oj 3.17.3 → 3.17.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7458dcdf494ef6b1b283ca86d51fba0b3102ecf5cec13f43682878c01708c80
-  data.tar.gz: ab8099b8b275aa5acab45a012bbc96ef0c860e041be2c4ae7d6f7cd331da1755
+  metadata.gz: 62e3d04685cbc7e063801fd45fc2e9c86a3695ac1fff9235d49944fb19a1ba50
+  data.tar.gz: 98cd36664b62b1d774998a5c39d4ea1610fbeb5a4d789de2bd80894bf9121fbe
 SHA512:
-  metadata.gz: 60d445fd27bbea120359c21d0c1b0ac1d4fbbd678c8fd28efe620706d382a2f0cc434645967c9bac0b6d08d1065fe99dc4b15e2623d98ca0e15a61eb591a993b
-  data.tar.gz: b7736fd3a7b27f98ef3e4df05464000849403ff33a3f82ecd6d8c51b40d0c2753d23ed14c078eb26506d504de991e35ebe68e5703225c80aab6ebbd28b7a80dc
+  metadata.gz: '029e6458460f15ae5bcbf26bb25ff959b5c3a0b70cf04b5eded0b2ff50930bbd3470b51410590fbf6621640590257360e0d20b290af8c28efbb31ee0a602998b'
+  data.tar.gz: c2442be3533074487f3fa7b7e84fac719748cd3f99c40217dc6f6dbc09600e491b2925905f400e2ac7de5639d78d15f76f01f5865a41dda2f963e6ccfd59223c

