oj 3.17.1 → 3.17.6

data/ext/oj/safe.c

@@ -1,10 +1,11 @@
+
 #include "safe.h"
 
 static VALUE max_hash_size_sym, max_array_size_sym, max_depth_sym, max_total_elements_sym, max_hash_size_error_class,
     max_array_size_error_class, max_depth_error_class, max_total_elements_error_class;
 
 static void check_object_size(safe_T safe) {
-    if (NIL_P(safe->max_hash_size)) {
+    if (!safe->max_hash_size_isset) {
         return;
     }
 
@@ -22,7 +23,7 @@ static void check_object_size(safe_T safe) {
 }
 
 static void check_array_size(safe_T safe) {
-    if (NIL_P(safe->max_array_size)) {
+    if (!safe->max_array_size_isset) {
         return;
     }
 
@@ -40,7 +41,7 @@ static void check_array_size(safe_T safe) {
 }
 
 static void check_max_depth(safe_T safe, ojParser p) {
-    if (NIL_P(safe->max_depth) || safe->max_depth >= (p->depth + 1)) {
+    if (!safe->max_depth_isset || safe->max_depth >= (p->depth + 1)) {
         return;
     }
 
@@ -54,7 +55,7 @@ static void check_max_total_elements(safe_T safe) {
     * null, true) are not counted. As a result, `current_elements_count`
     * always holds one less than the actual total.
     */
-    if (NIL_P(safe->max_total_elements) || safe->max_total_elements > safe->current_elements_count) {
+    if (!safe->max_total_elements_isset || safe->max_total_elements > safe->current_elements_count) {
         return;
     }
 
@@ -139,58 +140,72 @@ DEFINE_DELEGATED_OBJECT_FUNCTION(add_float);
 DEFINE_DELEGATED_OBJECT_FUNCTION(add_big);
 DEFINE_DELEGATED_OBJECT_FUNCTION(add_str);
 
+// The counting wrappers live in the parser function table, and the option
+// setters of the usual parser write to the same slots, so an option set after
+// the parser was built puts the unwrapped handler back and the limits stop
+// being applied for that kind of value.
+#define WRAP(funcs, slot, wrapper, saved) \
+    do {                                  \
+        if (wrapper != (funcs)->slot) {   \
+            safe->saved = (funcs)->slot;  \
+        }                                 \
+        (funcs)->slot = wrapper;          \
+    } while (0)
+
+static void wrap_funcs(ojParser p, safe_T safe) {
+    Funcs f = &p->funcs[ARRAY_FUN];
+
+    WRAP(f, open_object, safe_open_object, delegated_open_object_func);
+    WRAP(f, open_array, safe_open_array, delegated_open_array_func);
+    // The following overrides are done for counting objects
+    WRAP(f, add_null, safe_add_null, delegated_add_null_func);
+    WRAP(f, add_true, safe_add_true, delegated_add_true_func);
+    WRAP(f, add_false, safe_add_false, delegated_add_false_func);
+    WRAP(f, add_int, safe_add_int, delegated_add_int_func);
+    WRAP(f, add_float, safe_add_float, delegated_add_float_func);
+    WRAP(f, add_big, safe_add_big, delegated_add_big_func);
+    WRAP(f, add_str, safe_add_str, delegated_add_str_func);
+
+    f = &p->funcs[OBJECT_FUN];
+    WRAP(f, open_object, safe_open_object_key, delegated_open_object_key_func);
+    WRAP(f, open_array, safe_open_array_key, delegated_open_array_key_func);
+    WRAP(f, add_null, safe_add_null_key, delegated_add_null_key_func);
+    WRAP(f, add_true, safe_add_true_key, delegated_add_true_key_func);
+    WRAP(f, add_false, safe_add_false_key, delegated_add_false_key_func);
+    WRAP(f, add_int, safe_add_int_key, delegated_add_int_key_func);
+    WRAP(f, add_float, safe_add_float_key, delegated_add_float_key_func);
+    WRAP(f, add_big, safe_add_big_key, delegated_add_big_key_func);
+    WRAP(f, add_str, safe_add_str_key, delegated_add_str_key_func);
+}
+
+static VALUE safe_option(ojParser p, const char *key, VALUE value) {
+    safe_T safe = (safe_T)p->ctx;
+    VALUE  rv;
+
+    if (0 == strcmp("omit_null", key)) {
+        return safe->omit_null ? Qtrue : Qfalse;
+    }
+    rv = safe->delegated_option_func(p, key, value);
+    if (0 == strcmp("omit_null=", key)) {
+        safe->omit_null = (Qtrue == rv);
+    }
+    wrap_funcs(p, safe);
+
+    return rv;
+}
+
 void oj_init_safe_parser(ojParser p, safe_T safe, VALUE options) {
     // Safe parser inherits all members of usual parser
     oj_init_usual(p, &safe->usual);
 
     safe->delegated_start_func = p->start;
     p->start                   = safe_start;
+    safe->omit_null            = false;
 
