oj 3.17.4 → 3.17.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8bbb833f16ca15e4591772c707b059e1db37eee8aaf02240cd2f628bf1876f4c
-  data.tar.gz: 8020f6e49607b38fb120a5a6ea4eea9e5ba3e73f35b3556b7defb0202e93e015
+  metadata.gz: 62e3d04685cbc7e063801fd45fc2e9c86a3695ac1fff9235d49944fb19a1ba50
+  data.tar.gz: 98cd36664b62b1d774998a5c39d4ea1610fbeb5a4d789de2bd80894bf9121fbe
 SHA512:
-  metadata.gz: df072519e6d25cc38a04328022741db7bfe3d39a1545337aa6828982eaf233673ee2e04bb697ffb037aa25e0521258881ea96204d8a5d46b0a93b80dc002e94e
-  data.tar.gz: d0683f49f90c751beeb45b2d1ffb39238fd7c0c42e8c2970ed76eeb8ab2f382221c3ef7cdbc7d619ea29c50b7b3bf29559a8ae1e3ec34aa9b56e13a8fb02eac5
+  metadata.gz: '029e6458460f15ae5bcbf26bb25ff959b5c3a0b70cf04b5eded0b2ff50930bbd3470b51410590fbf6621640590257360e0d20b290af8c28efbb31ee0a602998b'
+  data.tar.gz: c2442be3533074487f3fa7b7e84fac719748cd3f99c40217dc6f6dbc09600e491b2925905f400e2ac7de5639d78d15f76f01f5865a41dda2f963e6ccfd59223c

