oj 3.17.1 → 3.17.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a7515f34ac9c85f3e60f14c886bf3701f41fd077bdc518c71c6125e6ca7913db
-  data.tar.gz: f4a5cab57b8fc728e7ec4aac4dbc672d26b69f83f6aa31c98c6d6237892f6bdc
+  metadata.gz: af3a1f2b343eefacdaeb1f82d4b48fe67bece49e4aae63ad46aa878f726ae3de
+  data.tar.gz: 8cd6e1ac300706f39d434cbbba52ea780a96b761ba2090d3d3624185bc021819
 SHA512:
-  metadata.gz: 0aa115483a049bb1a9b406d3d9fa1dda4dcb47cf50236301f5ea9acca4c21b20118a027462e384d60c0cb287be92a80b163dc924f58a93a0f5998d0f2e577f4c
-  data.tar.gz: 2f31c241a2283f353bf503eb54d89921643ec5fdc0ecb8166c31d68b5deb79fb26f68ea412155cc17dc5734bce9a85451bd798c600365428d5f389eabdc41346
+  metadata.gz: e081fafa7bd5af792fef91dc58612d6ea85bdae7b3d709bbd945773a5ad9d1feec4c88e3844aa403098c3fa267814ef61dcbba5fb4d9ee86a239eecf5b3926fa
+  data.tar.gz: 339ba6bedb36fb30a382f8cb5037053a4197d4e9364bb11f50b79ec6ec3002cdd687868e140fec1dacabdc9cfa972a45cfcd6cb8a85e4c4148cd484f56278004

