ox 2.14.23 → 2.14.25

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e074f178c4058fb2730b3472d9ba87a2f2b6491de903f139f1d5ec4f4fc68145
-  data.tar.gz: a3ebe7df1b9b582b9d930530af72c4907caad822a3f67f52e55d0ef9647e3685
+  metadata.gz: 1fdd6c47d31f46414501f3719dc4b3b0c938517cbd0a03f982110657b3b7261b
+  data.tar.gz: 9d65bf85bc88e0421049230251ed87a2dfa078c0e2be5ab61b5da63f148d52e4
 SHA512:
-  metadata.gz: faafbda1d85eb0a6ce1ed406fcdd666ba0c4325356080a992f35f1f7979911365e5845e963934aea970af2cfe8765c4d37c044b624a3a3dbfe06245d17d1f333
-  data.tar.gz: 8a712e6a78fbd9c60f0a209c2bc9b52c00f2f2ef31b066685bb9115b5d81a6ef296e5b8aa44b4060a0a9f5c8e95fd5a54eab7ca8daae09d3b7746a243b098237
+  metadata.gz: a82cba42c5957d123ea2022f8cce3f65923c31f96b1ff67c176a75f538fef35e3d58585ba232fc972a7a41e94386a72cdec9fd16f341cbd080ea1d1c1de04fc1
+  data.tar.gz: 255570365253191fbe23824dbdc9262162dcea2fd5b297bc182ea2fd4eff25ecc4bc8484cadf56c3c4c5cee4fac2d0589140ee2d2d5e7f395f6e2edaf487cfe3

data/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All changes to the Ox gem are documented here. Releases follow semantic versioning.
 
+## [2.14.25] - 2026-04-23
+
+### Added
+
+- Contribution by @albanpeignier
+
+### Fixed
+
+- Parser buffer overflow fix by @albanpeignier
+
+## [2.14.24] - 2026-04-20
+
+### Fixed
+
+- Bundler load issue #389
+
 ## [2.14.23] - 2025-05-27
 
 ### Changed

data/ext/ox/extconf.rb

@@ -32,6 +32,16 @@ CONFIG['warnflags'].slice!(/ -Wsuggest-attribute=format/)
 CONFIG['warnflags'].slice!(/ -Wdeclaration-after-statement/)
 CONFIG['warnflags'].slice!(/ -Wmissing-noreturn/)
 
+if ENV['OX_ASAN'] || ENV['OX_DEBUG']
+  CONFIG["optflags"] = "-O0"
+  CONFIG["debugflags"] = "-ggdb3"
+end
+
+if ENV['OX_ASAN']
+  $LDFLAGS << " -fsanitize=address"
+  $CFLAGS << " -fsanitize=address"
+end
+
 have_func('rb_ext_ractor_safe', 'ruby.h')
 have_func('pthread_mutex_init')
 have_func('rb_enc_interned_str')
@@ -42,6 +52,6 @@ have_header('sys/uio.h')
 
 have_struct_member('struct tm', 'tm_gmtoff')
 
-create_makefile(extension_name)
+create_makefile("ox/#{extension_name}")
 