data/CHANGELOG.md

@@ -1,5 +1,80 @@
 # CHANGELOG
 
+## 3.17.5 - 2026-07-31
+
+Most of this release comes out of a security review of the C extension. There are no API changes.
+
+### Memory safety
+
+- Fixed hash flooding by seeding the key hash per process. The hash was decided entirely at compile time, so a document of colliding keys turned key interning into O(n^2) and left the process slow for every later parse. (#1053)
+- Fixed a one byte buffer over-read on a document that ends with a backslash inside an unterminated string. (#1054)
+- Fixed two length underflows that made an empty `^m` value and a key of exactly 65,536 bytes read forward until they left mapped memory. (#1055)
+- Fixed a SEGV from type confusion in class path resolution. A name segment that resolved to something other than a class or module was dereferenced as one. (#1056)
+- Fixed uninitialized stack memory being read into the message of an unresolved class name error. (#1057)
+- Fixed output buffer overflows when writing indentation, where several callers of `fill_indent()` had not assured the buffer first. (#1058)
+- Fixed the `Oj::Doc` path depth limit being checked one level too late. (#1061)
+- Fixed the use-after-free of a key when the value stack grows. (#1062)
+- Fixed the buffer over-read when a document ends where a key belongs. (#1063)
+- Fixed the id from a circular reference being used unchecked. (#1064)
+- Fixed the SEGV dumping an exception that was never raised, where the missing backtrace was read as an Array. (#1068)
+- Fixed the stack buffer overflow writing the error location. (#1071)
+- Fixed a read error in `Oj::Parser#file` being taken as a read of `SIZE_MAX` bytes, which wrote in front of the buffer and then reparsed it forever without checking for interrupts. (#1072)
+- Fixed a `:float_format` too long for the 64 byte buffer copying stack bytes past the end of it into the output. (#1073)
+- Fixed the double free of the default `create_id` when a call passes `:create_id => nil`. (#1074)
+- Fixed the buffer over-read of an odd attribute name and the leak of its arguments. (#1075)
+- Fixed the SEGV reading a truncated document with `Oj::Parser#file` and the descriptor it leaked. (#1076)
+- Fixed the SEGV from a malformed number in `Oj::Doc`. (#1077)
+- Fixed the stack exhaustion from a long key with `:only` or `:except`. (#1078)
+- Fixed the odd module match being decided by uninitialized memory. (#1079)
+- Fixed `:float_format` accepting directives it has no argument for. (#1083)
+
+### Memory leaks
+
+- Fixed the leak of an escaped hash key in the streaming parser. (#1067)
+- Fixed the leak of the parser `create_id` when it is set a second time. (#1085)
+- Fixed the leak of the parser when `Oj::Parser.new` or `Oj::Parser.safe` raises on an argument it does not take. (#1086)
+
+### Parsing and dumping
+
+- Fixed a safe parser limit of 4 being ignored. (#1065)
+- Fixed the exponent bound being checked after it is narrowed. (#1066)
+- Fixed a document being rejected when it opens with a number of 4093 digits or more read through a file descriptor or an IO, and the reader buffer that leaked when it grew. (#1069)
+- Fixed the safe parser limits being dropped when an option is set after the parser is built. (#1070)
+- Fixed the `:custom` mode dump of an exception that was never raised opening with `{,`. (#1082)
+- Fixed the `:wab` mode time load being an offset out on Windows, where `mktime()` stood in for `timegm()` and returned -1 for any time before the epoch. (#1088)
+- Fixed `Oj::Doc` dropping the exponent of a number written without a decimal point, so `1e3` loaded as `1`. (#1089)
+
+### Rails
+
+- Fixed a `to_json(only:)` or `to_json(except:)` dropping the `include_root_in_json` wrapper key and the keys added by `:methods`. (#1039)
+- Fixed the `as_json` options reaching only the first element of a container, so `to_json(only:)`, `to_json(methods:)` and any custom `as_json(opts)` took effect on one row and nowhere else. (#1040)
+- An encoder now reads the global optimized class table and options instead of copying them, saving about 6.7KB of malloc per `ActiveSupport::JSON.encode`, and picks up later `Oj.default_options` and `ActiveSupport::JSON::Encoding` changes. (#1049)
+- Fixed `as_json` being handed the encoder's own options hash. ActiveSupport allows `as_json` to write into it, and ActiveSupport 8.1 caches one encoder per process, so a single such `as_json` could leave `:only` set for every later `to_json`. (#1050)
+
+### Documentation
+
+- Renamed the documented `:skip_null_byte` option to `:omit_null_byte`, which is the name that works. (#1041)
+- Dropped the `--with-sse42` install option from InstallOptions.md. SIMD support is detected at runtime. (#1042)
+- Corrected the documented minimum Ruby version from 2.4+ to 2.7+. (#1043)
+- Corrected the Parser.md benchmark conclusions to reference `:usual` rather than `:saj`. (#1044)
+- Corrected Custom.md and Options.md, which called `:custom` the default mode. The default is `:object`. (#1045)
+- Corrected the documented type of the `:safe` option from String to Boolean. (#1046)
+- Corrected Security.md, which said no methods are ever called on an Object created by a load. `exception`, `set_backtrace` and `replace` are. The page now also says which mode `Oj.load` uses. (#1080)
+
+### Tests and CI
+
+- Added the ActiveSupport 8 test suite. The Rakefile picked the suite by major version, so the rails_8 job had been running zero ActiveSupport tests. (#1047)
+- Added the ActiveSupport 8.1 test suite and pinned the #985 regression. (#1051)
+- Fixed `rake` never running the `test/test_*.rb` suite. The `Rake::TestTask` that defined `test` was commented out, so `test_all` invoked a synthesized no-op file task. (#1084)
+- Added a job timeout to the workflows. (#1087)
+- Removed the pre-1970 time test skips on Windows, which were left from a 32 bit Ruby limit that no longer applies. (#1090)
+
+## 3.17.4 - 2026-07-14
+
+- Fixed issue in fast.c where rescuing from a panic did not reset the where counter.
+
+- Multiple fixes thanks to @Watson1978.
+
 ## 3.17.3 - 2026-06-04
 