data/CHANGELOG.md

@@ -1,5 +1,92 @@
 # CHANGELOG
 
+## 3.17.6 - 2026-08-10
+
+- Fixed issue #1092, where the encoder ActiveSupport 8.1 caches with `escape: false` froze the options as they stood before `set_encoder` wrote `time_precision` into them, so `to_json(escape: false)` emitted 9 fractional digits. An options hash that names no option Oj knows no longer detaches an encoder from the defaults. (#1093)
+
+## 3.17.5 - 2026-07-31
+
+Most of this release comes out of a security review of the C extension. There are no API changes.
+
+### Memory safety
+
+- Fixed hash flooding by seeding the key hash per process. The hash was decided entirely at compile time, so a document of colliding keys turned key interning into O(n^2) and left the process slow for every later parse. (#1053)
+- Fixed a one byte buffer over-read on a document that ends with a backslash inside an unterminated string. (#1054)
+- Fixed two length underflows that made an empty `^m` value and a key of exactly 65,536 bytes read forward until they left mapped memory. (#1055)
+- Fixed a SEGV from type confusion in class path resolution. A name segment that resolved to something other than a class or module was dereferenced as one. (#1056)
+- Fixed uninitialized stack memory being read into the message of an unresolved class name error. (#1057)
+- Fixed output buffer overflows when writing indentation, where several callers of `fill_indent()` had not assured the buffer first. (#1058)
+- Fixed the `Oj::Doc` path depth limit being checked one level too late. (#1061)
+- Fixed the use-after-free of a key when the value stack grows. (#1062)
+- Fixed the buffer over-read when a document ends where a key belongs. (#1063)
+- Fixed the id from a circular reference being used unchecked. (#1064)
+- Fixed the SEGV dumping an exception that was never raised, where the missing backtrace was read as an Array. (#1068)
+- Fixed the stack buffer overflow writing the error location. (#1071)
+- Fixed a read error in `Oj::Parser#file` being taken as a read of `SIZE_MAX` bytes, which wrote in front of the buffer and then reparsed it forever without checking for interrupts. (#1072)
+- Fixed a `:float_format` too long for the 64 byte buffer copying stack bytes past the end of it into the output. (#1073)
+- Fixed the double free of the default `create_id` when a call passes `:create_id => nil`. (#1074)
+- Fixed the buffer over-read of an odd attribute name and the leak of its arguments. (#1075)
+- Fixed the SEGV reading a truncated document with `Oj::Parser#file` and the descriptor it leaked. (#1076)
+- Fixed the SEGV from a malformed number in `Oj::Doc`. (#1077)
+- Fixed the stack exhaustion from a long key with `:only` or `:except`. (#1078)
+- Fixed the odd module match being decided by uninitialized memory. (#1079)
+- Fixed `:float_format` accepting directives it has no argument for. (#1083)
+
+### Memory leaks
+
+- Fixed the leak of an escaped hash key in the streaming parser. (#1067)
+- Fixed the leak of the parser `create_id` when it is set a second time. (#1085)
+- Fixed the leak of the parser when `Oj::Parser.new` or `Oj::Parser.safe` raises on an argument it does not take. (#1086)
+
+### Parsing and dumping
+
+- Fixed a safe parser limit of 4 being ignored. (#1065)
+- Fixed the exponent bound being checked after it is narrowed. (#1066)
+- Fixed a document being rejected when it opens with a number of 4093 digits or more read through a file descriptor or an IO, and the reader buffer that leaked when it grew. (#1069)
+- Fixed the safe parser limits being dropped when an option is set after the parser is built. (#1070)
+- Fixed the `:custom` mode dump of an exception that was never raised opening with `{,`. (#1082)
+- Fixed the `:wab` mode time load being an offset out on Windows, where `mktime()` stood in for `timegm()` and returned -1 for any time before the epoch. (#1088)
+- Fixed `Oj::Doc` dropping the exponent of a number written without a decimal point, so `1e3` loaded as `1`. (#1089)
+
+### Rails
+
+- Fixed a `to_json(only:)` or `to_json(except:)` dropping the `include_root_in_json` wrapper key and the keys added by `:methods`. (#1039)
+- Fixed the `as_json` options reaching only the first element of a container, so `to_json(only:)`, `to_json(methods:)` and any custom `as_json(opts)` took effect on one row and nowhere else. (#1040)
+- An encoder now reads the global optimized class table and options instead of copying them, saving about 6.7KB of malloc per `ActiveSupport::JSON.encode`, and picks up later `Oj.default_options` and `ActiveSupport::JSON::Encoding` changes. (#1049)
+- Fixed `as_json` being handed the encoder's own options hash. ActiveSupport allows `as_json` to write into it, and ActiveSupport 8.1 caches one encoder per process, so a single such `as_json` could leave `:only` set for every later `to_json`. (#1050)
+
+### Documentation
+
+- Renamed the documented `:skip_null_byte` option to `:omit_null_byte`, which is the name that works. (#1041)
+- Dropped the `--with-sse42` install option from InstallOptions.md. SIMD support is detected at runtime. (#1042)
+- Corrected the documented minimum Ruby version from 2.4+ to 2.7+. (#1043)
+- Corrected the Parser.md benchmark conclusions to reference `:usual` rather than `:saj`. (#1044)
+- Corrected Custom.md and Options.md, which called `:custom` the default mode. The default is `:object`. (#1045)
+- Corrected the documented type of the `:safe` option from String to Boolean. (#1046)
+- Corrected Security.md, which said no methods are ever called on an Object created by a load. `exception`, `set_backtrace` and `replace` are. The page now also says which mode `Oj.load` uses. (#1080)
+
+### Tests and CI
+
+- Added the ActiveSupport 8 test suite. The Rakefile picked the suite by major version, so the rails_8 job had been running zero ActiveSupport tests. (#1047)
+- Added the ActiveSupport 8.1 test suite and pinned the #985 regression. (#1051)
+- Fixed `rake` never running the `test/test_*.rb` suite. The `Rake::TestTask` that defined `test` was commented out, so `test_all` invoked a synthesized no-op file task. (#1084)
+- Added a job timeout to the workflows. (#1087)
+- Removed the pre-1970 time test skips on Windows, which were left from a 32 bit Ruby limit that no longer applies. (#1090)
+
+## 3.17.4 - 2026-07-14
+
+- Fixed issue in fast.c where rescuing from a panic did not reset the where counter.
+
+- Multiple fixes thanks to @Watson1978.
+
+## 3.17.3 - 2026-06-04
+
+- Fixed issue in intern.c and fast.c.
+
+## 3.17.2 - 2026-05-27
+
+- Fixed multiple issues related to extreme sizes.
+
 ## 3.17.1 - 2026-05-15
 