data/CHANGELOG.md

@@ -1,5 +1,74 @@
 # CHANGELOG
 
+## 3.17.5 - 2026-07-31
+
+Most of this release comes out of a security review of the C extension. There are no API changes.
+
+### Memory safety
+
+- Fixed hash flooding by seeding the key hash per process. The hash was decided entirely at compile time, so a document of colliding keys turned key interning into O(n^2) and left the process slow for every later parse. (#1053)
+- Fixed a one byte buffer over-read on a document that ends with a backslash inside an unterminated string. (#1054)
+- Fixed two length underflows that made an empty `^m` value and a key of exactly 65,536 bytes read forward until they left mapped memory. (#1055)
+- Fixed a SEGV from type confusion in class path resolution. A name segment that resolved to something other than a class or module was dereferenced as one. (#1056)
+- Fixed uninitialized stack memory being read into the message of an unresolved class name error. (#1057)
+- Fixed output buffer overflows when writing indentation, where several callers of `fill_indent()` had not assured the buffer first. (#1058)
+- Fixed the `Oj::Doc` path depth limit being checked one level too late. (#1061)
+- Fixed the use-after-free of a key when the value stack grows. (#1062)
+- Fixed the buffer over-read when a document ends where a key belongs. (#1063)
+- Fixed the id from a circular reference being used unchecked. (#1064)
+- Fixed the SEGV dumping an exception that was never raised, where the missing backtrace was read as an Array. (#1068)
+- Fixed the stack buffer overflow writing the error location. (#1071)
+- Fixed a read error in `Oj::Parser#file` being taken as a read of `SIZE_MAX` bytes, which wrote in front of the buffer and then reparsed it forever without checking for interrupts. (#1072)
+- Fixed a `:float_format` too long for the 64 byte buffer copying stack bytes past the end of it into the output. (#1073)
+- Fixed the double free of the default `create_id` when a call passes `:create_id => nil`. (#1074)
+- Fixed the buffer over-read of an odd attribute name and the leak of its arguments. (#1075)
+- Fixed the SEGV reading a truncated document with `Oj::Parser#file` and the descriptor it leaked. (#1076)
+- Fixed the SEGV from a malformed number in `Oj::Doc`. (#1077)
+- Fixed the stack exhaustion from a long key with `:only` or `:except`. (#1078)
+- Fixed the odd module match being decided by uninitialized memory. (#1079)
+- Fixed `:float_format` accepting directives it has no argument for. (#1083)
+
+### Memory leaks
+
+- Fixed the leak of an escaped hash key in the streaming parser. (#1067)
+- Fixed the leak of the parser `create_id` when it is set a second time. (#1085)
+- Fixed the leak of the parser when `Oj::Parser.new` or `Oj::Parser.safe` raises on an argument it does not take. (#1086)
+
+### Parsing and dumping
+
+- Fixed a safe parser limit of 4 being ignored. (#1065)
+- Fixed the exponent bound being checked after it is narrowed. (#1066)
+- Fixed a document being rejected when it opens with a number of 4093 digits or more read through a file descriptor or an IO, and the reader buffer that leaked when it grew. (#1069)
+- Fixed the safe parser limits being dropped when an option is set after the parser is built. (#1070)
+- Fixed the `:custom` mode dump of an exception that was never raised opening with `{,`. (#1082)
+- Fixed the `:wab` mode time load being an offset out on Windows, where `mktime()` stood in for `timegm()` and returned -1 for any time before the epoch. (#1088)
+- Fixed `Oj::Doc` dropping the exponent of a number written without a decimal point, so `1e3` loaded as `1`. (#1089)
+
+### Rails
+
+- Fixed a `to_json(only:)` or `to_json(except:)` dropping the `include_root_in_json` wrapper key and the keys added by `:methods`. (#1039)
+- Fixed the `as_json` options reaching only the first element of a container, so `to_json(only:)`, `to_json(methods:)` and any custom `as_json(opts)` took effect on one row and nowhere else. (#1040)
+- An encoder now reads the global optimized class table and options instead of copying them, saving about 6.7KB of malloc per `ActiveSupport::JSON.encode`, and picks up later `Oj.default_options` and `ActiveSupport::JSON::Encoding` changes. (#1049)
+- Fixed `as_json` being handed the encoder's own options hash. ActiveSupport allows `as_json` to write into it, and ActiveSupport 8.1 caches one encoder per process, so a single such `as_json` could leave `:only` set for every later `to_json`. (#1050)
+
+### Documentation
+
+- Renamed the documented `:skip_null_byte` option to `:omit_null_byte`, which is the name that works. (#1041)
+- Dropped the `--with-sse42` install option from InstallOptions.md. SIMD support is detected at runtime. (#1042)
+- Corrected the documented minimum Ruby version from 2.4+ to 2.7+. (#1043)
+- Corrected the Parser.md benchmark conclusions to reference `:usual` rather than `:saj`. (#1044)
+- Corrected Custom.md and Options.md, which called `:custom` the default mode. The default is `:object`. (#1045)
+- Corrected the documented type of the `:safe` option from String to Boolean. (#1046)
+- Corrected Security.md, which said no methods are ever called on an Object created by a load. `exception`, `set_backtrace` and `replace` are. The page now also says which mode `Oj.load` uses. (#1080)
+
+### Tests and CI
+
+- Added the ActiveSupport 8 test suite. The Rakefile picked the suite by major version, so the rails_8 job had been running zero ActiveSupport tests. (#1047)
+- Added the ActiveSupport 8.1 test suite and pinned the #985 regression. (#1051)
+- Fixed `rake` never running the `test/test_*.rb` suite. The `Rake::TestTask` that defined `test` was commented out, so `test_all` invoked a synthesized no-op file task. (#1084)
+- Added a job timeout to the workflows. (#1087)
+- Removed the pre-1970 time test skips on Windows, which were left from a 32 bit Ruby limit that no longer applies. (#1090)
+
 ## 3.17.4 - 2026-07-14
 
 - Fixed issue in fast.c where rescuing from a panic did not reset the where counter.

data/ext/oj/cache.c

@@ -28,6 +28,22 @@
 // almost the Murmur hash algorithm
 #define M 0x5bd1e995
 
+uint64_t oj_hash_seed = 0;
+
+void oj_hash_seed_init(void) {
+    static bool seeded = false;
+
+    if (seeded) {
+        return;
+    }
+    seeded = true;
+#if HAVE_RB_HASH_START
+    oj_hash_seed = (uint64_t)rb_hash_start(0);
+#else
+    oj_hash_seed = (uint64_t)NUM2LL(rb_funcall(rb_str_new_cstr("oj"), rb_intern("hash"), 0));
+#endif
+}
+
 typedef struct _slot {
     struct _slot     *next;
     VALUE             val;
@@ -62,7 +78,7 @@ void cache_set_form(Cache c, VALUE (*form)(const char *str, size_t len)) {
 static uint64_t hash_calc(const uint8_t *key, size_t len) {
     const uint8_t *end     = key + len;
     const uint8_t *endless = key + (len & 0xFFFFFFFC);
-    uint64_t       h       = (uint64_t)len;
+    uint64_t       h       = (uint64_t)len ^ oj_hash_seed;
     uint64_t       k;
 