 - Fixed issue in intern.c and fast.c.

data/ext/oj/cache.c

@@ -28,6 +28,22 @@
 // almost the Murmur hash algorithm
 #define M 0x5bd1e995
 
+uint64_t oj_hash_seed = 0;
+
+void oj_hash_seed_init(void) {
+    static bool seeded = false;
+
+    if (seeded) {
+        return;
+    }
+    seeded = true;
+#if HAVE_RB_HASH_START
+    oj_hash_seed = (uint64_t)rb_hash_start(0);
+#else
+    oj_hash_seed = (uint64_t)NUM2LL(rb_funcall(rb_str_new_cstr("oj"), rb_intern("hash"), 0));
+#endif
+}
+
 typedef struct _slot {
     struct _slot     *next;
     VALUE             val;
@@ -62,7 +78,7 @@ void cache_set_form(Cache c, VALUE (*form)(const char *str, size_t len)) {
 static uint64_t hash_calc(const uint8_t *key, size_t len) {
     const uint8_t *end     = key + len;
     const uint8_t *endless = key + (len & 0xFFFFFFFC);
-    uint64_t       h       = (uint64_t)len;
+    uint64_t       h       = (uint64_t)len ^ oj_hash_seed;
     uint64_t       k;
 
     while (key < endless) {

data/ext/oj/cache.h

@@ -6,9 +6,14 @@
 
 #include <ruby.h>
 #include <stdbool.h>
+#include <stdint.h>
 
 #define CACHE_MAX_KEY 35
 
+extern uint64_t oj_hash_seed;
+
+extern void oj_hash_seed_init(void);
+
 struct _cache;
 typedef struct _cache *Cache;
 

data/ext/oj/circarray.c

@@ -25,8 +25,12 @@ void oj_circ_array_free(CircArray ca) {
     OJ_R_FREE(ca);
 }
 
+// Objects are numbered in encounter order starting at 1, so the only id that
+// can extend the array is one past the highest already seen. Anything further
+// is not a reference to an object the document can contain and must not be
+// used to size an allocation.
 void oj_circ_array_set(CircArray ca, VALUE obj, unsigned long id) {
-    if (0 < id && 0 != ca) {
+    if (0 != ca && 0 < id && id <= ca->cnt + 1) {
         unsigned long i;
 
         if (ca->size < id) {
@@ -57,7 +61,7 @@ VALUE
 oj_circ_array_get(CircArray ca, unsigned long id) {
     VALUE obj = Qnil;
 
-    if (id <= ca->cnt && 0 != ca) {
+    if (0 != ca && 0 < id && id <= ca->cnt) {
         obj = ca->objs[id - 1];
     }
     return obj;

data/ext/oj/compat.c

@@ -14,11 +14,11 @@
 
 static void hash_set_cstr(ParseInfo pi, Val kval, const char *str, size_t len, const char *orig) {
     const char *key    = kval->key;
-    int         klen   = kval->klen;
+    size_t      klen   = kval->klen;
     Val         parent = stack_peek(&pi->stack);
 
     if (Qundef == kval->key_val && Yes == pi->options.create_ok && NULL != pi->options.create_id &&
-        *pi->options.create_id == *key && (int)pi->options.create_id_len == klen &&
+        *pi->options.create_id == *key && (size_t)pi->options.create_id_len == klen &&
         0 == strncmp(pi->options.create_id, key, klen)) {
         parent->classname = oj_strndup(str, len);
         parent->clen      = len;

data/ext/oj/custom.c

@@ -640,7 +640,9 @@ static void dump_obj_attrs(VALUE obj, VALUE clas, slot_t id, int depth, Out out)
     if (rb_obj_is_kind_of(obj, rb_eException)) {
         volatile VALUE rv;
 
