oj 3.16.16 → 3.17.3

data/ext/oj/safe.c

@@ -0,0 +1,230 @@
+
+#include "safe.h"
+
+static VALUE max_hash_size_sym, max_array_size_sym, max_depth_sym, max_total_elements_sym, max_hash_size_error_class,
+    max_array_size_error_class, max_depth_error_class, max_total_elements_error_class;
+
+static void check_object_size(safe_T safe) {
+    if (NIL_P(safe->max_hash_size)) {
+        return;
+    }
+
+    struct _usual usual                   = safe->usual;
+    Col           current_object_location = usual.ctail - 1;
+
+    long int number_of_items_in_stack = usual.vtail - usual.vhead;
+    long int number_of_items_in_hash  = (number_of_items_in_stack - current_object_location->vi - 1) / 2;
+
+    if (safe->max_hash_size > number_of_items_in_hash) {
+        return;
+    }
+
+    rb_raise(max_hash_size_error_class, "Too many object items!");
+}
+
+static void check_array_size(safe_T safe) {
+    if (NIL_P(safe->max_array_size)) {
+        return;
+    }
+
+    struct _usual usual                   = safe->usual;
+    Col           current_object_location = usual.ctail - 1;
+
+    long int number_of_items_in_stack = usual.vtail - usual.vhead;
+    long int number_of_items_in_array = number_of_items_in_stack - current_object_location->vi - 1;
+
+    if (safe->max_array_size > number_of_items_in_array) {
+        return;
+    }
+
+    rb_raise(max_array_size_error_class, "Too many array items!");
+}
+
+static void check_max_depth(safe_T safe, ojParser p) {
+    if (NIL_P(safe->max_depth) || safe->max_depth >= (p->depth + 1)) {
+        return;
+    }
+
+    rb_raise(max_depth_error_class, "JSON is too deep!");
+}
+
+static void check_max_total_elements(safe_T safe) {
+    /*
+    * We check if `max_total_elements` is greater than `current_elements_count`
+    * (instead of greater than or equal) because top-level elements (e.g., [],
+    * null, true) are not counted. As a result, `current_elements_count`
+    * always holds one less than the actual total.
+    */
+    if (NIL_P(safe->max_total_elements) || safe->max_total_elements > safe->current_elements_count) {
+        return;
+    }
+
+    rb_raise(max_total_elements_error_class, "Too many elements!");
+}
+
+static void safe_start(ojParser p) {
+    safe_T safe = (safe_T)p->ctx;
+
+    safe->current_hash_size      = 0;
+    safe->current_array_size     = 0;
+    safe->current_elements_count = 0;
+
+    safe->delegated_start_func(p);
+}
+
+static void safe_open_object(ojParser p) {
+    safe_T safe = (safe_T)p->ctx;
+
+    safe->current_hash_size++;
+    safe->current_elements_count++;
+
+    check_array_size(safe);
+    check_max_depth(safe, p);
+    check_max_total_elements(safe);
+
+    safe->delegated_open_object_func(p);
+}
+
+static void safe_open_array(ojParser p) {
+    safe_T safe = (safe_T)p->ctx;
+
+    safe->current_array_size++;
+    safe->current_elements_count++;
+
+    check_array_size(safe);
+    check_max_depth(safe, p);
+    check_max_total_elements(safe);
+
+    safe->delegated_open_array_func(p);
+}
+
+DEFINE_DELEGATED_FUNCTION(add_null);
+DEFINE_DELEGATED_FUNCTION(add_true);
+DEFINE_DELEGATED_FUNCTION(add_false);
+DEFINE_DELEGATED_FUNCTION(add_int);
+DEFINE_DELEGATED_FUNCTION(add_float);
+DEFINE_DELEGATED_FUNCTION(add_big);
+DEFINE_DELEGATED_FUNCTION(add_str);
+
+static void safe_open_object_key(ojParser p) {
+    safe_T safe = (safe_T)p->ctx;
+
+    safe->current_hash_size++;
+    safe->current_elements_count += 2;
+
+    check_object_size(safe);
+    check_max_depth(safe, p);
+    check_max_total_elements(safe);
+
+    safe->delegated_open_object_key_func(p);
+}
+
+static void safe_open_array_key(ojParser p) {
+    safe_T safe = (safe_T)p->ctx;
+
+    safe->current_array_size++;
+    safe->current_elements_count += 2;
+
+    check_object_size(safe);
+    check_max_depth(safe, p);
+    check_max_total_elements(safe);
+
+    safe->delegated_open_array_key_func(p);
+}
+
+DEFINE_DELEGATED_OBJECT_FUNCTION(add_null);
+DEFINE_DELEGATED_OBJECT_FUNCTION(add_true);
+DEFINE_DELEGATED_OBJECT_FUNCTION(add_false);
+DEFINE_DELEGATED_OBJECT_FUNCTION(add_int);
+DEFINE_DELEGATED_OBJECT_FUNCTION(add_float);
+DEFINE_DELEGATED_OBJECT_FUNCTION(add_big);
+DEFINE_DELEGATED_OBJECT_FUNCTION(add_str);