-    Funcs f;
+    wrap_funcs(p, safe);
 
-    // Array parser functions
-    f                                = &p->funcs[ARRAY_FUN];
-    safe->delegated_open_object_func = f->open_object;
-    f->open_object                   = safe_open_object;
-    safe->delegated_open_array_func  = f->open_array;
-    f->open_array                    = safe_open_array;
-    // The following overrides are done for counting objects
-    safe->delegated_add_null_func  = f->add_null;
-    f->add_null                    = safe_add_null;
-    safe->delegated_add_true_func  = f->add_true;
-    f->add_true                    = safe_add_true;
-    safe->delegated_add_false_func = f->add_false;
-    f->add_false                   = safe_add_false;
-    safe->delegated_add_int_func   = f->add_int;
-    f->add_int                     = safe_add_int;
-    safe->delegated_add_float_func = f->add_float;
-    f->add_float                   = safe_add_float;
-    safe->delegated_add_big_func   = f->add_big;
-    f->add_big                     = safe_add_big;
-    safe->delegated_add_str_func   = f->add_str;
-    f->add_str                     = safe_add_str;
-
-    // Object parser functions
-    f                                    = &p->funcs[OBJECT_FUN];
-    safe->delegated_open_object_key_func = f->open_object;
-    f->open_object                       = safe_open_object_key;
-    safe->delegated_open_array_key_func  = f->open_array;
-    f->open_array                        = safe_open_array_key;
-    // The following overrides are done for counting objects
-    safe->delegated_add_null_key_func  = f->add_null;
-    f->add_null                        = safe_add_null_key;
-    safe->delegated_add_true_key_func  = f->add_true;
-    f->add_true                        = safe_add_true_key;
-    safe->delegated_add_false_key_func = f->add_false;
-    f->add_false                       = safe_add_false_key;
-    safe->delegated_add_int_key_func   = f->add_int;
-    f->add_int                         = safe_add_int_key;
-    safe->delegated_add_float_key_func = f->add_float;
-    f->add_float                       = safe_add_float_key;
-    safe->delegated_add_big_key_func   = f->add_big;
-    f->add_big                         = safe_add_big_key;
-    safe->delegated_add_str_key_func   = f->add_str;
-    f->add_str                         = safe_add_str_key;
+    safe->delegated_option_func = p->option;
+    p->option                   = safe_option;
 
     SET_CONFIG(max_hash_size);
     SET_CONFIG(max_array_size);

data/ext/oj/safe.h

@@ -8,11 +8,13 @@
         VALUE rb_##config_name = rb_hash_aref(options, config_name##_sym);             \
                                                                                        \
         if (RB_INTEGER_TYPE_P(rb_##config_name)) {                                     \
-            safe->config_name = NUM2LONG(rb_##config_name);                            \
+            safe->config_name         = NUM2LONG(rb_##config_name);                    \
+            safe->config_name##_isset = true;                                          \
         } else if (!NIL_P(rb_##config_name)) {                                         \
             rb_raise(rb_eArgError, "Incorrect value provided for `" #config_name "`"); \
         } else {                                                                       \
-            safe->config_name = Qnil;                                                  \
+            safe->config_name         = 0;                                             \
+            safe->config_name##_isset = false;                                         \
         }                                                                              \
     } while (0);
 
@@ -49,10 +51,20 @@ typedef struct _safe_S {
     long int max_total_elements;
     long int max_json_size_bytes;
 
+    bool max_hash_size_isset;
+    bool max_array_size_isset;
+    bool max_depth_isset;
+    bool max_total_elements_isset;
+
     long int current_hash_size;
     long int current_array_size;
     long int current_elements_count;
 