     while (key < endless) {

data/ext/oj/cache.h

@@ -6,9 +6,14 @@
 
 #include <ruby.h>
 #include <stdbool.h>
+#include <stdint.h>
 
 #define CACHE_MAX_KEY 35
 
+extern uint64_t oj_hash_seed;
+
+extern void oj_hash_seed_init(void);
+
 struct _cache;
 typedef struct _cache *Cache;
 

data/ext/oj/circarray.c

@@ -25,8 +25,12 @@ void oj_circ_array_free(CircArray ca) {
     OJ_R_FREE(ca);
 }
 
+// Objects are numbered in encounter order starting at 1, so the only id that
+// can extend the array is one past the highest already seen. Anything further
+// is not a reference to an object the document can contain and must not be
+// used to size an allocation.
 void oj_circ_array_set(CircArray ca, VALUE obj, unsigned long id) {
-    if (0 < id && 0 != ca) {
+    if (0 != ca && 0 < id && id <= ca->cnt + 1) {
         unsigned long i;
 
         if (ca->size < id) {
@@ -57,7 +61,7 @@ VALUE
 oj_circ_array_get(CircArray ca, unsigned long id) {
     VALUE obj = Qnil;
 
-    if (id <= ca->cnt && 0 != ca) {
+    if (0 != ca && 0 < id && id <= ca->cnt) {
         obj = ca->objs[id - 1];
     }
     return obj;

data/ext/oj/compat.c

@@ -14,11 +14,11 @@
 
 static void hash_set_cstr(ParseInfo pi, Val kval, const char *str, size_t len, const char *orig) {
     const char *key    = kval->key;
-    int         klen   = kval->klen;
+    size_t      klen   = kval->klen;
     Val         parent = stack_peek(&pi->stack);
 
     if (Qundef == kval->key_val && Yes == pi->options.create_ok && NULL != pi->options.create_id &&
-        *pi->options.create_id == *key && (int)pi->options.create_id_len == klen &&
+        *pi->options.create_id == *key && (size_t)pi->options.create_id_len == klen &&
         0 == strncmp(pi->options.create_id, key, klen)) {
         parent->classname = oj_strndup(str, len);
         parent->clen      = len;

data/ext/oj/custom.c

@@ -640,7 +640,9 @@ static void dump_obj_attrs(VALUE obj, VALUE clas, slot_t id, int depth, Out out)
     if (rb_obj_is_kind_of(obj, rb_eException)) {
         volatile VALUE rv;
 
-        if (',' != *(out->cur - 1)) {
+        // An exception that was never raised has no instance variables, so
+        // without the class name nothing has been written since the '{'.
+        if (',' != *(out->cur - 1) && '{' != *(out->cur - 1)) {
             *out->cur++ = ',';
         }
         // message
@@ -896,11 +898,11 @@ void oj_dump_custom_val(VALUE obj, int depth, Out out, bool as_ok) {
 
 static void hash_set_cstr(ParseInfo pi, Val kval, const char *str, size_t len, const char *orig) {
     const char *key    = kval->key;
-    int         klen   = kval->klen;
+    size_t      klen   = kval->klen;
     Val         parent = stack_peek(&pi->stack);
 
     if (Qundef == kval->key_val && Yes == pi->options.create_ok && NULL != pi->options.create_id &&
-        *pi->options.create_id == *key && (int)pi->options.create_id_len == klen &&
+        *pi->options.create_id == *key && (size_t)pi->options.create_id_len == klen &&
         0 == strncmp(pi->options.create_id, key, klen)) {
         parent->clas = oj_name2class(pi, str, len, false, rb_eArgError);
         if (2 == klen && '^' == *key && 'o' == key[1]) {

