oj 3.16.11 → 3.17.6

data/ext/oj/oj.c

@@ -20,6 +20,8 @@
 #include "rails.h"
 #include "simd.h"
 
+#define MAX_INDENT 16
+
 typedef struct _yesNoOpt {
     VALUE sym;
     char *attr;
@@ -120,7 +122,9 @@ static VALUE create_id_sym;
 static VALUE custom_sym;
 static VALUE empty_string_sym;
 static VALUE escape_mode_sym;
+static VALUE except_sym;
 static VALUE integer_range_sym;
+static VALUE max_integer_digits_sym;
 static VALUE fast_sym;
 static VALUE float_prec_sym;
 static VALUE float_format_sym;
@@ -138,6 +142,7 @@ static VALUE null_sym;
 static VALUE object_sym;
 static VALUE omit_null_byte_sym;
 static VALUE omit_nil_sym;
+static VALUE only_sym;
 static VALUE rails_sym;
 static VALUE raise_sym;
 static VALUE ruby_sym;
@@ -167,6 +172,8 @@ pthread_mutex_t oj_cache_mutex;
 VALUE oj_cache_mutex = Qnil;
 #endif
 
+SIMD_Implementation SIMD_Impl = SIMD_NONE;
+
 extern void oj_parser_init();
 
 const char oj_json_class[] = "json_class";
@@ -202,6 +209,7 @@ struct _options oj_default_options = {
     0,              // cache_str
     0,              // int_range_min
     0,              // int_range_max
+    0,              // max_integer_digits
     oj_json_class,  // create_id
     10,             // create_id_len
     9,              // sec_prec
@@ -226,6 +234,8 @@ struct _options oj_default_options = {
         false,      // omit_nil
         false,      // omit_null_byte
         MAX_DEPTH,  // max_depth
+        NULL,       // only
+        NULL,       // except
     },
     {
         // str_rx
@@ -236,6 +246,22 @@ struct _options oj_default_options = {
     NULL,
 };
 
+static VALUE only_array_from_string(const char *str) {
+    volatile VALUE a = Qnil;
+
+    if (NULL != str && 2 < strlen(str)) {
+        str++;
+        char *cp;
+
+        a = rb_ary_new();
+        while (NULL != (cp = strchr(str, ':'))) {
+            rb_ary_push(a, rb_id2sym(rb_intern2(str, cp - str)));
+            str = cp + 1;
+        }
+    }
+    return a;
+}
+
 /* Document-method: default_options()
  *	call-seq: default_options()
  *
@@ -273,7 +299,8 @@ struct _options oj_default_options = {
  *   floats, 0 indicates use Ruby
  * - *:float_format* [_String_] the C printf format string for printing floats.
  *   Default follows the float_precision and will be changed if float_precision is
- *   changed. The string can be no more than 6 bytes.
+ *   changed. The string can be no more than 6 bytes and can hold at most one
+ *   directive, which must be one of aAeEfgG and take no argument of its own.
  * - *:use_to_json* [_Boolean_|_nil_] call to_json() methods on dump, default is false
  * - *:use_as_json* [_Boolean_|_nil_] call as_json() methods on dump, default is false
  * - *:use_raw_json* [_Boolean_|_nil_] call raw_json() methods on dump, default is false
@@ -312,10 +339,17 @@ struct _options oj_default_options = {
  * - *:cache_str* [_Fixnum_] maximum string value length to cache (strings less
  *   than this are cached)
  * - *:integer_range* [_Range_] Dump integers outside range as strings.
+ * - *:max_integer_digits* [_Fixnum_] Maximum number of decimal digits allowed in a
+ *   parsed integer. When the limit is exceeded a parse error is raised. 0 (the
+ *   default) disables the limit. Setting a reasonable limit is recommended when
+ *   parsing untrusted input to mitigate CPU-DoS attacks. Only applies to the
+ *   legacy parsers (Oj.load, Oj::Doc, JSON.parse mimic); Oj::Parser is unaffected.
  * - *:trace* [_true,_|_false_] Trace all load and dump calls, default is false
  *   (trace is off)
  * - *:safe* [_true,_|_false_] Safe mimic breaks JSON mimic to be safer, default
  *   is false (safe is off)
+ * - *:only* [_nil,_|_Array_] A list of the fields to encode. All others are skipped.
+ * - *:except* [_nil,_|_Array_] A list of the fields to not encode. All others are encoded.
  *
  * Return [_Hash_] all current option settings.
  */
@@ -424,6 +458,7 @@ static VALUE get_def_opts(VALUE self) {
     } else {
         rb_hash_aset(opts, integer_range_sym, Qnil);
     }
+    rb_hash_aset(opts, max_integer_digits_sym, LONG2NUM((long)oj_default_options.max_integer_digits));
     switch (oj_default_options.escape_mode) {
     case NLEsc: rb_hash_aset(opts, escape_mode_sym, newline_sym); break;
     case JSONEsc: rb_hash_aset(opts, escape_mode_sym, json_sym); break;
@@ -481,6 +516,9 @@ static VALUE get_def_opts(VALUE self) {
     rb_hash_aset(opts, oj_hash_class_sym, oj_default_options.hash_class);
     rb_hash_aset(opts, oj_array_class_sym, oj_default_options.array_class);
 