-        if (',' != *(out->cur - 1)) {
+        // An exception that was never raised has no instance variables, so
+        // without the class name nothing has been written since the '{'.
+        if (',' != *(out->cur - 1) && '{' != *(out->cur - 1)) {
             *out->cur++ = ',';
         }
         // message
@@ -896,11 +898,11 @@ void oj_dump_custom_val(VALUE obj, int depth, Out out, bool as_ok) {
 
 static void hash_set_cstr(ParseInfo pi, Val kval, const char *str, size_t len, const char *orig) {
     const char *key    = kval->key;
-    int         klen   = kval->klen;
+    size_t      klen   = kval->klen;
     Val         parent = stack_peek(&pi->stack);
 
     if (Qundef == kval->key_val && Yes == pi->options.create_ok && NULL != pi->options.create_id &&
-        *pi->options.create_id == *key && (int)pi->options.create_id_len == klen &&
+        *pi->options.create_id == *key && (size_t)pi->options.create_id_len == klen &&
         0 == strncmp(pi->options.create_id, key, klen)) {
         parent->clas = oj_name2class(pi, str, len, false, rb_eArgError);
         if (2 == klen && '^' == *key && 'o' == key[1]) {

data/ext/oj/dump.c

@@ -1456,10 +1456,11 @@ void oj_dump_raw(const char *str, size_t cnt, Out out) {
 }
 
 void oj_out_init(Out out) {
-    out->buf       = out->stack_buffer;
-    out->cur       = out->buf;
-    out->end       = out->buf + sizeof(out->stack_buffer) - BUFFER_EXTRA;
-    out->allocated = false;
+    out->buf            = out->stack_buffer;
+    out->cur            = out->buf;
+    out->end            = out->buf + sizeof(out->stack_buffer) - BUFFER_EXTRA;
+    out->allocated      = false;
+    out->key_filter_off = false;
 }
 
 void oj_out_free(Out out) {
@@ -1731,6 +1732,11 @@ void oj_dump_float(VALUE obj, int depth, Out out, bool as_ok) {
 size_t oj_dump_float_printf(char *buf, size_t blen, VALUE obj, double d, const char *format) {
     size_t cnt = snprintf(buf, blen, format, d);
 
+    // snprintf() returns the length the output would have needed, which is
+    // more than it wrote when the format asks for more room than buf has.
+    if (blen <= cnt) {
+        cnt = blen - 1;
+    }
     // Round off issues at 16 significant digits so check for obvious ones of
     // 0001 and 9999.
     if (17 <= cnt && (0 == strcmp("0001", buf + cnt - 4) || 0 == strcmp("9999", buf + cnt - 4))) {
@@ -1742,6 +1748,21 @@ size_t oj_dump_float_printf(char *buf, size_t blen, VALUE obj, double d, const c
     return cnt;
 }
 
+// The only and except lists are the keys joined with a ':' and wrapped in one
+// at each end, so a key is in a list when ":key:" is in it. Matching in place
+// finds what searching the list for a copy of the key with the colons on it
+// found, without a buffer sized by the key.
+static bool key_listed(const char *list, const char *key, size_t klen) {
+    const char *s;
+
+    for (s = list; NULL != (s = strchr(s, ':')); s++) {
+        if (0 == strncmp(s + 1, key, klen) && ':' == s[klen + 1]) {
+            return true;
+        }
+    }
+    return false;
+}
+
 bool oj_key_skip(VALUE key, const char *only, const char *except) {
     const char *skey;
 
@@ -1751,15 +1772,9 @@ bool oj_key_skip(VALUE key, const char *only, const char *except) {
     default: skey = NULL; break;
     }
     if (NULL != skey && '\0' != *skey) {
-        size_t size = strlen(skey);
-        char  *buf  = alloca(size + 3);
-
-        buf[0] = ':';
-        strcpy(buf + 1, skey);
-        buf[size + 1] = ':';
-        buf[size + 2] = '\0';
+        size_t klen = strlen(skey);
 