data/ext/oj/dump.c

@@ -1456,10 +1456,11 @@ void oj_dump_raw(const char *str, size_t cnt, Out out) {
 }
 
 void oj_out_init(Out out) {
-    out->buf       = out->stack_buffer;
-    out->cur       = out->buf;
-    out->end       = out->buf + sizeof(out->stack_buffer) - BUFFER_EXTRA;
-    out->allocated = false;
+    out->buf            = out->stack_buffer;
+    out->cur            = out->buf;
+    out->end            = out->buf + sizeof(out->stack_buffer) - BUFFER_EXTRA;
+    out->allocated      = false;
+    out->key_filter_off = false;
 }
 
 void oj_out_free(Out out) {
@@ -1731,6 +1732,11 @@ void oj_dump_float(VALUE obj, int depth, Out out, bool as_ok) {
 size_t oj_dump_float_printf(char *buf, size_t blen, VALUE obj, double d, const char *format) {
     size_t cnt = snprintf(buf, blen, format, d);
 
+    // snprintf() returns the length the output would have needed, which is
+    // more than it wrote when the format asks for more room than buf has.
+    if (blen <= cnt) {
+        cnt = blen - 1;
+    }
     // Round off issues at 16 significant digits so check for obvious ones of
     // 0001 and 9999.
     if (17 <= cnt && (0 == strcmp("0001", buf + cnt - 4) || 0 == strcmp("9999", buf + cnt - 4))) {
@@ -1742,6 +1748,21 @@ size_t oj_dump_float_printf(char *buf, size_t blen, VALUE obj, double d, const c
     return cnt;
 }
 
+// The only and except lists are the keys joined with a ':' and wrapped in one
+// at each end, so a key is in a list when ":key:" is in it. Matching in place
+// finds what searching the list for a copy of the key with the colons on it
+// found, without a buffer sized by the key.
+static bool key_listed(const char *list, const char *key, size_t klen) {
+    const char *s;
+
+    for (s = list; NULL != (s = strchr(s, ':')); s++) {
+        if (0 == strncmp(s + 1, key, klen) && ':' == s[klen + 1]) {
+            return true;
+        }
+    }
+    return false;
+}
+
 bool oj_key_skip(VALUE key, const char *only, const char *except) {
     const char *skey;
 
@@ -1751,15 +1772,9 @@ bool oj_key_skip(VALUE key, const char *only, const char *except) {
     default: skey = NULL; break;
     }
     if (NULL != skey && '\0' != *skey) {
-        size_t size = strlen(skey);
-        char  *buf  = alloca(size + 3);
-
-        buf[0] = ':';
-        strcpy(buf + 1, skey);
-        buf[size + 1] = ':';
-        buf[size + 2] = '\0';
+        size_t klen = strlen(skey);
 
-        return ((NULL != only && NULL == strstr(only, buf)) || (NULL != except && NULL != strstr(except, buf)));
+        return ((NULL != only && !key_listed(only, skey, klen)) || (NULL != except && key_listed(except, skey, klen)));
     }
     return NULL != only;
 }

data/ext/oj/dump.h

@@ -70,9 +70,19 @@ inline static void assure_size(Out out, size_t len) {
     }
 }
 
+// Bytes that fill_indent(), or the dump_opts equivalent used when :indent is a
+// String, writes at this depth. nl_size is array_size or hash_size.
+inline static size_t indent_len(Out out, int depth, size_t nl_size) {
+    if (out->opts->dump_opts.use) {
+        return depth * out->opts->dump_opts.indent_size + nl_size;
+    }
+    return depth * out->indent + 1;
+}
+
 inline static void fill_indent(Out out, int cnt) {
     if (0 < out->indent) {
         cnt *= out->indent;
+        assure_size(out, cnt + 1);
         *out->cur++ = '\n';
         memset(out->cur, ' ', cnt);
         out->cur += cnt;

data/ext/oj/dump_compat.c

@@ -299,9 +299,10 @@ static ID message_id   = 0;
 static ID backtrace_id = 0;
 