+    rb_hash_aset(opts, only_sym, only_array_from_string(oj_default_options.dump_opts.only));
+    rb_hash_aset(opts, except_sym, only_array_from_string(oj_default_options.dump_opts.except));
+
     if (NULL == oj_default_options.ignore) {
         rb_hash_aset(opts, ignore_sym, Qnil);
     } else {
@@ -537,7 +575,8 @@ static VALUE get_def_opts(VALUE self) {
  *     when dumping the seconds portion of time.
  *   - *:float_format* [_String_] the C printf format string for printing floats.
  *     Default follows the float_precision and will be changed if float_precision
- *     is changed. The string can be no more than 6 bytes.
+ *     is changed. The string can be no more than 6 bytes and can hold at most one
+ *     directive, which must be one of aAeEfgG and take no argument of its own.
  *   - *:float_precision* [_Fixnum_|_nil_] number of digits of precision when dumping floats, 0 indicates use Ruby.
  *   - *:use_to_json* [_Boolean_|_nil_] call to_json() methods on dump, default is false.
  *   - *:use_as_json* [_Boolean_|_nil_] call as_json() methods on dump, default is false.
@@ -564,12 +603,57 @@ static VALUE get_def_opts(VALUE self) {
  *   - *:cache_keys* [_Boolean_] if true then hash keys are cached
  *   - *:cache_str* [_Fixnum_] maximum string value length to cache (strings less than this are cached)
  *   - *:integer_range* [_Range_] Dump integers outside range as strings.
+ *   - *:max_integer_digits* [_Fixnum_] Maximum decimal digits in a parsed integer
+ *     (0 = unlimited). Use to mitigate CPU-DoS via huge integer values in JSON.
  *   - *:trace* [_Boolean_] turn trace on or off.
  *   - *:safe* [_Boolean_] turn safe mimic on or off.
  */
+static ID oj_default_options_keeper_id = 0;
+
+// The default options are a plain C global so the Ruby objects in them, the
+// classes of the hash_class, array_class, and ignore options and the regexps
+// and the classes of the match_string option, can not be reached by the GC and
+// are collected while the defaults still refer to them. Holding them in an
+// array the GC does know about keeps them alive. The array is rebuilt whenever
+// the defaults change and replaces the previous one so that only the objects
+// the defaults are currently using are held.
+static void keep_default_options(void) {
+    VALUE keep = rb_ary_new();
+
+    if (0 == oj_default_options_keeper_id) {
+        oj_default_options_keeper_id = rb_intern("@default_options_keeper");
+    }
+    if (Qnil != oj_default_options.hash_class) {
+        rb_ary_push(keep, oj_default_options.hash_class);
+    }
+    if (Qnil != oj_default_options.array_class) {
+        rb_ary_push(keep, oj_default_options.array_class);
+    }
+    if (NULL != oj_default_options.ignore) {
+        VALUE *vp;
+
+        for (vp = oj_default_options.ignore; Qnil != *vp; vp++) {
+            rb_ary_push(keep, *vp);
+        }
+    }
+    oj_rxclass_keep(&oj_default_options.str_rx, keep);
+    // An instance variable of the Oj module is a reference the GC can follow on
+    // every engine, unlike a C global.
+    rb_ivar_set(Oj, oj_default_options_keeper_id, keep);
+}
+
 static VALUE set_def_opts(VALUE self, VALUE opts) {
     Check_Type(opts, T_HASH);
+    // A :match_string option replaces the regexps instead of adding to them so
+    // the ones the defaults are holding have to be freed here, the only place
+    // that owns them. A per call options struct only aliases them.
+    if (Qnil != rb_hash_lookup(opts, match_string_sym)) {
+        oj_rxclass_cleanup(&oj_default_options.str_rx);
+        oj_default_options.str_rx.head = NULL;
+        oj_default_options.str_rx.tail = NULL;
+    }
     oj_parse_options(opts, &oj_default_options);
+    keep_default_options();
 