-        return ((NULL != only && NULL == strstr(only, buf)) || (NULL != except && NULL != strstr(except, buf)));
+        return ((NULL != only && !key_listed(only, skey, klen)) || (NULL != except && key_listed(except, skey, klen)));
     }
     return NULL != only;
 }

data/ext/oj/dump.h

@@ -70,9 +70,19 @@ inline static void assure_size(Out out, size_t len) {
     }
 }
 
+// Bytes that fill_indent(), or the dump_opts equivalent used when :indent is a
+// String, writes at this depth. nl_size is array_size or hash_size.
+inline static size_t indent_len(Out out, int depth, size_t nl_size) {
+    if (out->opts->dump_opts.use) {
+        return depth * out->opts->dump_opts.indent_size + nl_size;
+    }
+    return depth * out->indent + 1;
+}
+
 inline static void fill_indent(Out out, int cnt) {
     if (0 < out->indent) {
         cnt *= out->indent;
+        assure_size(out, cnt + 1);
         *out->cur++ = '\n';
         memset(out->cur, ' ', cnt);
         out->cur += cnt;

data/ext/oj/dump_compat.c

@@ -162,6 +162,7 @@ static void dump_array(VALUE a, int depth, Out out, bool as_ok) {
                     }
                 }
             } else {
+                assure_size(out, size);
                 fill_indent(out, d2);
             }
             oj_dump_compat_val(RARRAY_AREF(a, i), d2, out, true);
@@ -298,9 +299,10 @@ static ID message_id   = 0;
 static ID backtrace_id = 0;
 
 static void exception_alt(VALUE obj, int depth, Out out) {
-    int    d3      = depth + 2;
-    size_t size    = d3 * out->indent + 2;
-    size_t sep_len = out->opts->dump_opts.before_size + out->opts->dump_opts.after_size + 2;
+    int            d3      = depth + 2;
+    size_t         size    = d3 * out->indent + 2;
+    size_t         sep_len = out->opts->dump_opts.before_size + out->opts->dump_opts.after_size + 2;
+    volatile VALUE bt;
 
     if (0 == message_id) {
         message_id   = rb_intern("message");
@@ -331,7 +333,12 @@ static void exception_alt(VALUE obj, int depth, Out out) {
     if (0 < out->opts->dump_opts.after_size) {
         APPEND_CHARS(out->cur, out->opts->dump_opts.after_sep, out->opts->dump_opts.after_size);
     }
-    dump_array(rb_funcall(obj, backtrace_id, 0), depth, out, false);
+    bt = rb_funcall(obj, backtrace_id, 0);
+    if (T_ARRAY == rb_type(bt)) {
+        dump_array(bt, depth, out, false);
+    } else {
+        oj_dump_nil(Qnil, depth, out, false);
+    }
     fill_indent(out, depth);
     *out->cur++ = '}';
     *out->cur   = '\0';

data/ext/oj/dump_object.c

@@ -10,6 +10,24 @@ static const char hex_chars[17] = "0123456789abcdef";
 
 static void dump_obj_attrs(VALUE obj, VALUE clas, slot_t id, int depth, Out out);
 