+
+void oj_init_safe_parser(ojParser p, safe_T safe, VALUE options) {
+    // Safe parser inherits all members of usual parser
+    oj_init_usual(p, &safe->usual);
+
+    safe->delegated_start_func = p->start;
+    p->start                   = safe_start;
+
+    Funcs f;
+
+    // Array parser functions
+    f                                = &p->funcs[ARRAY_FUN];
+    safe->delegated_open_object_func = f->open_object;
+    f->open_object                   = safe_open_object;
+    safe->delegated_open_array_func  = f->open_array;
+    f->open_array                    = safe_open_array;
+    // The following overrides are done for counting objects
+    safe->delegated_add_null_func  = f->add_null;
+    f->add_null                    = safe_add_null;
+    safe->delegated_add_true_func  = f->add_true;
+    f->add_true                    = safe_add_true;
+    safe->delegated_add_false_func = f->add_false;
+    f->add_false                   = safe_add_false;
+    safe->delegated_add_int_func   = f->add_int;
+    f->add_int                     = safe_add_int;
+    safe->delegated_add_float_func = f->add_float;
+    f->add_float                   = safe_add_float;
+    safe->delegated_add_big_func   = f->add_big;
+    f->add_big                     = safe_add_big;
+    safe->delegated_add_str_func   = f->add_str;
+    f->add_str                     = safe_add_str;
+
+    // Object parser functions
+    f                                    = &p->funcs[OBJECT_FUN];
+    safe->delegated_open_object_key_func = f->open_object;
+    f->open_object                       = safe_open_object_key;
+    safe->delegated_open_array_key_func  = f->open_array;
+    f->open_array                        = safe_open_array_key;
+    // The following overrides are done for counting objects
+    safe->delegated_add_null_key_func  = f->add_null;
+    f->add_null                        = safe_add_null_key;
+    safe->delegated_add_true_key_func  = f->add_true;
+    f->add_true                        = safe_add_true_key;
+    safe->delegated_add_false_key_func = f->add_false;
+    f->add_false                       = safe_add_false_key;
+    safe->delegated_add_int_key_func   = f->add_int;
+    f->add_int                         = safe_add_int_key;
+    safe->delegated_add_float_key_func = f->add_float;
+    f->add_float                       = safe_add_float_key;
+    safe->delegated_add_big_key_func   = f->add_big;
+    f->add_big                         = safe_add_big_key;
+    safe->delegated_add_str_key_func   = f->add_str;
+    f->add_str                         = safe_add_str_key;
+
+    SET_CONFIG(max_hash_size);
+    SET_CONFIG(max_array_size);
+    SET_CONFIG(max_depth);
+    SET_CONFIG(max_total_elements);
+}
+
+void oj_set_parser_safe(ojParser p, VALUE options) {
+    safe_T s = OJ_R_ALLOC(struct _safe_S);
+
+    oj_init_safe_parser(p, s, options);
+}
+
+void oj_safe_init(VALUE parser_class) {
+    VALUE validation_error_class = rb_define_class_under(parser_class, "ValidationError", rb_eRuntimeError);
+
+    max_hash_size_error_class      = rb_define_class_under(parser_class, "HashSizeError", validation_error_class);
+    max_array_size_error_class     = rb_define_class_under(parser_class, "ArraySizeError", validation_error_class);
+    max_depth_error_class          = rb_define_class_under(parser_class, "DepthError", validation_error_class);
+    max_total_elements_error_class = rb_define_class_under(parser_class, "TotalElementsError", validation_error_class);
+
+    rb_gc_register_address(&max_hash_size_error_class);
+    rb_gc_register_address(&max_array_size_error_class);
+    rb_gc_register_address(&max_depth_error_class);
+    rb_gc_register_address(&max_total_elements_error_class);
+
+    max_hash_size_sym      = ID2SYM(rb_intern("max_hash_size"));
+    max_array_size_sym     = ID2SYM(rb_intern("max_array_size"));
+    max_depth_sym          = ID2SYM(rb_intern("max_depth"));
+    max_total_elements_sym = ID2SYM(rb_intern("max_total_elements"));
+
+    rb_gc_register_address(&max_hash_size_sym);
+    rb_gc_register_address(&max_array_size_sym);
+    rb_gc_register_address(&max_depth_sym);
+    rb_gc_register_address(&max_total_elements_sym);
+}