     return Qnil;
 }
@@ -623,12 +707,143 @@ bool set_yesno_options(VALUE key, VALUE value, Options copts) {
     return false;
 }
 
-static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
-    Options copts = (Options)opts;
-    size_t  len;
+inline static bool in_set(const char *set, char c) {
+    return '\0' != c && NULL != strchr(set, c);
+}
+
+// The format is used with one double and nothing else, so a directive that
+// asks for anything more takes it from whatever is left in the argument
+// registers. %s reads it as a pointer and %n writes through it.
+static void validate_float_format(const char *str, size_t len) {
+    const char *s   = str;
+    const char *end = str + len;
+    int         cnt = 0;
+
+    for (; s < end; s++) {
+        if ('%' != *s) {
+            continue;
+        }
+        s++;
+        if (s < end && '%' == *s) {
+            continue;
+        }
+        if (1 < ++cnt) {
+            rb_raise(rb_eArgError, ":float_format must not have more than one directive.");
+        }
+        for (; s < end && in_set("-+ #0", *s); s++) {
+        }
+        for (; s < end && '0' <= *s && *s <= '9'; s++) {
+        }
+        if (s < end && '.' == *s) {
+            for (s++; s < end && '0' <= *s && *s <= '9'; s++) {
+            }
+        }
+        if (s < end && 'l' == *s) {
+            s++;
+        }
+        if (end <= s || !in_set("aAeEfgG", *s)) {
+            rb_raise(rb_eArgError, ":float_format directive must be one of aAeEfgG and take no argument of its own.");
+        }
+    }
+}
+
+static const char *make_only_value(VALUE v) {
+    switch (rb_type(v)) {
+    case RUBY_T_NIL:
+    case RUBY_T_NONE: return NULL;
+    case RUBY_T_ARRAY: {
+        long  len = rb_array_len(v);
+        long  i;
+        long  size = 0;
+        char *buf;
+        char *bp;
+
+        for (i = 0; i < len; i++) {
+            VALUE x = rb_ary_entry(v, i);
+
+            switch (rb_type(x)) {
+            case RUBY_T_SYMBOL:
+                size += strlen(rb_id2name(rb_sym2id(x)));
+                size++;
+                break;
+            case RUBY_T_STRING:
+                size += strlen(StringValueCStr(x));
+                size++;
+                break;
+            default: rb_raise(rb_eArgError, ":only and :except must be nil, symbol, string, or array."); break;
+            }
+        }
+        if (0 == size) {
+            return NULL;
+        }
+        buf   = OJ_R_ALLOC_N(char, size + 2);
+        bp    = buf;
+        *bp++ = ':';
+        for (i = 0; i < len; i++) {
+            VALUE       x = rb_ary_entry(v, i);
+            const char *str;
+
+            switch (rb_type(x)) {
+            case RUBY_T_SYMBOL:
+                str  = rb_id2name(rb_sym2id(x));
+                size = strlen(str);
+                memcpy(bp, str, size);
+                bp += size;
+                *bp++ = ':';
+                break;
+            case RUBY_T_STRING:
+                str  = StringValueCStr(x);
+                size = strlen(str);
+                memcpy(bp, str, size);
+                bp += size;
+                *bp++ = ':';
+                break;
+            default:
+                // ignore
+                break;
+            }
+        }
+        *bp = '\0';
+
+        return buf;
+    }
+    case RUBY_T_STRING: {
+        const char *str  = StringValueCStr(v);
+        size_t      size = strlen(str);
+        char       *buf  = OJ_R_ALLOC_N(char, size + 3);
+
+        buf[0] = ':';
+        strcpy(buf + 1, str);
+        buf[size + 1] = ':';
+        buf[size + 2] = '\0';
+
+        return buf;
+    }
+    case RUBY_T_SYMBOL: {
+        const char *str  = rb_id2name(rb_sym2id(v));
+        size_t      size = strlen(str);
+        char       *buf  = OJ_R_ALLOC_N(char, size + 3);
+
+        buf[0] = ':';
+        strcpy(buf + 1, str);
+        buf[size + 1] = ':';
+        buf[size + 2] = '\0';
+
+        return buf;
+    }
+    default: rb_raise(rb_eArgError, ":only and zzz :except must be nil, symbol, string, or array."); break;
+    }
+    return NULL;
+}
+
+// Apply one key and value to copts. Returns true if the key named an option Oj
+// knows and false if it did not. An unrecognized key is still ignored rather
+// than an error; the return only lets a caller tell the two cases apart.
+static bool parse_one_option(VALUE k, VALUE v, Options copts) {
+    size_t len;
 