 - Fixed "quoted string not terminated" error.

data/ext/oj/cache.c

@@ -28,6 +28,22 @@
 // almost the Murmur hash algorithm
 #define M 0x5bd1e995
 
+uint64_t oj_hash_seed = 0;
+
+void oj_hash_seed_init(void) {
+    static bool seeded = false;
+
+    if (seeded) {
+        return;
+    }
+    seeded = true;
+#if HAVE_RB_HASH_START
+    oj_hash_seed = (uint64_t)rb_hash_start(0);
+#else
+    oj_hash_seed = (uint64_t)NUM2LL(rb_funcall(rb_str_new_cstr("oj"), rb_intern("hash"), 0));
+#endif
+}
+
 typedef struct _slot {
     struct _slot     *next;
     VALUE             val;
@@ -62,7 +78,7 @@ void cache_set_form(Cache c, VALUE (*form)(const char *str, size_t len)) {
 static uint64_t hash_calc(const uint8_t *key, size_t len) {
     const uint8_t *end     = key + len;
     const uint8_t *endless = key + (len & 0xFFFFFFFC);
-    uint64_t       h       = (uint64_t)len;
+    uint64_t       h       = (uint64_t)len ^ oj_hash_seed;
     uint64_t       k;
 
     while (key < endless) {

data/ext/oj/cache.h

@@ -6,9 +6,14 @@
 
 #include <ruby.h>
 #include <stdbool.h>
+#include <stdint.h>
 
 #define CACHE_MAX_KEY 35
 
+extern uint64_t oj_hash_seed;
+
+extern void oj_hash_seed_init(void);
+
 struct _cache;
 typedef struct _cache *Cache;
 

data/ext/oj/circarray.c

@@ -25,8 +25,12 @@ void oj_circ_array_free(CircArray ca) {
     OJ_R_FREE(ca);
 }
 
+// Objects are numbered in encounter order starting at 1, so the only id that
+// can extend the array is one past the highest already seen. Anything further
+// is not a reference to an object the document can contain and must not be
+// used to size an allocation.
 void oj_circ_array_set(CircArray ca, VALUE obj, unsigned long id) {
-    if (0 < id && 0 != ca) {
+    if (0 != ca && 0 < id && id <= ca->cnt + 1) {
         unsigned long i;
 
         if (ca->size < id) {
@@ -57,7 +61,7 @@ VALUE
 oj_circ_array_get(CircArray ca, unsigned long id) {
     VALUE obj = Qnil;
 
-    if (id <= ca->cnt && 0 != ca) {
+    if (0 != ca && 0 < id && id <= ca->cnt) {
         obj = ca->objs[id - 1];
     }
     return obj;

data/ext/oj/compat.c

@@ -14,11 +14,11 @@
 
 static void hash_set_cstr(ParseInfo pi, Val kval, const char *str, size_t len, const char *orig) {
     const char *key    = kval->key;
-    int         klen   = kval->klen;
+    size_t      klen   = kval->klen;
     Val         parent = stack_peek(&pi->stack);
 
     if (Qundef == kval->key_val && Yes == pi->options.create_ok && NULL != pi->options.create_id &&
-        *pi->options.create_id == *key && (int)pi->options.create_id_len == klen &&
+        *pi->options.create_id == *key && (size_t)pi->options.create_id_len == klen &&
         0 == strncmp(pi->options.create_id, key, klen)) {
         parent->classname = oj_strndup(str, len);
         parent->clen      = len;
@@ -27,7 +27,7 @@ static void hash_set_cstr(ParseInfo pi, Val kval, const char *str, size_t len, c
         volatile VALUE rkey = oj_calc_hash_key(pi, kval);
 
         if (Yes == pi->options.create_ok && NULL != pi->options.str_rx.head) {
-            VALUE clas = oj_rxclass_match(&pi->options.str_rx, str, (int)len);
+            VALUE clas = oj_rxclass_match(&pi->options.str_rx, str, len);
 