+    // omit_null is kept here because the usual parser reports it by looking at
+    // the add_null slot, which is one of the slots wrapped below.
+    bool omit_null;
+
+    VALUE (*delegated_option_func)(struct _ojParser *p, const char *key, VALUE value);
     void (*delegated_start_func)(struct _ojParser *p);
 
     // Array functions

data/ext/oj/saj.c

@@ -82,7 +82,14 @@ inline static void next_non_white(ParseInfo pi) {
         case '\f':
         case '\n':
         case '\r': break;
-        case '/': skip_comment(pi); break;
+        case '/':
+            skip_comment(pi);
+            /* A comment that is not terminated by a newline ends on the null
+             * terminator. Stop here so the loop does not step past it. */
+            if ('\0' == *pi->s) {
+                return;
+            }
+            break;
         default: return;
         }
     }
@@ -118,14 +125,15 @@ static void skip_comment(ParseInfo pi) {
             if ('*' == *pi->s && '/' == *(pi->s + 1)) {
                 pi->s++;
                 return;
-            } else if ('\0' == *pi->s) {
-                if (pi->has_error) {
-                    call_error("comment not terminated", pi, __FILE__, __LINE__);
-                } else {
-                    raise_error("comment not terminated", pi->str, pi->s);
-                }
             }
         }
+        /* The loop only ends on the null terminator so the comment was never
+         * closed. */
+        if (pi->has_error) {
+            call_error("comment not terminated", pi, __FILE__, __LINE__);
+        } else {
+            raise_error("comment not terminated", pi->str, pi->s);
+        }
     } else if ('/' == *pi->s) {
         for (; 1; pi->s++) {
             switch (*pi->s) {
@@ -190,6 +198,12 @@ static void read_hash(ParseInfo pi, const char *key) {
     } else {
         while (1) {
             next_non_white(pi);
+            if ('"' != *pi->s) {
+                if (pi->has_error) {
+                    call_error("invalid format, expected a key", pi, __FILE__, __LINE__);
+                }
+                raise_error("invalid format, expected a key", pi->str, pi->s);
+            }
             ks = read_quoted_value(pi);
             next_non_white(pi);
             if (':' == *pi->s) {
@@ -606,6 +620,19 @@ static void saj_parse(VALUE handler, char *json) {
     }
 }
 
+struct _sajArgs {
+    VALUE handler;
+    char *json;
+};
+
+static VALUE protect_saj_parse(VALUE x) {
+    struct _sajArgs *args = (struct _sajArgs *)x;
+
+    saj_parse(args->handler, args->json);
+
+    return Qnil;
+}
+
 /* call-seq: saj_parse(handler, io)
  *
  * Parses an IO stream or file containing an JSON document. Raises an exception
@@ -670,8 +697,17 @@ oj_saj_parse(int argc, VALUE *argv, VALUE self) {
             rb_raise(rb_eArgError, "saj_parse() expected a String or IO Object.");
         }
     }
-    saj_parse(*argv, json);
-    OJ_R_FREE(json);
-
+    {
+        // saj_parse() raises on a malformed document so the json buffer has to
+        // be freed even when the parse does not return normally.
+        struct _sajArgs args = {*argv, json};
+        int             ex   = 0;
+
+        rb_protect(protect_saj_parse, (VALUE)&args, &ex);
+        OJ_R_FREE(json);
+        if (0 != ex) {
+            rb_jump_tag(ex);
+        }
+    }
     return Qnil;
 }

data/ext/oj/sparse.c

@@ -290,13 +290,13 @@ static void read_escaped_str(ParseInfo pi) {
         case NEXT_HASH_NEW:
         case NEXT_HASH_KEY:
             if (Qundef == (parent->key_val = pi->hash_key(pi, buf.head, buf_len(&buf)))) {
-                parent->klen = buf_len(&buf);
-                parent->key  = malloc(parent->klen + 1);
-                memcpy((char *)parent->key, buf.head, parent->klen);
-                *(char *)(parent->key + parent->klen) = '\0';
+                parent->klen   = buf_len(&buf);
+                parent->key    = oj_strndup(buf.head, parent->klen);
+                parent->kalloc = 1;
             } else {
-                parent->key  = "";
-                parent->klen = 0;
+                parent->key    = "";
+                parent->klen   = 0;
+                parent->kalloc = 0;
             }
             parent->k1   = *pi->rd.str;
             parent->next = NEXT_HASH_COLON;
@@ -906,7 +906,17 @@ CLEANUP:
     if (0 != pi->circ_array) {
         oj_circ_array_free(pi->circ_array);
     }
+    reader_cleanup(&pi->rd);
     stack_cleanup(&pi->stack);
+    // A :match_string option builds a chain of regexps for this call that has to
+    // be freed. Without the option the member aliases the chain owned by the
+    // defaults and must be left alone.
+    if (pi->options.str_rx.head != oj_default_options.str_rx.head) {
+        oj_rxclass_cleanup(&pi->options.str_rx);
+        pi->options.str_rx.head = NULL;
+        pi->options.str_rx.tail = NULL;
+    }
+    oj_free_call_options(&pi->options);
     if (0 != fd) {
 #ifdef _WIN32
         rb_w32_close(fd);