     if (set_yesno_options(k, v, copts)) {
-        return ST_CONTINUE;
+        return true;
     }
     if (oj_indent_sym == k) {
         switch (rb_type(v)) {
@@ -640,7 +855,10 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
         case T_FIXNUM:
             copts->dump_opts.indent_size = 0;
             *copts->dump_opts.indent_str = '\0';
-            copts->indent                = FIX2INT(v);
+            if (MAX_INDENT < FIX2INT(v)) {
+                rb_raise(rb_eArgError, "indent is limited to %d characters.", MAX_INDENT);
+            }
+            copts->indent = FIX2INT(v);
             break;
         case T_STRING:
             if (sizeof(copts->dump_opts.indent_str) <= (len = RSTRING_LEN(v))) {
@@ -751,7 +969,7 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
         }
     } else if (bigdecimal_load_sym == k) {
         if (Qnil == v) {
-            return ST_CONTINUE;
+            return true;
         }
 
         if (bigdecimal_sym == v || Qtrue == v) {
@@ -767,7 +985,7 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
         }
     } else if (compat_bigdecimal_sym == k) {
         if (Qnil == v) {
-            return ST_CONTINUE;
+            return true;
         }
         copts->compat_bigdec = (Qtrue == v);
     } else if (oj_decimal_class_sym == k) {
@@ -779,9 +997,13 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
             rb_raise(rb_eArgError, ":decimal_class must be BigDecimal or Float.");
         }
     } else if (create_id_sym == k) {
+        // A per call copy of the options aliases the buffer the default
+        // options own, so only the defaults may free it.
+        bool owned = (&oj_default_options == copts && NULL != copts->create_id && oj_json_class != copts->create_id);
+
         if (Qnil == v) {
-            if (oj_json_class != oj_default_options.create_id && NULL != copts->create_id) {
-                OJ_R_FREE((char *)oj_default_options.create_id);
+            if (owned) {
+                OJ_R_FREE((char *)copts->create_id);
             }
             copts->create_id     = NULL;
             copts->create_id_len = 0;
@@ -789,7 +1011,10 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
             const char *str = StringValuePtr(v);
 