+// An odd class is dumped as {"^O":class,...} and is rebuilt with a create
+// function when loaded so there is no place to put a "^i" circular id on it.
+// Registering it in the circular cache would consume an id that is never
+// written and any later occurrence would then be dumped as a "^r" that refers
+// to nothing. Instead dump odd classes in full each time they are encountered
+// just like Time, Rational, and Complex are.
+static void dump_circular_obj(VALUE obj, VALUE clas, int depth, Out out) {
+    if (NULL != oj_get_odd(clas)) {
+        dump_obj_attrs(obj, clas, 0, depth, out);
+    } else {
+        long id = oj_check_circular(obj, out);
+
+        if (0 <= id) {
+            dump_obj_attrs(obj, clas, id, depth, out);
+        }
+    }
+}
+
 static void dump_time(VALUE obj, Out out) {
     switch (out->opts->time_format) {
     case RubyTime:
@@ -47,11 +65,7 @@ static void dump_data(VALUE obj, int depth, Out out, bool as_ok) {
                 oj_dump_cstr(str, len, 0, 0, out);
             }
         } else {
-            long id = oj_check_circular(obj, out);
-
-            if (0 <= id) {
-                dump_obj_attrs(obj, clas, id, depth, out);
-            }
+            dump_circular_obj(obj, clas, depth, out);
         }
     }
 }
@@ -74,11 +88,7 @@ static void dump_obj(VALUE obj, int depth, Out out, bool as_ok) {
             oj_dump_raw(str, len, out);
         }
     } else {
-        long id = oj_check_circular(obj, out);
-
-        if (0 <= id) {
-            dump_obj_attrs(obj, clas, id, depth, out);
-        }
+        dump_circular_obj(obj, clas, depth, out);
     }
 }
 

data/ext/oj/extconf.rb

@@ -32,6 +32,7 @@ have_func('pthread_mutex_init')
 have_func('getrlimit', 'sys/resource.h')
 have_func('rb_enc_interned_str')
 have_func('rb_ext_ractor_safe', 'ruby.h')
+have_func('rb_hash_start', 'ruby.h')
 
 dflags['OJ_DEBUG'] = true unless ENV['OJ_DEBUG'].nil?
 

data/ext/oj/fast.c

@@ -92,12 +92,35 @@ inline static void next_non_white(ParseInfo pi) {
         case '\f':
         case '\n':
         case '\r': break;
-        case '/': skip_comment(pi); break;
+        case '/':
+            skip_comment(pi);
+            // A comment that is not terminated by a newline ends on the null
+            // terminator. Stop here so the loop does not step past it.
+            if ('\0' == *pi->s) {
+                return;
+            }
+            break;
         default: return;
         }
     }
 }
 
+inline static bool is_value_end(char c) {
+    switch (c) {
+    case '\0':
+    case ' ':
+    case '\t':
+    case '\f':
+    case '\n':
+    case '\r':
+    case '/':
+    case ',':
+    case ']':
+    case '}': return true;
+    default: return false;
+    }
+}
+
 inline static char *ulong_fill(char *s, size_t num) {
     char  buf[32];
     char *b = buf + sizeof(buf) - 1;
@@ -210,10 +233,11 @@ static void skip_comment(ParseInfo pi) {
             if ('*' == *pi->s && '/' == *(pi->s + 1)) {
                 pi->s++;
                 return;
-            } else if ('\0' == *pi->s) {
-                raise_error("comment not terminated", pi->str, pi->s);
             }
         }
+        // The loop only ends on the null terminator so the comment was never
+        // closed.
+        raise_error("comment not terminated", pi->str, pi->s);
     } else if ('/' == *pi->s) {
         for (; 1; pi->s++) {
             switch (*pi->s) {
@@ -455,27 +479,42 @@ static Leaf read_num(ParseInfo pi) {
     char *start = pi->s;
     int   type  = T_FIXNUM;
     Leaf  leaf;
+    int   dcnt = 0;
+    int   ecnt = 1;
 