             if (Qnil != clas) {
                 rstr = rb_funcall(clas, oj_json_create_id, 1, rstr);
@@ -84,7 +84,7 @@ static void add_cstr(ParseInfo pi, const char *str, size_t len, const char *orig
     volatile VALUE rstr = oj_cstr_to_value(str, len, (size_t)pi->options.cache_str);
 
     if (Yes == pi->options.create_ok && NULL != pi->options.str_rx.head) {
-        VALUE clas = oj_rxclass_match(&pi->options.str_rx, str, (int)len);
+        VALUE clas = oj_rxclass_match(&pi->options.str_rx, str, len);
 
         if (Qnil != clas) {
             pi->stack.head->val = rb_funcall(clas, oj_json_create_id, 1, rstr);
@@ -155,7 +155,7 @@ static void array_append_cstr(ParseInfo pi, const char *str, size_t len, const c
     volatile VALUE rstr = oj_cstr_to_value(str, len, (size_t)pi->options.cache_str);
 
     if (Yes == pi->options.create_ok && NULL != pi->options.str_rx.head) {
-        VALUE clas = oj_rxclass_match(&pi->options.str_rx, str, (int)len);
+        VALUE clas = oj_rxclass_match(&pi->options.str_rx, str, len);
 
         if (Qnil != clas) {
             rb_ary_push(stack_peek(&pi->stack)->val, rb_funcall(clas, oj_json_create_id, 1, rstr));

data/ext/oj/custom.c

@@ -640,7 +640,9 @@ static void dump_obj_attrs(VALUE obj, VALUE clas, slot_t id, int depth, Out out)
     if (rb_obj_is_kind_of(obj, rb_eException)) {
         volatile VALUE rv;
 
-        if (',' != *(out->cur - 1)) {
+        // An exception that was never raised has no instance variables, so
+        // without the class name nothing has been written since the '{'.
+        if (',' != *(out->cur - 1) && '{' != *(out->cur - 1)) {
             *out->cur++ = ',';
         }
         // message
@@ -896,11 +898,11 @@ void oj_dump_custom_val(VALUE obj, int depth, Out out, bool as_ok) {
 
 static void hash_set_cstr(ParseInfo pi, Val kval, const char *str, size_t len, const char *orig) {
     const char *key    = kval->key;
-    int         klen   = kval->klen;
+    size_t      klen   = kval->klen;
     Val         parent = stack_peek(&pi->stack);
 
     if (Qundef == kval->key_val && Yes == pi->options.create_ok && NULL != pi->options.create_id &&
-        *pi->options.create_id == *key && (int)pi->options.create_id_len == klen &&
+        *pi->options.create_id == *key && (size_t)pi->options.create_id_len == klen &&
         0 == strncmp(pi->options.create_id, key, klen)) {
         parent->clas = oj_name2class(pi, str, len, false, rb_eArgError);
         if (2 == klen && '^' == *key && 'o' == key[1]) {
@@ -915,7 +917,7 @@ static void hash_set_cstr(ParseInfo pi, Val kval, const char *str, size_t len, c
         volatile VALUE rkey = oj_calc_hash_key(pi, kval);
 
         if (Yes == pi->options.create_ok && NULL != pi->options.str_rx.head) {
-            VALUE clas = oj_rxclass_match(&pi->options.str_rx, str, (int)len);
+            VALUE clas = oj_rxclass_match(&pi->options.str_rx, str, len);
 
             if (Qnil != clas) {
                 rstr = rb_funcall(clas, oj_json_create_id, 1, rstr);
@@ -1020,7 +1022,7 @@ static void array_append_cstr(ParseInfo pi, const char *str, size_t len, const c
     volatile VALUE rstr = rb_utf8_str_new(str, len);
 
     if (Yes == pi->options.create_ok && NULL != pi->options.str_rx.head) {
-        VALUE clas = oj_rxclass_match(&pi->options.str_rx, str, (int)len);
+        VALUE clas = oj_rxclass_match(&pi->options.str_rx, str, len);
 
