SWITCH_RANGE_BEGIN(b)
     SWITCH_RANGE(b, 0x00, 0x7f)  // Positive Fixnum
-        return object_complete(uk, INT2NUM(b));
+        return object_complete_frozen(uk, INT2NUM(b));
 
     SWITCH_RANGE(b, 0xe0, 0xff)  // Negative Fixnum
-        return object_complete(uk, INT2NUM((int8_t)b));
+        return object_complete_frozen(uk, INT2NUM((int8_t)b));
 
     SWITCH_RANGE(b, 0xa0, 0xbf)  // FixRaw / fixstr
         size_t count = b & 0x1f;
@@ -478,15 +485,15 @@ static int read_primitive(msgpack_unpacker_t* uk)
     SWITCH_RANGE(b, 0xc0, 0xdf)  // Variable
         switch(b) {
         case 0xc0:  // nil
-            return object_complete(uk, Qnil);
+            return object_complete_frozen(uk, Qnil);
 
         //case 0xc1:  // string
 
         case 0xc2:  // false
-            return object_complete(uk, Qfalse);
+            return object_complete_frozen(uk, Qfalse);
 
         case 0xc3:  // true
-            return object_complete(uk, Qtrue);
+            return object_complete_frozen(uk, Qtrue);
 
         case 0xc7: // ext 8
             {
@@ -542,14 +549,14 @@ static int read_primitive(msgpack_unpacker_t* uk)
             {
                 READ_CAST_BLOCK_OR_RETURN_EOF(cb, uk, 1);
                 uint8_t u8 = cb.u8;
-                return object_complete(uk, INT2NUM((int)u8));
+                return object_complete_frozen(uk, INT2NUM((int)u8));
             }
 
         case 0xcd:  // unsigned int 16
             {
                 READ_CAST_BLOCK_OR_RETURN_EOF(cb, uk, 2);
                 uint16_t u16 = _msgpack_be16(cb.u16);
-                return object_complete(uk, INT2NUM((int)u16));
+                return object_complete_frozen(uk, INT2NUM((int)u16));
             }
 
         case 0xce:  // unsigned int 32
@@ -570,14 +577,14 @@ static int read_primitive(msgpack_unpacker_t* uk)
             {
                 READ_CAST_BLOCK_OR_RETURN_EOF(cb, uk, 1);
                 int8_t i8 = cb.i8;
-                return object_complete(uk, INT2NUM((int)i8));
+                return object_complete_frozen(uk, INT2NUM((int)i8));
             }
 
         case 0xd1:  // signed int 16
             {
                 READ_CAST_BLOCK_OR_RETURN_EOF(cb, uk, 2);
                 int16_t i16 = _msgpack_be16(cb.i16);
-                return object_complete(uk, INT2NUM((int)i16));
+                return object_complete_frozen(uk, INT2NUM((int)i16));
             }
 
         case 0xd2:  // signed int 32
@@ -897,82 +904,6 @@ int msgpack_unpacker_skip(msgpack_unpacker_t* uk, size_t target_stack_depth)
     }
 }
 
