ox 2.14.28 → 2.14.29

data/ext/ox/dump.c

@@ -4,6 +4,7 @@
  */
 
 #include <errno.h>
+#include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -12,6 +13,9 @@
 #include "base64.h"
 #include "cache8.h"
 #include "ox.h"
+#include "time_conv.h"
+#include "xml_check.h"
+#include "xml_str.h"
 
 #define USE_B64 0
 #define MAX_DEPTH 1000
@@ -77,18 +81,25 @@ static int is_xml_friendly(const uchar *str, int len, const char *table);
 
 static const char hex_chars[17] = "0123456789abcdef";
 
-// The : character is equivalent to 10. Used for replacement characters up to 10
-// characters long such as '&#x10FFFF;'.
-static const char xml_friendly_chars[257] = "\
-:::::::::11::1::::::::::::::::::\
-11611156111111111111111111114141\
-11111111111111111111111111111111\
-11111111111111111111111111111111\
-11111111111111111111111111111111\
-11111111111111111111111111111111\
-11111111111111111111111111111111\
-11111111111111111111111111111111";
+#define APPEND_CHARS(buffer, chars, size) \
+    {                                     \
+        memcpy(buffer, chars, size);      \
+        buffer += size;                   \
+    }
+
+#ifdef HAVE_FAST_MEMCPY
+#define APPEND_CHARS_SMALL(buffer, chars, size) \
+    {                                           \
+        fast_memcpy16(buffer, chars, size);     \
+        buffer += size;                         \
+    }
+#else
+#define APPEND_CHARS_SMALL(buffer, chars, size) APPEND_CHARS(buffer, chars, size)
+#endif
 
+// Each table below maps a byte to the length of its escaped form, held as an ASCII digit so that
+// xml_str_len() can sum the entries directly. The : character is equivalent to 10, used for replacement
+// characters up to 10 characters long such as '&#x10FFFF;'.
 static const char xml_quote_chars[257] = "\
 :::::::::11::1::::::::::::::::::\
 11611151111111111111111111114141\
@@ -118,15 +129,6 @@ inline static int is_xml_friendly(const uchar *str, int len, const char *table)
     return 1;
 }
 
-inline static size_t xml_str_len(const uchar *str, size_t len, const char *table) {
-    size_t size = 0;
-
-    for (; 0 < len; str++, len--) {
-        size += xml_friendly_chars[*str];
-    }
-    return size - len * (size_t)'0';
-}
-
 inline static void dump_hex(uchar c, Out out) {
     uchar d = (c >> 4) & 0x0F;
 
@@ -150,9 +152,10 @@ static Type obj_class_code(VALUE obj) {
         return (is_xml_friendly((uchar *)StringValuePtr(obj), (int)RSTRING_LEN(obj), xml_element_chars)) ? StringCode
                                                                                                          : String64Code;
     case T_SYMBOL: {
-        const char *sym = rb_id2name(SYM2ID(obj));
+        volatile VALUE sym = rb_sym2str(obj);
 
-        return (is_xml_friendly((uchar *)sym, (int)strlen(sym), xml_element_chars)) ? SymbolCode : Symbol64Code;
+        return (is_xml_friendly((uchar *)RSTRING_PTR(sym), (int)RSTRING_LEN(sym), xml_element_chars)) ? SymbolCode
+                                                                                                      : Symbol64Code;
     }
     case T_DATA: return (rb_cTime == clas) ? TimeCode : ((ox_date_class == clas) ? DateCode : 0);
     case T_STRUCT: return (rb_cRange == clas) ? RangeCode : StructCode;
@@ -173,49 +176,74 @@ inline static void fill_indent(Out out, int cnt) {
             memcpy(out->cur, out->opts->margin, out->opts->margin_len);
             out->cur += out->opts->margin_len;
         }
-        for (; 0 < cnt; cnt--) {
-            *out->cur++ = ' ';
+        if (0 < cnt) {
+            memset(out->cur, ' ', cnt);
+            out->cur += cnt;
         }
     }
 }
 
 inline static void fill_value(Out out, const char *value, size_t len) {
-    if (6 < len) {
-        memcpy(out->cur, value, len);
-        out->cur += len;
+    if (16 < len) {
+        APPEND_CHARS(out->cur, value, len);
     } else {
-        for (; 0 < len; len--, value++) {
-            *out->cur++ = *value;
-        }
+        APPEND_CHARS_SMALL(out->cur, value, len);
     }
 }
 
 inline static void fill_attr(Out out, char name, const char *value, size_t len) {
     *out->cur++ = ' ';
     *out->cur++ = name;
-    *out->cur++ = '=';
-    *out->cur++ = '"';
-    if (6 < len) {
-        memcpy(out->cur, value, len);
-        out->cur += len;
+    APPEND_CHARS_SMALL(out->cur, "=\"", 2);
+    if (16 < len) {
+        APPEND_CHARS(out->cur, value, len);
     } else {
-        for (; 0 < len; len--, value++) {
-            *out->cur++ = *value;
-        }
+        APPEND_CHARS_SMALL(out->cur, value, len);
     }
     *out->cur++ = '"';
 }
 