 static void exception_alt(VALUE obj, int depth, Out out) {
-    int    d3      = depth + 2;
-    size_t size    = d3 * out->indent + 2;
-    size_t sep_len = out->opts->dump_opts.before_size + out->opts->dump_opts.after_size + 2;
+    int            d3      = depth + 2;
+    size_t         size    = d3 * out->indent + 2;
+    size_t         sep_len = out->opts->dump_opts.before_size + out->opts->dump_opts.after_size + 2;
+    volatile VALUE bt;
 
     if (0 == message_id) {
         message_id   = rb_intern("message");
@@ -332,7 +333,12 @@ static void exception_alt(VALUE obj, int depth, Out out) {
     if (0 < out->opts->dump_opts.after_size) {
         APPEND_CHARS(out->cur, out->opts->dump_opts.after_sep, out->opts->dump_opts.after_size);
     }
-    dump_array(rb_funcall(obj, backtrace_id, 0), depth, out, false);
+    bt = rb_funcall(obj, backtrace_id, 0);
+    if (T_ARRAY == rb_type(bt)) {
+        dump_array(bt, depth, out, false);
+    } else {
+        oj_dump_nil(Qnil, depth, out, false);
+    }
     fill_indent(out, depth);
     *out->cur++ = '}';
     *out->cur   = '\0';

data/ext/oj/extconf.rb

@@ -32,6 +32,7 @@ have_func('pthread_mutex_init')
 have_func('getrlimit', 'sys/resource.h')
 have_func('rb_enc_interned_str')
 have_func('rb_ext_ractor_safe', 'ruby.h')
+have_func('rb_hash_start', 'ruby.h')
 
 dflags['OJ_DEBUG'] = true unless ENV['OJ_DEBUG'].nil?
 

data/ext/oj/fast.c

@@ -105,6 +105,22 @@ inline static void next_non_white(ParseInfo pi) {
     }
 }
 
+inline static bool is_value_end(char c) {
+    switch (c) {
+    case '\0':
+    case ' ':
+    case '\t':
+    case '\f':
+    case '\n':
+    case '\r':
+    case '/':
+    case ',':
+    case ']':
+    case '}': return true;
+    default: return false;
+    }
+}
+
 inline static char *ulong_fill(char *s, size_t num) {
     char  buf[32];
     char *b = buf + sizeof(buf) - 1;
@@ -463,27 +479,42 @@ static Leaf read_num(ParseInfo pi) {
     char *start = pi->s;
     int   type  = T_FIXNUM;
     Leaf  leaf;
+    int   dcnt = 0;
+    int   ecnt = 1;
 
-    if ('-' == *pi->s) {
+    // read_next() sends a leading '+' here as well, and Oj.load() takes one.
+    if ('-' == *pi->s || '+' == *pi->s) {
         pi->s++;
     }
     // digits
     for (; '0' <= *pi->s && *pi->s <= '9'; pi->s++) {
+        dcnt++;
     }
     if ('.' == *pi->s) {
         type = T_FLOAT;
         pi->s++;
         for (; '0' <= *pi->s && *pi->s <= '9'; pi->s++) {
+            dcnt++;
         }
     }
     if ('e' == *pi->s || 'E' == *pi->s) {
+        // An exponent makes it a float whether or not a '.' was seen. Without
+        // this leaf_fixnum_value() stops reading at the 'e' and the exponent is
+        // dropped.
+        type = T_FLOAT;
         pi->s++;
         if ('-' == *pi->s || '+' == *pi->s) {
             pi->s++;
         }
-        for (; '0' <= *pi->s && *pi->s <= '9'; pi->s++) {
+        for (ecnt = 0; '0' <= *pi->s && *pi->s <= '9'; pi->s++) {
+            ecnt++;
         }
     }
+    // A float is converted with rb_cstr_to_dbl(), which has to be given
+    // something it can convert.
+    if (T_FLOAT == type && (0 == dcnt || 0 == ecnt || !is_value_end(*pi->s))) {
+        raise_error("invalid number", pi->str, pi->s);
+    }
     leaf      = leaf_new(pi->doc, type);
     leaf->str = start;
 
@@ -670,7 +701,11 @@ static void doc_free(Doc doc) {
 static VALUE protect_open_proc(VALUE x) {
     ParseInfo pi = (ParseInfo)x;
 