-int msgpack_unpacker_peek_next_object_type(msgpack_unpacker_t* uk)
-{
-    int b = get_head_byte(uk);
-    if(b < 0) {
-        return b;
-    }
-
-    SWITCH_RANGE_BEGIN(b)
-    SWITCH_RANGE(b, 0x00, 0x7f)  // Positive Fixnum
-        return TYPE_INTEGER;
-
-    SWITCH_RANGE(b, 0xe0, 0xff)  // Negative Fixnum
-        return TYPE_INTEGER;
-
-    SWITCH_RANGE(b, 0xa0, 0xbf)  // FixRaw
-        return TYPE_RAW;
-
-    SWITCH_RANGE(b, 0x90, 0x9f)  // FixArray
-        return TYPE_ARRAY;
-
-    SWITCH_RANGE(b, 0x80, 0x8f)  // FixMap
-        return TYPE_MAP;
-
-    SWITCH_RANGE(b, 0xc0, 0xdf)  // Variable
-        switch(b) {
-        case 0xc0:  // nil
-            return TYPE_NIL;
-
-        case 0xc2:  // false
-        case 0xc3:  // true
-            return TYPE_BOOLEAN;
-
-        case 0xca:  // float
-        case 0xcb:  // double
-            return TYPE_FLOAT;
-
-        case 0xcc:  // unsigned int  8
-        case 0xcd:  // unsigned int 16
-        case 0xce:  // unsigned int 32
-        case 0xcf:  // unsigned int 64
-            return TYPE_INTEGER;
-
-        case 0xd0:  // signed int  8
-        case 0xd1:  // signed int 16
-        case 0xd2:  // signed int 32
-        case 0xd3:  // signed int 64
-            return TYPE_INTEGER;
-
-        case 0xd9:  // raw 8 / str 8
-        case 0xda:  // raw 16 / str 16
-        case 0xdb:  // raw 32 / str 32
-            return TYPE_RAW;
-
-        case 0xc4:  // bin 8
-        case 0xc5:  // bin 16
-        case 0xc6:  // bin 32
-            return TYPE_RAW;
-
-        case 0xdc:  // array 16
-        case 0xdd:  // array 32
-            return TYPE_ARRAY;
-
-        case 0xde:  // map 16
-        case 0xdf:  // map 32
-            return TYPE_MAP;
-
-        default:
-            return PRIMITIVE_INVALID_BYTE;
-        }
-
-    SWITCH_RANGE_DEFAULT
-        return PRIMITIVE_INVALID_BYTE;
-
-    SWITCH_RANGE_END
-}
-
 int msgpack_unpacker_skip_nil(msgpack_unpacker_t* uk)
 {
     int b = get_head_byte(uk);

data/ext/msgpack/unpacker.h

@@ -77,16 +77,6 @@ struct msgpack_unpacker_t {
 
 #define UNPACKER_BUFFER_(uk) (&(uk)->buffer)
 
-enum msgpack_unpacker_object_type {
-    TYPE_NIL = 0,
-    TYPE_BOOLEAN,
-    TYPE_INTEGER,
-    TYPE_FLOAT,
-    TYPE_RAW,
-    TYPE_ARRAY,
-    TYPE_MAP,
-};
-
 void msgpack_unpacker_static_init(void);
 
 void msgpack_unpacker_static_destroy(void);
@@ -139,9 +129,6 @@ static inline VALUE msgpack_unpacker_get_last_object(msgpack_unpacker_t* uk)
     return uk->last_object;
 }
 
-
-int msgpack_unpacker_peek_next_object_type(msgpack_unpacker_t* uk);
-
 int msgpack_unpacker_skip_nil(msgpack_unpacker_t* uk);
 
 int msgpack_unpacker_read_array_header(msgpack_unpacker_t* uk, uint32_t* result_size);

data/lib/msgpack/version.rb

@@ -1,5 +1,5 @@
 module MessagePack
-  VERSION = "1.8.3"
+  VERSION = "1.8.4"
   # Note for maintainers:
   #  Don't miss building/releasing the JRuby version (rake buld:java)
   #  See "How to build -java rubygems" in README for more details.

data/msgpack.gemspec

@@ -29,13 +29,4 @@ Gem::Specification.new do |s|
     "documentation_uri" => "https://github.com/msgpack/msgpack/blob/master/spec.md",
     "source_code_uri" => "https://github.com/msgpack/msgpack-ruby"
   }
-
-  s.add_development_dependency 'bundler'
-  s.add_development_dependency 'rake'
-  s.add_development_dependency 'rake-compiler', ['>= 1.1.9']
-  s.add_development_dependency 'rspec', ['~> 3.3']
-  s.add_development_dependency 'ruby_memcheck'
-  s.add_development_dependency 'yard'
-  s.add_development_dependency 'json'
-  s.add_development_dependency 'benchmark-ips', ['~> 2.10.0']
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: msgpack
 version: !ruby/object:Gem::Version
-  version: 1.8.3
+  version: 1.8.4
 platform: ruby
 authors:
 - Sadayuki Furuhashi
@@ -10,119 +10,7 @@ authors:
 bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rake-compiler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.1.9
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.1.9
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.3'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.3'
-- !ruby/object:Gem::Dependency
-  name: ruby_memcheck
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: yard
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: json
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: benchmark-ips
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 2.10.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 2.10.0
+dependencies: []
 description: MessagePack is a binary-based efficient object serialization library.
   It enables to exchange structured objects between many languages like JSON. But
   unlike JSON, it is very fast and small.
@@ -210,7 +98,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.12
+rubygems_version: 4.0.16
 specification_version: 4
 summary: MessagePack, a binary-based efficient data interchange format.
 test_files: []