-    if ('-' == *pi->s) {
+    // read_next() sends a leading '+' here as well, and Oj.load() takes one.
+    if ('-' == *pi->s || '+' == *pi->s) {
         pi->s++;
     }
     // digits
     for (; '0' <= *pi->s && *pi->s <= '9'; pi->s++) {
+        dcnt++;
     }
     if ('.' == *pi->s) {
         type = T_FLOAT;
         pi->s++;
         for (; '0' <= *pi->s && *pi->s <= '9'; pi->s++) {
+            dcnt++;
         }
     }
     if ('e' == *pi->s || 'E' == *pi->s) {
+        // An exponent makes it a float whether or not a '.' was seen. Without
+        // this leaf_fixnum_value() stops reading at the 'e' and the exponent is
+        // dropped.
+        type = T_FLOAT;
         pi->s++;
         if ('-' == *pi->s || '+' == *pi->s) {
             pi->s++;
         }
-        for (; '0' <= *pi->s && *pi->s <= '9'; pi->s++) {
+        for (ecnt = 0; '0' <= *pi->s && *pi->s <= '9'; pi->s++) {
+            ecnt++;
         }
     }
+    // A float is converted with rb_cstr_to_dbl(), which has to be given
+    // something it can convert.
+    if (T_FLOAT == type && (0 == dcnt || 0 == ecnt || !is_value_end(*pi->s))) {
+        raise_error("invalid number", pi->str, pi->s);
+    }
     leaf      = leaf_new(pi->doc, type);
     leaf->str = start;
 
@@ -662,7 +701,11 @@ static void doc_free(Doc doc) {
 static VALUE protect_open_proc(VALUE x) {
     ParseInfo pi = (ParseInfo)x;
 
-    pi->doc->data   = read_next(pi);  // parse
+    pi->doc->data = read_next(pi);  // parse
+    // read_obj() and read_array() terminate each value where it ends. The top
+    // level value has no closing delimiter to do that on, so a number leaf runs
+    // to the end of the document unless it is terminated here.
+    *pi->s          = '\0';
     *pi->doc->where = pi->doc->data;
     pi->doc->where  = pi->doc->where_path;
     if (rb_block_given_p()) {
@@ -710,21 +753,23 @@ static void mark_doc(void *ptr) {
 }
 #ifdef HAVE_RB_GC_MARK_MOVABLE
 static void compact_leaf(Leaf leaf) {
-    switch (leaf->value_type) {
-    case COL_VAL:
-        if (NULL != leaf->elements) {
-            Leaf first = leaf->elements->next;
-            Leaf e     = first;
+    if (NULL != leaf) {
+        switch (leaf->value_type) {
+        case COL_VAL:
+            if (NULL != leaf->elements) {
+                Leaf first = leaf->elements->next;
+                Leaf e     = first;
 
-            do {
-                compact_leaf(e);
-                e = e->next;
-            } while (e != first);
-        }
-        break;
-    case RUBY_VAL: leaf->value = rb_gc_location(leaf->value); break;
+                do {
+                    compact_leaf(e);
+                    e = e->next;
+                } while (e != first);
+            }
+            break;
+        case RUBY_VAL: leaf->value = rb_gc_location(leaf->value); break;
 
-    default: break;
+        default: break;
+        }
     }
 }
 
@@ -790,14 +835,11 @@ static VALUE parse_json(VALUE clas, char *json, bool given) {
     doc->self = self;
     result    = rb_protect(protect_open_proc, (VALUE)&pi, &ex);
     if (given || 0 != ex) {
+        // The doc is detached from its wrapper so the GC will not free it.
+        // doc_free() releases both the doc and its json buffer (doc->json), so
+        // the caller must not free json separately.
         DATA_PTR(doc->self) = NULL;
-        // TBD is this needed?
-        /*
         doc_free(pi.doc);
-        if (0 != ex) {  // will jump so caller will not free
-            OJ_R_FREE(json);
-        }
-        */
     } else {
         result = doc->self;
     }
@@ -865,7 +907,7 @@ static bool key_match(const char *pat, const char *key, int plen) {
 static Leaf get_leaf(Leaf *stack, Leaf *lp, const char *path) {
     Leaf leaf = *lp;
 