-    pi->doc->data   = read_next(pi);  // parse
+    pi->doc->data = read_next(pi);  // parse
+    // read_obj() and read_array() terminate each value where it ends. The top
+    // level value has no closing delimiter to do that on, so a number leaf runs
+    // to the end of the document unless it is terminated here.
+    *pi->s          = '\0';
     *pi->doc->where = pi->doc->data;
     pi->doc->where  = pi->doc->where_path;
     if (rb_block_given_p()) {
@@ -872,7 +907,7 @@ static bool key_match(const char *pat, const char *key, int plen) {
 static Leaf get_leaf(Leaf *stack, Leaf *lp, const char *path) {
     Leaf leaf = *lp;
 
-    if (MAX_STACK <= lp - stack) {
+    if (MAX_STACK <= (lp + 1) - stack) {
         rb_raise(rb_const_get_at(Oj, rb_intern("DepthError")), "Path too deep. Limit is %d levels.", MAX_STACK);
     }
     if ('\0' != *path) {
@@ -972,7 +1007,7 @@ static void each_leaf(Doc doc, VALUE self) {
 }
 
 static int move_step(Doc doc, const char *path, int loc) {
-    if (MAX_STACK <= doc->where - doc->where_path) {
+    if (MAX_STACK <= (doc->where + 1) - doc->where_path) {
         rb_raise(rb_const_get_at(Oj, rb_intern("DepthError")), "Path too deep. Limit is %d levels.", MAX_STACK);
     }
     if ('\0' == *path) {

data/ext/oj/intern.c

@@ -97,6 +97,8 @@ static const rb_data_type_t oj_cache_type = {
 };
 
 void oj_hash_init(void) {
+    oj_hash_seed_init();
+
     VALUE cache_class = rb_define_class_under(Oj, "Cache", rb_cObject);
     rb_undef_alloc_func(cache_class);
 
@@ -151,7 +153,7 @@ ID oj_attr_intern(const char *key, size_t len) {
 static uint64_t hash_calc(const uint8_t *key, size_t len) {
     const uint8_t *end     = key + len;
     const uint8_t *endless = key + (len & 0xFFFFFFFC);
-    uint64_t       h       = (uint64_t)len;
+    uint64_t       h       = (uint64_t)len ^ oj_hash_seed;
     uint64_t       k;
 
     while (key < endless) {
@@ -188,6 +190,9 @@ static VALUE resolve_classname(VALUE mod, const char *classname, int auto_define
 
     if (rb_const_defined_at(mod, ci)) {
         clas = rb_const_get_at(mod, ci);
+        if (!RB_TYPE_P(clas, T_CLASS) && !RB_TYPE_P(clas, T_MODULE)) {
+            clas = Qundef;
+        }
     } else if (auto_define) {
         clas = rb_define_class_under(mod, classname, oj_bag_class);
     } else {

data/ext/oj/object.c

@@ -31,7 +31,7 @@ inline static long read_long(const char *str, size_t len) {
 static VALUE calc_hash_key(ParseInfo pi, Val kval, char k1) {
     volatile VALUE rkey;
 
-    if (':' == k1) {
+    if (':' == k1 && 0 < kval->klen) {
         return ID2SYM(rb_intern3(kval->key + 1, kval->klen - 1, oj_utf8_encoding));
     }
     if (Yes == pi->options.sym_key) {
@@ -54,7 +54,7 @@ static VALUE str_to_value(ParseInfo pi, const char *str, size_t len, const char
     } else if (pi->circ_array && 3 <= len && '^' == *orig && 'r' == orig[1]) {
         long i = read_long(str + 2, len - 2);
 
-        if (0 > i) {
+        if (0 >= i) {
             oj_set_error_at(pi, oj_parse_error_class, __FILE__, __LINE__, "not a valid ID number");
             return Qnil;
         }
@@ -207,7 +207,7 @@ oj_parse_xml_time(const char *str, int len) {
 
 static int hat_cstr(ParseInfo pi, Val parent, Val kval, const char *str, size_t len) {
     const char *key  = kval->key;
-    int         klen = kval->klen;
+    size_t      klen = kval->klen;
 