data/ext/oj/stream_writer.c

@@ -16,15 +16,29 @@ static void stream_writer_free(void *ptr) {
         return;
     }
     sw = (StreamWriter)ptr;
+    oj_options_release(&sw->sw.opts);
     OJ_R_FREE(sw->sw.out.buf);
     OJ_R_FREE(sw->sw.types);
     OJ_R_FREE(ptr);
 }
 
+static void stream_writer_mark(void *ptr) {
+    if (NULL != ptr) {
+        StreamWriter sw = (StreamWriter)ptr;
+
+        oj_options_mark(&sw->sw.opts);
+        // The writer can be the only reference to the stream as in
+        // Oj::StreamWriter.new(StringIO.new) so it must be marked.
+        if (Qnil != sw->stream) {
+            rb_gc_mark(sw->stream);
+        }
+    }
+}
+
 static const rb_data_type_t oj_stream_writer_type = {
     "Oj/stream_writer",
     {
-        NULL,
+        stream_writer_mark,
         stream_writer_free,
         NULL,
     },
@@ -116,6 +130,7 @@ static VALUE stream_writer_new(int argc, VALUE *argv, VALUE self) {
         oj_str_writer_init(&sw->sw, 4096);
         sw->flush_limit = 0;
     }
+    oj_options_take_ownership(&sw->sw.opts);
     sw->sw.out.indent = sw->sw.opts.indent;
     sw->stream        = stream;
     sw->type          = type;

data/ext/oj/string_writer.c

@@ -42,12 +42,18 @@ static void maybe_comma(StrWriter sw) {
 
 // Used by stream writer also.
 void oj_str_writer_init(StrWriter sw, int buf_size) {
-    sw->opts       = oj_default_options;
-    sw->depth      = 0;
-    sw->types      = OJ_R_ALLOC_N(char, 256);
-    sw->types_end  = sw->types + 256;
-    *sw->types     = '\0';
-    sw->keyWritten = 0;
+    sw->opts = oj_default_options;
+    // Detach from the match_string regexps owned by the defaults before the
+    // options are parsed. A :match_string option then builds a chain of its own
+    // that is freed with the writer instead of being appended to the chain the
+    // defaults are using.
+    sw->opts.str_rx.head = NULL;
+    sw->opts.str_rx.tail = NULL;
+    sw->depth            = 0;
+    sw->types            = OJ_R_ALLOC_N(char, 256);
+    sw->types_end        = sw->types + 256;
+    *sw->types           = '\0';
+    sw->keyWritten       = 0;
 
     if (0 == buf_size) {
         buf_size = 4096;
@@ -72,6 +78,8 @@ void oj_str_writer_init(StrWriter sw, int buf_size) {
     sw->out.argv       = NULL;
     sw->out.ropts      = NULL;
     sw->out.omit_nil   = oj_default_options.dump_opts.omit_nil;
+    // oj_str_writer_init does not call oj_out_init, so clear this here too.
+    sw->out.key_filter_off = false;
 }
 
 void oj_str_writer_push_key(StrWriter sw, const char *key) {
@@ -234,15 +242,22 @@ static void string_writer_free(void *ptr) {
     sw = (StrWriter)ptr;
 
     oj_out_free(&sw->out);
+    oj_options_release(&sw->opts);
 