data/ext/oj/safe.h

@@ -0,0 +1,79 @@
+#include <ruby.h>
+
+#include "parser.h"
+#include "usual.h"
+
+#define SET_CONFIG(config_name)                                                        \
+    do {                                                                               \
+        VALUE rb_##config_name = rb_hash_aref(options, config_name##_sym);             \
+                                                                                       \
+        if (RB_INTEGER_TYPE_P(rb_##config_name)) {                                     \
+            safe->config_name = NUM2LONG(rb_##config_name);                            \
+        } else if (!NIL_P(rb_##config_name)) {                                         \
+            rb_raise(rb_eArgError, "Incorrect value provided for `" #config_name "`"); \
+        } else {                                                                       \
+            safe->config_name = Qnil;                                                  \
+        }                                                                              \
+    } while (0);
+
+#define DEFINE_DELEGATED_FUNCTION(function_name)   \
+    static void safe_##function_name(ojParser p) { \
+        safe_T safe = (safe_T)p->ctx;              \
+                                                   \
+        safe->current_elements_count++;            \
+                                                   \
+        check_array_size(safe);                    \
+        check_max_total_elements(safe);            \
+                                                   \
+        safe->delegated_##function_name##_func(p); \
+    }
+
+#define DEFINE_DELEGATED_OBJECT_FUNCTION(function_name)  \
+    static void safe_##function_name##_key(ojParser p) { \
+        safe_T safe = (safe_T)p->ctx;                    \
+                                                         \
+        safe->current_elements_count += 2;               \
+                                                         \
+        check_object_size(safe);                         \
+        check_max_total_elements(safe);                  \
+                                                         \
+        safe->delegated_##function_name##_key_func(p);   \
+    }
+
+typedef struct _safe_S {
+    struct _usual usual;
+
+    long int max_hash_size;
+    long int max_array_size;
+    long int max_depth;
+    long int max_total_elements;
+    long int max_json_size_bytes;
+
+    long int current_hash_size;
+    long int current_array_size;
+    long int current_elements_count;
+
+    void (*delegated_start_func)(struct _ojParser *p);
+
+    // Array functions
+    void (*delegated_open_object_func)(struct _ojParser *p);
+    void (*delegated_open_array_func)(struct _ojParser *p);
+    void (*delegated_add_null_func)(struct _ojParser *p);
+    void (*delegated_add_true_func)(struct _ojParser *p);
+    void (*delegated_add_false_func)(struct _ojParser *p);
+    void (*delegated_add_int_func)(struct _ojParser *p);
+    void (*delegated_add_float_func)(struct _ojParser *p);
+    void (*delegated_add_big_func)(struct _ojParser *p);
+    void (*delegated_add_str_func)(struct _ojParser *p);
+
+    // Object functions
+    void (*delegated_open_object_key_func)(struct _ojParser *p);
+    void (*delegated_open_array_key_func)(struct _ojParser *p);
+    void (*delegated_add_null_key_func)(struct _ojParser *p);
+    void (*delegated_add_true_key_func)(struct _ojParser *p);
+    void (*delegated_add_false_key_func)(struct _ojParser *p);
+    void (*delegated_add_int_key_func)(struct _ojParser *p);
+    void (*delegated_add_float_key_func)(struct _ojParser *p);
+    void (*delegated_add_big_key_func)(struct _ojParser *p);
+    void (*delegated_add_str_key_func)(struct _ojParser *p);
+} *safe_T;