         if (Qnil != clas) {
             rb_ary_push(stack_peek(&pi->stack)->val, rb_funcall(clas, oj_json_create_id, 1, rstr));

data/ext/oj/dump.c

@@ -1456,10 +1456,11 @@ void oj_dump_raw(const char *str, size_t cnt, Out out) {
 }
 
 void oj_out_init(Out out) {
-    out->buf       = out->stack_buffer;
-    out->cur       = out->buf;
-    out->end       = out->buf + sizeof(out->stack_buffer) - BUFFER_EXTRA;
-    out->allocated = false;
+    out->buf            = out->stack_buffer;
+    out->cur            = out->buf;
+    out->end            = out->buf + sizeof(out->stack_buffer) - BUFFER_EXTRA;
+    out->allocated      = false;
+    out->key_filter_off = false;
 }
 
 void oj_out_free(Out out) {
@@ -1731,6 +1732,11 @@ void oj_dump_float(VALUE obj, int depth, Out out, bool as_ok) {
 size_t oj_dump_float_printf(char *buf, size_t blen, VALUE obj, double d, const char *format) {
     size_t cnt = snprintf(buf, blen, format, d);
 
+    // snprintf() returns the length the output would have needed, which is
+    // more than it wrote when the format asks for more room than buf has.
+    if (blen <= cnt) {
+        cnt = blen - 1;
+    }
     // Round off issues at 16 significant digits so check for obvious ones of
     // 0001 and 9999.
     if (17 <= cnt && (0 == strcmp("0001", buf + cnt - 4) || 0 == strcmp("9999", buf + cnt - 4))) {
@@ -1742,6 +1748,21 @@ size_t oj_dump_float_printf(char *buf, size_t blen, VALUE obj, double d, const c
     return cnt;
 }
 
+// The only and except lists are the keys joined with a ':' and wrapped in one
+// at each end, so a key is in a list when ":key:" is in it. Matching in place
+// finds what searching the list for a copy of the key with the colons on it
+// found, without a buffer sized by the key.
+static bool key_listed(const char *list, const char *key, size_t klen) {
+    const char *s;
+
+    for (s = list; NULL != (s = strchr(s, ':')); s++) {
+        if (0 == strncmp(s + 1, key, klen) && ':' == s[klen + 1]) {
+            return true;
+        }
+    }
+    return false;
+}
+
 bool oj_key_skip(VALUE key, const char *only, const char *except) {
     const char *skey;
 
@@ -1751,15 +1772,9 @@ bool oj_key_skip(VALUE key, const char *only, const char *except) {
     default: skey = NULL; break;
     }
     if (NULL != skey && '\0' != *skey) {
-        size_t size = strlen(skey);
-        char  *buf  = alloca(size + 3);
-
-        buf[0] = ':';
-        strcpy(buf + 1, skey);
-        buf[size + 1] = ':';
-        buf[size + 2] = '\0';
+        size_t klen = strlen(skey);
 
-        return ((NULL != only && NULL == strstr(only, buf)) || (NULL != except && NULL != strstr(except, buf)));
+        return ((NULL != only && !key_listed(only, skey, klen)) || (NULL != except && key_listed(except, skey, klen)));
     }
     return NULL != only;
 }

data/ext/oj/dump.h

@@ -70,9 +70,19 @@ inline static void assure_size(Out out, size_t len) {
     }
 }
 
+// Bytes that fill_indent(), or the dump_opts equivalent used when :indent is a
+// String, writes at this depth. nl_size is array_size or hash_size.
+inline static size_t indent_len(Out out, int depth, size_t nl_size) {
+    if (out->opts->dump_opts.use) {
+        return depth * out->opts->dump_opts.indent_size + nl_size;
+    }
+    return depth * out->indent + 1;
+}
+
 inline static void fill_indent(Out out, int cnt) {
     if (0 < out->indent) {
         cnt *= out->indent;
+        assure_size(out, cnt + 1);
         *out->cur++ = '\n';
         memset(out->cur, ' ', cnt);
         out->cur += cnt;