     OJ_R_FREE(sw->types);
     OJ_R_FREE(ptr);
 }
 
+static void string_writer_mark(void *ptr) {
+    if (NULL != ptr) {
+        oj_options_mark(&((StrWriter)ptr)->opts);
+    }
+}
+
 static const rb_data_type_t oj_string_writer_type = {
     "Oj/string_writer",
     {
-        NULL,
+        string_writer_mark,
         string_writer_free,
         NULL,
     },
@@ -279,6 +294,7 @@ static VALUE str_writer_new(int argc, VALUE *argv, VALUE self) {
     if (1 == argc) {
         oj_parse_options(argv[0], &sw->opts);
     }
+    oj_options_take_ownership(&sw->opts);
     sw->out.argc   = argc - 1;
     sw->out.argv   = argv + 1;
     sw->out.indent = sw->opts.indent;

data/ext/oj/usual.c

@@ -63,7 +63,7 @@ static VALUE form_attr(const char *str, size_t len) {
         memcpy(b + 1, str, len);
         b[len + 1] = '\0';
 
-        id = rb_intern3(buf, len + 1, oj_utf8_encoding);
+        id = rb_intern3(b, len + 1, oj_utf8_encoding);
         OJ_R_FREE(b);
         return id;
     }
@@ -200,7 +200,10 @@ static void push_key(ojParser p) {
         d->ktail = d->khead + pos;
         d->kend  = d->khead + cap;
     }
-    d->ktail->len = klen;
+    if (32000 < klen) {
+        rb_raise(oj_json_parser_error_class, "Key too long. Keys are limited to 32,000 bytes.");
+    }
+    d->ktail->len = (int16_t)klen;
     if (klen < sizeof(d->ktail->buf)) {
         memcpy(d->ktail->buf, key, klen);
         d->ktail->buf[klen] = '\0';
@@ -608,12 +611,16 @@ static void dfree(ojParser p) {
     Usual d = (Usual)p->ctx;
 
     cache_free(d->str_cache);
+    d->str_cache = NULL;
     cache_free(d->attr_cache);
+    d->attr_cache = NULL;
     if (NULL != d->sym_cache) {
         cache_free(d->sym_cache);
+        d->sym_cache = NULL;
     }
     if (NULL != d->class_cache) {
         cache_free(d->class_cache);
+        d->class_cache = NULL;
     }
     OJ_R_FREE(d->vhead);
     OJ_R_FREE(d->chead);
@@ -640,6 +647,12 @@ static void mark(ojParser p) {
     if (NULL != d->class_cache) {
         cache_mark(d->class_cache);
     }
+    if (Qnil != d->hash_class) {
+        rb_gc_mark(d->hash_class);
+    }
+    if (Qnil != d->array_class) {
+        rb_gc_mark(d->array_class);
+    }
     for (vp = d->vhead; vp < d->vtail; vp++) {
         if (Qundef != *vp) {
             rb_gc_mark(*vp);
@@ -818,6 +831,7 @@ static VALUE opt_create_id_set(ojParser p, VALUE value) {
     Usual d = (Usual)p->ctx;
 
     if (Qnil == value) {
+        OJ_R_FREE(d->create_id);
         d->create_id                 = NULL;
         d->create_id_len             = 0;
         p->funcs[OBJECT_FUN].add_str = add_str_key;
@@ -837,12 +851,15 @@ static VALUE opt_create_id_set(ojParser p, VALUE value) {
         if (1 << (8 * sizeof(d->create_id_len)) <= len) {
             rb_raise(rb_eArgError, "The create_id values is limited to %d bytes.", 1 << (8 * sizeof(d->create_id_len)));
         }
-        d->create_id_len                  = (uint8_t)len;
+        char *prev = d->create_id;
+
         d->create_id                      = str_dup(RSTRING_PTR(value), len);
+        d->create_id_len                  = (uint8_t)len;
         p->funcs[OBJECT_FUN].add_str      = add_str_key_create;
         p->funcs[TOP_FUN].close_object    = close_object_create;
         p->funcs[ARRAY_FUN].close_object  = close_object_create;
         p->funcs[OBJECT_FUN].close_object = close_object_create;
+        OJ_R_FREE(prev);
     }
     return opt_create_id(p, value);
 }
@@ -1050,10 +1067,10 @@ static VALUE opt_symbol_keys_set(ojParser p, VALUE value) {
         if (NULL != d->sym_cache) {
             cache_free(d->sym_cache);
             d->sym_cache = NULL;
+            d->key_cache = NULL;
         }
-        if (!d->cache_keys) {
-            d->get_key = str_key;
-        }
+        d->cache_keys = false;
+        d->get_key    = str_key;
     }
     return (NULL != d->sym_cache) ? Qtrue : Qfalse;
 }