             len = RSTRING_LEN(v);
-            if (len != copts->create_id_len || 0 != strcmp(copts->create_id, str)) {
+            if (NULL == copts->create_id || len != copts->create_id_len || 0 != strcmp(copts->create_id, str)) {
+                if (owned) {
+                    OJ_R_FREE((char *)copts->create_id);
+                }
                 copts->create_id = OJ_R_ALLOC_N(char, len + 1);
                 strcpy((char *)copts->create_id, str);
                 copts->create_id_len = len;
@@ -855,7 +1080,7 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
         }
     } else if (nan_sym == k) {
         if (Qnil == v) {
-            return ST_CONTINUE;
+            return true;
         }
         if (null_sym == v) {
             copts->dump_opts.nan_dump = NullNan;
@@ -872,7 +1097,7 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
         }
     } else if (omit_nil_sym == k) {
         if (Qnil == v) {
-            return ST_CONTINUE;
+            return true;
         }
         if (Qtrue == v) {
             copts->dump_opts.omit_nil = true;
@@ -883,7 +1108,7 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
         }
     } else if (omit_null_byte_sym == k) {
         if (Qnil == v) {
-            return ST_CONTINUE;
+            return true;
         }
         if (Qtrue == v) {
             copts->dump_opts.omit_null_byte = true;
@@ -921,7 +1146,11 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
             copts->array_class = v;
         }
     } else if (ignore_sym == k) {
-        OJ_R_FREE(copts->ignore);
+        // Only free when replacing the defaults; a per-call copy's ignore still
+        // aliases the default-owned buffer, which oj_free_call_options() frees.
+        if (&oj_default_options == copts) {
+            OJ_R_FREE(copts->ignore);
+        }
         copts->ignore = NULL;
         if (Qnil != v) {
             size_t cnt;
@@ -940,7 +1169,7 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
         }
     } else if (integer_range_sym == k) {
         if (Qnil == v) {
-            return ST_CONTINUE;
+            return true;
         }
         if (rb_obj_class(v) == rb_cRange) {
             VALUE min = rb_funcall(v, oj_begin_id, 0);
@@ -955,9 +1184,23 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
         } else if (Qfalse != v) {
             rb_raise(rb_eArgError, ":integer_range must be a range of Fixnum.");
         }
+    } else if (max_integer_digits_sym == k) {
+        if (Qnil == v || Qfalse == v) {
+            copts->max_integer_digits = 0;
+        } else if (T_FIXNUM == rb_type(v)) {
+            long n = FIX2LONG(v);
+
+            if (n < 0) {
+                rb_raise(rb_eArgError, ":max_integer_digits must be >= 0.");
+            }
+
+            copts->max_integer_digits = (size_t)n;
+        } else {
+            rb_raise(rb_eArgError, ":max_integer_digits must be a non-negative Integer.");
+        }
     } else if (symbol_keys_sym == k || oj_symbolize_names_sym == k) {
         if (Qnil == v) {
-            return ST_CONTINUE;
+            return true;
         }
         copts->sym_key = (Qtrue == v) ? Yes : No;
 
@@ -977,23 +1220,180 @@ static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
         if (6 < RSTRING_LEN(v)) {
             rb_raise(rb_eArgError, ":float_format must be 6 bytes or less.");
         }
+        validate_float_format(RSTRING_PTR(v), (size_t)RSTRING_LEN(v));
         strncpy(copts->float_fmt, RSTRING_PTR(v), (size_t)RSTRING_LEN(v));
         copts->float_fmt[RSTRING_LEN(v)] = '\0';
+    } else if (only_sym == k) {
+        // Only free when replacing the defaults; a per-call copy's pointer still
+        // aliases the default-owned buffer, which oj_free_call_options() frees.
+        if (&oj_default_options == copts && NULL != copts->dump_opts.only) {
+            OJ_R_FREE((void *)copts->dump_opts.only);
+        }
+        copts->dump_opts.only = make_only_value(v);
+    } else if (except_sym == k) {
+        if (&oj_default_options == copts && NULL != copts->dump_opts.except) {
+            OJ_R_FREE((void *)copts->dump_opts.except);
+        }
+        copts->dump_opts.except = make_only_value(v);
+    } else {
+        return false;
+    }
+    return true;
+}
+
+// Collects the return of parse_one_option() over every key in a hash.
+struct _optsParse {
+    Options copts;
+    bool    consumed;
+};
+
+static int parse_options_cb(VALUE k, VALUE v, VALUE opts) {
+    struct _optsParse *op = (struct _optsParse *)opts;
+
+    if (parse_one_option(k, v, op->copts)) {
+        op->consumed = true;
     }
     return ST_CONTINUE;
 }
 