 `make clean`

data/ext/ox/foo.h

@@ -0,0 +1,204 @@
+/* sax_buf.h
+ * Copyright (c) 2011, Peter Ohler
+ * All rights reserved.
+ */
+
+#ifndef OX_SAX_BUF_H
+#define OX_SAX_BUF_H
+
+#include <stdio.h>
+
+typedef struct _buf {
+    char  base[0x00001000];
+    char *head;
+    char *end;
+    char *tail;
+    char *read_end; /* one past last character read */
+    char *pro;      /* protection start, buffer can not slide past this point */
+    char *str;      /* start of current string being read */
+    off_t pos;
+    off_t line;
+    off_t col;
+    off_t pro_pos;
+    off_t pro_line;
+    off_t pro_col;
+    int (*read_func)(struct _buf *buf);
+    union {
+        int         fd;
+        VALUE       io;
+        const char *str;
+    } in;
+    struct _saxDrive *dr;
+} *Buf;
+
+typedef struct _checkPt {
+    off_t pro_dif;
+    off_t pos;
+    off_t line;
+    off_t col;
+    char  c;
+} *CheckPt;
+
+#define CHECK_PT_INIT {-1, 0, 0, 0, '\0'}
+
+extern void ox_sax_buf_init(Buf buf, VALUE io);
+extern int  ox_sax_buf_read(Buf buf);
+
+static inline char buf_get(Buf buf) {
+    // printf("*** drive get from '%s'  from start: %ld  buf: %p  from read_end: %ld\n", buf->tail, buf->tail -
+    // buf->head, buf->head, buf->read_end - buf->tail);
+    if (buf->read_end <= buf->tail) {
+        if (0 != ox_sax_buf_read(buf)) {
+            return '\0';
+        }
+    }
+    if ('\n' == *buf->tail) {
+        buf->line++;
+        buf->col = 0;
+    } else {
+        buf->col++;
+    }
+    buf->pos++;
+
+    return *buf->tail++;
+}
+
+static inline void buf_backup(Buf buf) {
+    buf->tail--;
+    buf->col--;
+    buf->pos--;
+    if (0 >= buf->col) {
+        buf->line--;
+        // allow col to be negative since we never backup twice in a row
+    }
+}
+
+static inline void buf_protect(Buf buf) {
+    buf->pro      = buf->tail;
+    buf->str      = buf->tail;  // can't have str before pro
+    buf->pro_pos  = buf->pos;
+    buf->pro_line = buf->line;
+    buf->pro_col  = buf->col;
+}
+
+static inline void buf_reset(Buf buf) {
+    buf->tail = buf->pro;
+    buf->pos  = buf->pro_pos;
+    buf->line = buf->pro_line;
+    buf->col  = buf->pro_col;
+}
+
+/* Starts by reading a character so it is safe to use with an empty or
+ * compacted buffer.
+ */
+static inline char buf_next_non_white(Buf buf) {
+    char c;
+
+    while ('\0' != (c = buf_get(buf))) {
+        switch (c) {
+        case ' ':
+        case '\t':
+        case '\f':
+        case '\n':
+        case '\r': break;
+        default: return c;
+        }
+    }
+    return '\0';
+}
+
+/* Starts by reading a character so it is safe to use with an empty or
+ * compacted buffer.
+ */
+static inline char buf_next_white(Buf buf) {
+    char c;
+
+    while ('\0' != (c = buf_get(buf))) {
+        switch (c) {
+        case ' ':
+        case '\t':
+        case '\f':
+        case '\n':
+        case '\r':
+        case '\0': return c;
+        default: break;
+        }
+    }
+    return '\0';
+}
+
+static inline void buf_cleanup(Buf buf) {
+    if (buf->base != buf->head && 0 != buf->head) {
+        xfree(buf->head);
+        buf->head = 0;
+    }
+}
+
+static inline int is_white(char c) {
+    switch (c) {
+    case ' ':
+    case '\t':
+    case '\f':
+    case '\n':
+    case '\r': return 1;
+    default: break;
+    }
+    return 0;
+}
+
+static inline void buf_checkpoint(Buf buf, CheckPt cp) {
+    cp->pro_dif = (int)(buf->tail - buf->pro);
+    cp->pos     = buf->pos;
+    cp->line    = buf->line;
+    cp->col     = buf->col;
+    cp->c       = *(buf->tail - 1);
+}
+
+static inline int buf_checkset(CheckPt cp) {
+    return (0 <= cp->pro_dif);
+}
+
+static inline char buf_checkback(Buf buf, CheckPt cp) {
+    buf->tail = buf->pro + cp->pro_dif;
+    buf->pos  = cp->pos;
+    buf->line = cp->line;
+    buf->col  = cp->col;
+    return cp->c;
+}
+
+static inline void buf_collapse_return(char *str) {
+    char *s    = str;
+    char *back = str;
+
+    for (; '\0' != *s; s++) {
+        if (back != str && '\n' == *s && '\r' == *(back - 1)) {
+            *(back - 1) = '\n';
+        } else {
+            *back++ = *s;
+        }
+    }
+    *back = '\0';
+}
+
+static inline void buf_collapse_white(char *str) {
+    char *s    = str;
+    char *back = str;
+
+    for (; '\0' != *s; s++) {
+        switch (*s) {
+        case ' ':
+        case '\t':
+        case '\f':
+        case '\n':
+        case '\r':
+            if (back == str || ' ' != *(back - 1)) {
+                *back++ = ' ';
+            }
+            break;
+        default: *back++ = *s; break;
+        }
+    }
+    *back = '\0';
+}
+
+#endif /* OX_SAX_BUF_H */

data/ext/ox/parse.c

@@ -1171,7 +1171,7 @@ static int collapse_special(PInfo pi, char *str) {
                             return EDOM;
                         }
                         if (kend <= k) {
-                            k = key;
+                            k = key + 1;  // because k-- follows
                             break;
                         }
                         *k++ = *s;

data/lib/ox/version.rb

@@ -1,4 +1,4 @@
 module Ox
   # Current version of the module.
-  VERSION = '2.14.23'
+  VERSION = '2.14.25'
 end

data/lib/ox.rb

@@ -76,8 +76,4 @@ require 'ox/bag'
 require 'ox/sax'
 
 # C extension
-begin
-  require_relative "ox.#{RbConfig::CONFIG['DLEXT']}"
-rescue LoadError
-  require 'ox/ox'
-end
+require 'ox/ox'

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ox
 version: !ruby/object:Gem::Version
-  version: 2.14.23
+  version: 2.14.25
 platform: ruby
 authors:
 - Peter Ohler
 bindir: bin
 cert_chain: []
-date: 2025-05-28 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bigdecimal
@@ -32,8 +32,8 @@ executables: []
 extensions:
 - ext/ox/extconf.rb
 extra_rdoc_files:
-- README.md
 - CHANGELOG.md
+- README.md
 files:
 - CHANGELOG.md
 - LICENSE
@@ -51,6 +51,7 @@ files:
 - ext/ox/err.c
 - ext/ox/err.h
 - ext/ox/extconf.rb
+- ext/ox/foo.h
 - ext/ox/gen_load.c
 - ext/ox/hash_load.c
 - ext/ox/helper.h
@@ -122,7 +123,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 4.0.3
 specification_version: 4
 summary: A fast XML parser and object serializer.
 test_files: []