data/ext/oj/saj.c

@@ -648,8 +648,16 @@ oj_saj_parse(int argc, VALUE *argv, VALUE self) {
             len = lseek(fd, 0, SEEK_END);
             lseek(fd, 0, SEEK_SET);
             json = OJ_R_ALLOC_N(char, len + 1);
-            if (0 >= (cnt = read(fd, json, len)) || cnt != (ssize_t)len) {
-                rb_raise(rb_eIOError, "failed to read from IO Object.");
+            {
+                size_t total = 0;
+
+                while (total < len) {
+                    cnt = read(fd, json + total, len - total);
+                    if (cnt <= 0) {
+                        rb_raise(rb_eIOError, "failed to read from IO Object.");
+                    }
+                    total += cnt;
+                }
             }
             json[len] = '\0';
 #endif

data/ext/oj/simd.h

@@ -191,4 +191,29 @@ static inline OJ_TARGET_SSE42 __m128i vector_lookup_sse42(__m128i input, __m128i
 
 #endif
 
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+
+#if __has_builtin(__builtin_memcpy)
+#define HAVE_FAST_MEMCPY 1
+
+inline static void fast_memcpy16(void *dest, const void *src, size_t n) {
+    char *d = (char *)dest;
+    char *s = (char *)src;
+    if (n >= 8) {
+        __builtin_memcpy(d, s, 8);
+        __builtin_memcpy(d + n - 8, s + n - 8, 8);
+    } else if (n >= 4) {
+        __builtin_memcpy(d, s, 4);
+        __builtin_memcpy(d + n - 4, s + n - 4, 4);
+    } else if (n >= 2) {
+        __builtin_memcpy(d, s, 2);
+        __builtin_memcpy(d + n - 2, s + n - 2, 2);
+    } else if (n >= 1) {
+        *d = *s;
+    }
+}
+#endif
+
 #endif /* OJ_SIMD_H */

data/ext/oj/sparse.c

@@ -399,6 +399,7 @@ static void read_num(ParseInfo pi) {
     char            c;
 
     reader_protect(&pi->rd);
+    ni.pi       = pi;
     ni.i        = 0;
     ni.num      = 0;
     ni.div      = 1;
@@ -415,7 +416,7 @@ static void read_num(ParseInfo pi) {
         ni.bigdec_load = pi->options.compat_bigdec;
     } else {
         ni.no_big      = (FloatDec == pi->options.bigdec_load || FastDec == pi->options.bigdec_load ||
-                     RubyDec == pi->options.bigdec_load);
+                          RubyDec == pi->options.bigdec_load);
         ni.bigdec_load = pi->options.bigdec_load;
     }
 
@@ -549,6 +550,7 @@ static void read_nan(ParseInfo pi) {
     struct _numInfo ni;
     char            c;
 
+    ni.pi       = pi;
     ni.str      = pi->rd.str;
     ni.i        = 0;
     ni.num      = 0;
@@ -565,7 +567,7 @@ static void read_nan(ParseInfo pi) {
         ni.bigdec_load = pi->options.compat_bigdec;
     } else {
         ni.no_big      = (FloatDec == pi->options.bigdec_load || FastDec == pi->options.bigdec_load ||
-                     RubyDec == pi->options.bigdec_load);
+                          RubyDec == pi->options.bigdec_load);
         ni.bigdec_load = pi->options.bigdec_load;
     }
 