-void oj_parse_options(VALUE ropts, Options copts) {
+// Apply the options in ropts to copts and report whether any key was
+// recognized. A hash of nothing but unknown keys leaves copts untouched and
+// returns false.
+bool oj_parse_options_consumed(VALUE ropts, Options copts) {
+    struct _optsParse op = {copts, false};
+
     if (T_HASH != rb_type(ropts)) {
-        return;
+        return false;
+    }
+    rb_hash_foreach(ropts, parse_options_cb, (VALUE)&op);
+    if (Qnil != rb_hash_lookup(ropts, match_string_sym)) {
+        op.consumed = true;
     }
-    rb_hash_foreach(ropts, parse_options_cb, (VALUE)copts);
     oj_parse_opt_match_string(&copts->str_rx, ropts);
 
     copts->dump_opts.use = (0 < copts->dump_opts.indent_size || 0 < copts->dump_opts.after_size ||
                             0 < copts->dump_opts.before_size || 0 < copts->dump_opts.hash_size ||
                             0 < copts->dump_opts.array_size);
-    return;
+
+    return op.consumed;
+}
+
+void oj_parse_options(VALUE ropts, Options copts) {
+    oj_parse_options_consumed(ropts, copts);
+}
+
+// Free the option buffers that oj_parse_options() allocated for a single call.
+// A per-call options struct is a copy of oj_default_options, so its create_id,
+// ignore, only, and except members initially alias the ones owned by the
+// defaults. Only free a member when it differs from the default, i.e. when it
+// was allocated for this call; the default-owned buffers must be left alone.
+void oj_free_call_options(Options copts) {
+    if (NULL != copts->create_id && oj_default_options.create_id != copts->create_id) {
+        OJ_R_FREE((char *)copts->create_id);
+        copts->create_id     = NULL;
+        copts->create_id_len = 0;
+    }
+    if (NULL != copts->ignore && oj_default_options.ignore != copts->ignore) {
+        OJ_R_FREE(copts->ignore);
+        copts->ignore = NULL;
+    }
+    if (NULL != copts->dump_opts.only && oj_default_options.dump_opts.only != copts->dump_opts.only) {
+        OJ_R_FREE((void *)copts->dump_opts.only);
+        copts->dump_opts.only = NULL;
+    }
+    if (NULL != copts->dump_opts.except && oj_default_options.dump_opts.except != copts->dump_opts.except) {
+        OJ_R_FREE((void *)copts->dump_opts.except);
+        copts->dump_opts.except = NULL;
+    }
+}
+
+static char *dup_option_str(const char *str, size_t len) {
+    char *buf = OJ_R_ALLOC_N(char, len + 1);
+
+    memcpy(buf, str, len);
+    buf[len] = '\0';
+
+    return buf;
+}
+
+// Give an options struct private copies of the option buffers it still shares
+// with the defaults so that it owns all of them.
+//
+// An options struct that outlives the call it was created in can not rely on
+// the default-owned buffers it aliases: Oj.default_options= is free to replace
+// them at any time, which would leave the alias dangling. Call this once, in
+// the call that creates such an object and after oj_parse_options(), then free