     if (2 == klen) {
         switch (key[1]) {
@@ -230,7 +230,12 @@ static int hat_cstr(ParseInfo pi, Val parent, Val kval, const char *str, size_t
             parent->odd_args = oj_odd_alloc_args(odd);
             break;
         }
-        case 'm': parent->val = ID2SYM(rb_intern3(str + 1, len - 1, oj_utf8_encoding)); break;
+        case 'm':
+            if (0 == len) {
+                return 0;
+            }
+            parent->val = ID2SYM(rb_intern3(str + 1, len - 1, oj_utf8_encoding));
+            break;
         case 's': parent->val = rb_utf8_str_new(str, len); break;
         case 'c':  // class
         {
@@ -395,7 +400,7 @@ void oj_set_obj_ivar(Val parent, Val kval, VALUE value) {
 
 static void hash_set_cstr(ParseInfo pi, Val kval, const char *str, size_t len, const char *orig) {
     const char    *key    = kval->key;
-    int            klen   = kval->klen;
+    size_t         klen   = kval->klen;
     Val            parent = stack_peek(&pi->stack);
     volatile VALUE rval   = Qnil;
 
@@ -437,7 +442,7 @@ WHICH_TYPE:
             if (0 != oj_odd_set_arg(parent->odd_args, kval->key, kval->klen, rval)) {
                 char buf[256];
 
-                if ((int)sizeof(buf) - 1 <= klen) {
+                if (sizeof(buf) - 1 <= klen) {
                     klen = sizeof(buf) - 2;
                 }
                 memcpy(buf, key, klen);
@@ -466,7 +471,7 @@ WHICH_TYPE:
 
 static void hash_set_num(ParseInfo pi, Val kval, NumInfo ni) {
     const char    *key    = kval->key;
-    int            klen   = kval->klen;
+    size_t         klen   = kval->klen;
     Val            parent = stack_peek(&pi->stack);
     volatile VALUE rval   = Qnil;
 
@@ -506,7 +511,7 @@ WHICH_TYPE:
             if (0 != oj_odd_set_arg(parent->odd_args, key, klen, rval)) {
                 char buf[256];
 
-                if ((int)sizeof(buf) - 1 <= klen) {
+                if (sizeof(buf) - 1 <= klen) {
                     klen = sizeof(buf) - 2;
                 }
                 memcpy(buf, key, klen);
@@ -535,7 +540,7 @@ WHICH_TYPE:
 
 static void hash_set_value(ParseInfo pi, Val kval, VALUE value) {
     const char *key    = kval->key;
-    int         klen   = kval->klen;
+    size_t      klen   = kval->klen;
     Val         parent = stack_peek(&pi->stack);
 
 WHICH_TYPE:
@@ -591,7 +596,7 @@ WHICH_TYPE:
         } else if (0 != oj_odd_set_arg(parent->odd_args, key, klen, value)) {
             char buf[256];
 
-            if ((int)sizeof(buf) - 1 <= klen) {
+            if (sizeof(buf) - 1 <= klen) {
                 klen = sizeof(buf) - 2;
             }
             memcpy(buf, key, klen);

data/ext/oj/odd.c

@@ -166,7 +166,11 @@ Odd oj_get_oddc(const char *classname, size_t len) {
         if (len == odd->clen && 0 == strncmp(classname, odd->classname, len)) {
             return odd;
         }
-        if (odd->is_module && 0 == strncmp(odd->classname, classname, odd->clen) && ':' == classname[odd->clen]) {
+        // The module test needs a "::" after the module name, so the name has
+        // to be shorter than what it is compared against. Without that the
+        // comparison and the character after it both run past len.
+        if (odd->is_module && odd->clen < len && 0 == strncmp(odd->classname, classname, odd->clen) &&
+            ':' == classname[odd->clen]) {
             return odd;
         }
     }
@@ -195,7 +199,7 @@ int oj_odd_set_arg(OddArgs args, const char *key, size_t klen, VALUE value) {
     int          i;
 
     for (i = args->odd->attr_cnt, np = args->odd->attr_names, vp = args->args; 0 < i; i--, np++, vp++) {
-        if (0 == strncmp(key, *np, klen) && '\0' == *((*np) + klen)) {
+        if (klen == strlen(*np) && 0 == memcmp(key, *np, klen)) {
             *vp = value;
             return 0;
         }