data/ext/oj/util.c

@@ -134,3 +134,30 @@ void sec_as_time(int64_t secs, TimeInfo ti) {
     secs     = secs - (int64_t)ti->min * 60LL;
     ti->sec  = (int)secs;
 }
+
+// The inverse of sec_as_time(). The days are counted with the civil calendar
+// algorithm from Howard Hinnant's date library so that no libc call is needed.
+// timegm() is not available on Windows and the mktime() based replacement that
+// was used there returned the wrong value in any timezone east of UTC.
+int64_t time_as_sec(TimeInfo ti) {
+    int64_t year = (int64_t)ti->year;
+    int64_t mon  = (int64_t)ti->mon;
+    int64_t era;
+    int64_t yoe;   // year of the era, [0, 399]
+    int64_t doy;   // day of the year, [0, 365]
+    int64_t doe;   // day of the era, [0, 146096]
+    int64_t days;  // days since 1970-01-01
+
+    // Start the year on March 1st so that a leap day falls on the last day of
+    // the year and the day of the year is a simple expression.
+    if (mon <= 2) {
+        year--;
+    }
+    era  = (0 <= year ? year : year - 399) / 400;
+    yoe  = year - era * 400;
+    doy  = (153 * (mon + (2 < mon ? -3 : 9)) + 2) / 5 + (int64_t)ti->day - 1;
+    doe  = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    days = era * 146097 + doe - 719468;
+
+    return days * SECS_PER_DAY + (int64_t)ti->hour * 3600LL + (int64_t)ti->min * 60LL + (int64_t)ti->sec;
+}

data/ext/oj/util.h

@@ -15,6 +15,7 @@ typedef struct _timeInfo {
     int year;
 }* TimeInfo;
 
-extern void sec_as_time(int64_t secs, TimeInfo ti);
+extern void    sec_as_time(int64_t secs, TimeInfo ti);
+extern int64_t time_as_sec(TimeInfo ti);
 
 #endif /* OJ_UTIL_H */

data/ext/oj/val_stack.h

@@ -35,8 +35,8 @@ typedef struct _val {
     const char    *classname;
     VALUE          clas;
     OddArgs        odd_args;
-    uint16_t       klen;
-    uint16_t       clen;
+    size_t         klen;
+    size_t         clen;
     char           next;  // ValNext
     char           k1;    // first original character in the key
     char           kalloc;
@@ -62,6 +62,16 @@ inline static int stack_empty(ValStack stack) {
 }
 
 inline static void stack_cleanup(ValStack stack) {
+    Val v;
+
+    // end_hash() frees the args of a completed odd class. Anything still here
+    // belongs to a parse that was abandoned part way through.
+    for (v = stack->head; v < stack->tail; v++) {
+        if (NULL != v->odd_args) {
+            oj_odd_free(v->odd_args);
+            v->odd_args = NULL;
+        }
+    }
     if (stack->base != stack->head) {
         OJ_R_FREE(stack->head);
         stack->head = NULL;
@@ -70,9 +80,11 @@ inline static void stack_cleanup(ValStack stack) {
 
 inline static void stack_push(ValStack stack, VALUE val, ValNext next) {
     if (stack->end <= stack->tail) {
-        size_t len  = stack->end - stack->head;
-        size_t toff = stack->tail - stack->head;
-        Val    head = stack->head;
+        size_t      len  = stack->end - stack->head;
+        size_t      toff = stack->tail - stack->head;
+        Val         head = stack->head;
+        const char *old  = (const char *)stack->head;
+        size_t      i;
 
         // A realloc can trigger a GC so make sure it happens outside the lock
         // but lock before changing pointers.
@@ -82,6 +94,13 @@ inline static void stack_push(ValStack stack, VALUE val, ValNext next) {
         } else {
             OJ_R_REALLOC_N(head, struct _val, len + STACK_INC);
         }
+        // A key short enough to be kept in the Val itself points into the
+        // block that just moved.
+        for (i = 0; i < toff; i++) {
+            if (old <= head[i].key && head[i].key < old + sizeof(struct _val) * len) {
+                head[i].key = head[i].karray;
+            }
+        }
 #ifdef HAVE_PTHREAD_MUTEX_INIT
         pthread_mutex_lock(&stack->mutex);
 #else