+// the buffers with oj_options_release() when the object is collected.
+void oj_options_take_ownership(Options copts) {
+    if (NULL != copts->create_id && oj_default_options.create_id == copts->create_id) {
+        copts->create_id = dup_option_str(copts->create_id, copts->create_id_len);
+    }
+    if (NULL != copts->ignore && oj_default_options.ignore == copts->ignore) {
+        VALUE *vp;
+        VALUE *buf;
+        size_t cnt = 0;
+
+        for (vp = copts->ignore; Qnil != *vp; vp++) {
+            cnt++;
+        }
+        buf = OJ_R_ALLOC_N(VALUE, cnt + 1);
+        memcpy(buf, copts->ignore, sizeof(VALUE) * (cnt + 1));
+        copts->ignore = buf;
+    }
+    if (NULL != copts->dump_opts.only && oj_default_options.dump_opts.only == copts->dump_opts.only) {
+        copts->dump_opts.only = dup_option_str(copts->dump_opts.only, strlen(copts->dump_opts.only));
+    }
+    if (NULL != copts->dump_opts.except && oj_default_options.dump_opts.except == copts->dump_opts.except) {
+        copts->dump_opts.except = dup_option_str(copts->dump_opts.except, strlen(copts->dump_opts.except));
+    }
+}
+
+// Free the option buffers of an options struct that owns all of them, i.e. one
+// that oj_options_take_ownership() was called on. Unlike oj_free_call_options()
+// this never looks at the defaults, so it is safe to call from a GC free
+// function, where the defaults may have been replaced since the object was
+// created.
+void oj_options_release(Options copts) {
+    if (NULL != copts->create_id) {
+        OJ_R_FREE((char *)copts->create_id);
+        copts->create_id     = NULL;
+        copts->create_id_len = 0;
+    }
+    if (NULL != copts->ignore) {
+        OJ_R_FREE(copts->ignore);
+        copts->ignore = NULL;
+    }
+    if (NULL != copts->dump_opts.only) {
+        OJ_R_FREE((void *)copts->dump_opts.only);
+        copts->dump_opts.only = NULL;
+    }
+    if (NULL != copts->dump_opts.except) {
+        OJ_R_FREE((void *)copts->dump_opts.except);
+        copts->dump_opts.except = NULL;
+    }
+    // The str_rx chain is detached from the defaults when the owner is created
+    // so the chain, if there is one, was built for this options struct alone.
+    oj_rxclass_cleanup(&copts->str_rx);
+}
+
+// Mark the Ruby objects held by an owned options struct. A long lived object
+// such as a writer or an encoder can be the only reference to the classes in
+// the options so without this they could be collected while the owner is still
+// alive leaving the options with dangling VALUEs.
+void oj_options_mark(Options copts) {
+    if (Qnil != copts->hash_class) {
+        rb_gc_mark(copts->hash_class);
+    }
+    if (Qnil != copts->array_class) {
+        rb_gc_mark(copts->array_class);
+    }
+    if (NULL != copts->ignore) {
+        VALUE *vp;
+
+        for (vp = copts->ignore; Qnil != *vp; vp++) {
+            rb_gc_mark(*vp);
+        }
+    }
 }
 