@@ -745,6 +747,7 @@ void oj_sparse2(ParseInfo pi) {
                     oj_set_error_at(pi, oj_parse_error_class, __FILE__, __LINE__, "expected NaN");
                     return;
                 }
+                ni.pi       = pi;
                 ni.str      = pi->rd.str;
                 ni.i        = 0;
                 ni.num      = 0;
@@ -761,7 +764,7 @@ void oj_sparse2(ParseInfo pi) {
                     ni.bigdec_load = pi->options.compat_bigdec;
                 } else {
                     ni.no_big      = (FloatDec == pi->options.bigdec_load || FastDec == pi->options.bigdec_load ||
-                                 RubyDec == pi->options.bigdec_load);
+                                      RubyDec == pi->options.bigdec_load);
                     ni.bigdec_load = pi->options.bigdec_load;
                 }
                 add_num_value(pi, &ni);

data/ext/oj/usual.c

@@ -63,7 +63,7 @@ static VALUE form_attr(const char *str, size_t len) {
         memcpy(b + 1, str, len);
         b[len + 1] = '\0';
 
-        id = rb_intern3(buf, len + 1, oj_utf8_encoding);
+        id = rb_intern3(b, len + 1, oj_utf8_encoding);
         OJ_R_FREE(b);
         return id;
     }
@@ -200,7 +200,10 @@ static void push_key(ojParser p) {
         d->ktail = d->khead + pos;
         d->kend  = d->khead + cap;
     }
-    d->ktail->len = klen;
+    if (32000 < klen) {
+        rb_raise(oj_json_parser_error_class, "Key too long. Keys are limited to 32,000 bytes.");
+    }
+    d->ktail->len = (int16_t)klen;
     if (klen < sizeof(d->ktail->buf)) {
         memcpy(d->ktail->buf, key, klen);
         d->ktail->buf[klen] = '\0';
@@ -608,12 +611,16 @@ static void dfree(ojParser p) {
     Usual d = (Usual)p->ctx;
 
     cache_free(d->str_cache);
+    d->str_cache = NULL;
     cache_free(d->attr_cache);
+    d->attr_cache = NULL;
     if (NULL != d->sym_cache) {
         cache_free(d->sym_cache);
+        d->sym_cache = NULL;
     }
     if (NULL != d->class_cache) {
         cache_free(d->class_cache);
+        d->class_cache = NULL;
     }
     OJ_R_FREE(d->vhead);
     OJ_R_FREE(d->chead);
@@ -640,6 +647,12 @@ static void mark(ojParser p) {
     if (NULL != d->class_cache) {
         cache_mark(d->class_cache);
     }
+    if (Qnil != d->hash_class) {
+        rb_gc_mark(d->hash_class);
+    }
+    if (Qnil != d->array_class) {
+        rb_gc_mark(d->array_class);
+    }
     for (vp = d->vhead; vp < d->vtail; vp++) {
         if (Qundef != *vp) {
             rb_gc_mark(*vp);
@@ -1050,10 +1063,10 @@ static VALUE opt_symbol_keys_set(ojParser p, VALUE value) {
         if (NULL != d->sym_cache) {
             cache_free(d->sym_cache);
             d->sym_cache = NULL;
+            d->key_cache = NULL;
         }
-        if (!d->cache_keys) {
-            d->get_key = str_key;
-        }
+        d->cache_keys = false;
+        d->get_key    = str_key;
     }
     return (NULL != d->sym_cache) ? Qtrue : Qfalse;
 }

data/ext/oj/wab.c

@@ -19,7 +19,7 @@
 // Workaround in case INFINITY is not defined in math.h or if the OS is CentOS
 #define OJ_INFINITY (1.0 / 0.0)
 
-static char hex_chars[256] = "\
+static char hex_chars[257] = "\
 ................................\
 ................xxxxxxxxxx......\
 .xxxxxx.........................\

data/lib/oj/version.rb

@@ -1,4 +1,4 @@
 module Oj
   # Current version of the module.
-  VERSION = '3.16.16'
+  VERSION = '3.17.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: oj
 version: !ruby/object:Gem::Version
-  version: 3.16.16
+  version: 3.17.3
 platform: ruby
 authors:
 - Peter Ohler
@@ -158,6 +158,8 @@ files:
 - ext/oj/resolve.h
 - ext/oj/rxclass.c
 - ext/oj/rxclass.h
+- ext/oj/safe.c
+- ext/oj/safe.h
 - ext/oj/saj.c
 - ext/oj/saj2.c
 - ext/oj/saj2.h
@@ -229,7 +231,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: A fast JSON parser and serializer.
 test_files: []