data/ext/oj/dump_compat.c

@@ -162,6 +162,7 @@ static void dump_array(VALUE a, int depth, Out out, bool as_ok) {
                     }
                 }
             } else {
+                assure_size(out, size);
                 fill_indent(out, d2);
             }
             oj_dump_compat_val(RARRAY_AREF(a, i), d2, out, true);
@@ -298,9 +299,10 @@ static ID message_id   = 0;
 static ID backtrace_id = 0;
 
 static void exception_alt(VALUE obj, int depth, Out out) {
-    int    d3      = depth + 2;
-    size_t size    = d3 * out->indent + 2;
-    size_t sep_len = out->opts->dump_opts.before_size + out->opts->dump_opts.after_size + 2;
+    int            d3      = depth + 2;
+    size_t         size    = d3 * out->indent + 2;
+    size_t         sep_len = out->opts->dump_opts.before_size + out->opts->dump_opts.after_size + 2;
+    volatile VALUE bt;
 
     if (0 == message_id) {
         message_id   = rb_intern("message");
@@ -331,7 +333,12 @@ static void exception_alt(VALUE obj, int depth, Out out) {
     if (0 < out->opts->dump_opts.after_size) {
         APPEND_CHARS(out->cur, out->opts->dump_opts.after_sep, out->opts->dump_opts.after_size);
     }
-    dump_array(rb_funcall(obj, backtrace_id, 0), depth, out, false);
+    bt = rb_funcall(obj, backtrace_id, 0);
+    if (T_ARRAY == rb_type(bt)) {
+        dump_array(bt, depth, out, false);
+    } else {
+        oj_dump_nil(Qnil, depth, out, false);
+    }
     fill_indent(out, depth);
     *out->cur++ = '}';
     *out->cur   = '\0';

data/ext/oj/dump_object.c

@@ -10,6 +10,24 @@ static const char hex_chars[17] = "0123456789abcdef";
 
 static void dump_obj_attrs(VALUE obj, VALUE clas, slot_t id, int depth, Out out);
 
+// An odd class is dumped as {"^O":class,...} and is rebuilt with a create
+// function when loaded so there is no place to put a "^i" circular id on it.
+// Registering it in the circular cache would consume an id that is never
+// written and any later occurrence would then be dumped as a "^r" that refers
+// to nothing. Instead dump odd classes in full each time they are encountered
+// just like Time, Rational, and Complex are.
+static void dump_circular_obj(VALUE obj, VALUE clas, int depth, Out out) {
+    if (NULL != oj_get_odd(clas)) {
+        dump_obj_attrs(obj, clas, 0, depth, out);
+    } else {
+        long id = oj_check_circular(obj, out);
+
+        if (0 <= id) {
+            dump_obj_attrs(obj, clas, id, depth, out);
+        }
+    }
+}
+
 static void dump_time(VALUE obj, Out out) {
     switch (out->opts->time_format) {
     case RubyTime:
@@ -47,11 +65,7 @@ static void dump_data(VALUE obj, int depth, Out out, bool as_ok) {
                 oj_dump_cstr(str, len, 0, 0, out);
             }
         } else {
-            long id = oj_check_circular(obj, out);
-
-            if (0 <= id) {
-                dump_obj_attrs(obj, clas, id, depth, out);
-            }
+            dump_circular_obj(obj, clas, depth, out);
         }
     }
 }
@@ -74,11 +88,7 @@ static void dump_obj(VALUE obj, int depth, Out out, bool as_ok) {
             oj_dump_raw(str, len, out);
         }
     } else {
-        long id = oj_check_circular(obj, out);
-
-        if (0 <= id) {
-            dump_obj_attrs(obj, clas, id, depth, out);
-        }
+        dump_circular_obj(obj, clas, depth, out);
     }
 }
 

data/ext/oj/extconf.rb

@@ -32,6 +32,7 @@ have_func('pthread_mutex_init')
 have_func('getrlimit', 'sys/resource.h')
 have_func('rb_enc_interned_str')
 have_func('rb_ext_ractor_safe', 'ruby.h')
+have_func('rb_hash_start', 'ruby.h')
 
 dflags['OJ_DEBUG'] = true unless ENV['OJ_DEBUG'].nil?