 static int match_string_cb(VALUE key, VALUE value, VALUE rx) {
@@ -1287,6 +1687,7 @@ static VALUE dump_ensure(VALUE a) {
     volatile struct dump_arg *arg = (void *)a;
 
     oj_out_free(arg->out);
+    oj_free_call_options(arg->copts);
 
     return Qnil;
 }
@@ -1402,6 +1803,7 @@ static VALUE to_file(int argc, VALUE *argv, VALUE self) {
         oj_parse_options(argv[2], &copts);
     }
     oj_write_obj_to_file(argv[1], StringValuePtr(*argv), &copts);
+    oj_free_call_options(&copts);
 
     return Qnil;
 }
@@ -1423,6 +1825,7 @@ static VALUE to_stream(int argc, VALUE *argv, VALUE self) {
         oj_parse_options(argv[2], &copts);
     }
     oj_write_obj_to_stream(argv[1], *argv, &copts);
+    oj_free_call_options(&copts);
 
     return Qnil;
 }
@@ -1780,6 +2183,78 @@ static VALUE mem_report(VALUE self) {
  *
  * - *:wab* specifically for WAB data exchange.
  */
+
+// =============================================================================
+// Runtime SIMD CPU detection
+// Cross-platform support for Windows (MSVC), Linux, and macOS (GCC/Clang)
+// =============================================================================
+SIMD_Implementation oj_get_simd_implementation(void) {
+#ifdef HAVE_SIMD_X86
+    // x86/x86_64 runtime detection
+
+#if defined(_MSC_VER)
+    // MSVC: Use __cpuid intrinsic
+    int cpu_info[4];
+    __cpuid(cpu_info, 1);
+
+    // Check for SSE4.2 (bit 20 of ECX)
+    if (cpu_info[2] & (1 << 20)) {
+        return SIMD_SSE42;
+    }
+    // Check for SSE2 (bit 26 of EDX)
+    if (cpu_info[3] & (1 << 26)) {
+        return SIMD_SSE2;
+    }
+
+#elif defined(__GNUC__) || defined(__clang__)
+    // GCC/Clang: Use __builtin_cpu_supports if available
+#if defined(__has_builtin)
+#if __has_builtin(__builtin_cpu_supports)
+#define OJ_HAS_BUILTIN_CPU_SUPPORTS 1
+#endif
+#elif defined(__GNUC__) && (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 8))
+    // GCC 4.8+ has __builtin_cpu_supports
+#define OJ_HAS_BUILTIN_CPU_SUPPORTS 1
+#endif
+
+#ifdef OJ_HAS_BUILTIN_CPU_SUPPORTS
+#ifdef HAVE_SIMD_SSE4_2
+    if (__builtin_cpu_supports("sse4.2")) {
+        return SIMD_SSE42;
+    }
+#endif
+#ifdef HAVE_SIMD_SSE2
+    if (__builtin_cpu_supports("sse2")) {
+        return SIMD_SSE2;
+    }
+#endif
+#else
+    // Fallback: Use CPUID instruction directly
+    unsigned int eax, ebx, ecx, edx;
+    if (__get_cpuid(1, &eax, &ebx, &ecx, &edx)) {
+        // Check for SSE4.2 (bit 20 of ECX)
+        if (ecx & (1 << 20)) {
+            return SIMD_SSE42;
+        }
+        // Check for SSE2 (bit 26 of EDX)
+        if (edx & (1 << 26)) {
+            return SIMD_SSE2;
+        }
+    }
+#endif  // OJ_HAS_BUILTIN_CPU_SUPPORTS
+
+#endif  // _MSC_VER vs GCC/Clang
+
+#endif  // HAVE_SIMD_X86
+
+#ifdef HAVE_SIMD_NEON
+    // ARM NEON is always available on ARM64 and detected at compile time
+    return SIMD_NEON;
+#endif
+
+    return SIMD_NONE;
+}
+
 void Init_oj(void) {
     int err = 0;
 
@@ -1953,6 +2428,8 @@ void Init_oj(void) {
     rb_gc_register_address(&escape_mode_sym);
     integer_range_sym = ID2SYM(rb_intern("integer_range"));
     rb_gc_register_address(&integer_range_sym);
+    max_integer_digits_sym = ID2SYM(rb_intern("max_integer_digits"));
+    rb_gc_register_address(&max_integer_digits_sym);
     fast_sym = ID2SYM(rb_intern("fast"));
     rb_gc_register_address(&fast_sym);
     float_format_sym = ID2SYM(rb_intern("float_format"));
@@ -2059,6 +2536,10 @@ void Init_oj(void) {
     rb_gc_register_address(&xmlschema_sym);
     xss_safe_sym = ID2SYM(rb_intern("xss_safe"));
     rb_gc_register_address(&xss_safe_sym);
+    only_sym = ID2SYM(rb_intern("only"));
+    rb_gc_register_address(&only_sym);
+    except_sym = ID2SYM(rb_intern("except"));
+    rb_gc_register_address(&except_sym);
 
     oj_slash_string = rb_str_new2("/");
     rb_gc_register_address(&oj_slash_string);
@@ -2080,10 +2561,18 @@ void Init_oj(void) {
 #endif
     oj_init_doc();
 
+    SIMD_Impl = oj_get_simd_implementation();
+
     oj_parser_init();
     oj_scanner_init();
 
 #ifdef HAVE_SIMD_NEON
     initialize_neon();
 #endif /* HAVE_SIMD_NEON */
+
+#ifdef HAVE_SIMD_SSE4_2
+    if (SIMD_Impl == SIMD_SSE42) {
+        initialize_sse42();
+    }
+#endif /* HAVE_SIMD_SSE4_2 */
 }