-    if (MAX_STACK <= lp - stack) {
+    if (MAX_STACK <= (lp + 1) - stack) {
         rb_raise(rb_const_get_at(Oj, rb_intern("DepthError")), "Path too deep. Limit is %d levels.", MAX_STACK);
     }
     if ('\0' != *path) {
@@ -946,6 +988,7 @@ static void each_leaf(Doc doc, VALUE self) {
 
             doc->where++;
             if (MAX_STACK <= doc->where - doc->where_path) {
+                doc->where--;
                 rb_raise(rb_const_get_at(Oj, rb_intern("DepthError")), "Path too deep. Limit is %d levels.", MAX_STACK);
             }
             do {
@@ -964,7 +1007,7 @@ static void each_leaf(Doc doc, VALUE self) {
 }
 
 static int move_step(Doc doc, const char *path, int loc) {
-    if (MAX_STACK <= doc->where - doc->where_path) {
+    if (MAX_STACK <= (doc->where + 1) - doc->where_path) {
         rb_raise(rb_const_get_at(Oj, rb_intern("DepthError")), "Path too deep. Limit is %d levels.", MAX_STACK);
     }
     if ('\0' == *path) {
@@ -972,8 +1015,9 @@ static int move_step(Doc doc, const char *path, int loc) {
     } else {
         Leaf leaf;
 
+        // A document with no root (empty or comment only JSON) has no leaf to
+        // step from so the path can not be located.
         if (0 == doc->where || 0 == (leaf = *doc->where)) {
-            printf("*** Internal error at %s\n", path);
             return loc;
         }
         if ('.' == *path && '.' == *(path + 1)) {
@@ -1104,12 +1148,7 @@ static VALUE doc_open(VALUE clas, VALUE str) {
 
     memcpy(json, StringValuePtr(str), len);
     obj = parse_json(clas, json, given);
-    // TBD is this needed
-    /*
-    if (given) {
-        OJ_R_FREE(json);
-    }
-    */
+    // json is owned by the doc and freed by doc_free(); do not free it here.
     return obj;
 }
 
@@ -1141,7 +1180,9 @@ static VALUE doc_open_file(VALUE clas, VALUE filename) {
     int            given = rb_block_given_p();
 
     path = StringValuePtr(filename);
-    if (0 == (f = fopen(path, "r"))) {
+    // Open in binary mode. On Windows a text mode read translates CRLF into LF
+    // so fewer bytes are read than the file size reported by ftell().
+    if (0 == (f = fopen(path, "rb"))) {
         rb_raise(rb_eIOError, "%s", strerror(errno));
     }
     fseek(f, 0, SEEK_END);
@@ -1159,12 +1200,7 @@ static VALUE doc_open_file(VALUE clas, VALUE filename) {
     fclose(f);
     json[len] = '\0';
     obj       = parse_json(clas, json, given);
-    // TBD is this needed
-    /*
-    if (given) {
-        OJ_R_FREE(json);
-    }
-    */
+    // json is owned by the doc and freed by doc_free(); do not free it here.
     return obj;
 }
 
@@ -1263,10 +1299,14 @@ static VALUE doc_path(VALUE self) {
  * #=> nil
  */
 static VALUE doc_local_key(VALUE self) {
-    Doc            doc  = self_doc(self);
-    Leaf           leaf = *doc->where;
-    volatile VALUE key  = Qnil;
+    Doc            doc = self_doc(self);
+    Leaf           leaf;
+    volatile VALUE key = Qnil;
 
+    if (NULL == doc->where || NULL == *doc->where) {
+        return Qnil;
+    }
+    leaf = *doc->where;
     if (T_HASH == leaf->parent_type) {
         key = rb_utf8_str_new_cstr(leaf->key);
     } else if (T_ARRAY == leaf->parent_type) {
@@ -1421,6 +1461,9 @@ static VALUE doc_each_leaf(int argc, VALUE *argv, VALUE self) {
                 return Qnil;
             }
         }
+        if (NULL == doc->where || NULL == *doc->where) {
+            return Qnil;
+        }
         each_leaf(doc, self);
         if (0 < wlen) {
             memcpy(doc->where_path, save_path, sizeof(Leaf) * (wlen + 1));