-inline static const char *ulong2str(ulong num, char *end) {
-    char *b;
+static const char digits_table[] = "\
+00010203040506070809\
+10111213141516171819\
+20212223242526272829\
+30313233343536373839\
+40414243444546474849\
+50515253545556575859\
+60616263646566676869\
+70717273747576777879\
+80818283848586878889\
+90919293949596979899";
+
+static char *ox_longlong_to_string(long long num, bool negative, char *b) {
+    while (100 <= num) {
+        unsigned idx = (unsigned)(num % 100) * 2;
+
+        *b-- = digits_table[idx + 1];
+        *b-- = digits_table[idx];
+        num /= 100;
+    }
+    if (num < 10) {
+        *b-- = (char)(num + '0');
+    } else {
+        *b-- = digits_table[num * 2 + 1];
+        *b-- = digits_table[num * 2];
+    }
+    if (negative) {
+        *b = '-';
+    } else {
+        b++;
+    }
+    return b;
+}
 
+inline static const char *ulong2str(ulong num, char *end) {
     *end-- = '\0';
-    for (b = end; 0 < num || b == end; num /= 10, b--) {
-        *b = (num % 10) + '0';
+    if (0 == num) {
+        *end = '0';
+        return end;
     }
-    b++;
-
-    return b;
+    return ox_longlong_to_string((long long)num, false, end);
 }
 
 static int check_circular(Out out, VALUE obj, Element e) {
@@ -290,9 +318,7 @@ static void dump_start(Out out, Element e) {
     }
     if (e->closed) {
         if (out->opts->no_empty) {
-            *out->cur++ = '>';
-            *out->cur++ = '<';
-            *out->cur++ = '/';
+            APPEND_CHARS_SMALL(out->cur, "></", 3);
             *out->cur++ = e->type;
         } else {
             *out->cur++ = '/';
@@ -309,8 +335,7 @@ static void dump_end(Out out, Element e) {
         grow(out, size);
     }
     fill_indent(out, e->indent);
-    *out->cur++ = '<';
-    *out->cur++ = '/';
+    APPEND_CHARS_SMALL(out->cur, "</", 2);
     *out->cur++ = e->type;
     *out->cur++ = '>';
     *out->cur   = '\0';
@@ -320,13 +345,10 @@ inline static void dump_value(Out out, const char *value, size_t size) {
     if (out->end - out->cur <= (long)size) {
         grow(out, size);
     }
-    if (6 < size) {
-        memcpy(out->cur, value, size);
-        out->cur += size;
+    if (16 < size) {
+        APPEND_CHARS(out->cur, value, size);
     } else {
-        for (; 0 < size; size--, value++) {
-            *out->cur++ = *value;
-        }
+        APPEND_CHARS_SMALL(out->cur, value, size);
     }
     *out->cur = '\0';
 }
@@ -337,66 +359,88 @@ inline static void dump_str_value(Out out, const char *value, size_t size, const
     if (out->end - out->cur <= (long)xsize) {
         grow(out, xsize);
     }
-    for (; 0 < size; size--, value++) {
-        if ('1' == table[(uchar)*value]) {
-            *out->cur++ = *value;
+    if (xsize == size) {
+        if (16 < size) {
+            APPEND_CHARS(out->cur, value, size);
         } else {
-            switch (*value) {
-            case '"':
-                *out->cur++ = '&';
-                *out->cur++ = 'q';
-                *out->cur++ = 'u';
-                *out->cur++ = 'o';
-                *out->cur++ = 't';
-                *out->cur++ = ';';
-                break;
-            case '&':
-                *out->cur++ = '&';
-                *out->cur++ = 'a';
-                *out->cur++ = 'm';
-                *out->cur++ = 'p';
-                *out->cur++ = ';';
-                break;
-            case '\'':
-                *out->cur++ = '&';
-                *out->cur++ = 'a';
-                *out->cur++ = 'p';
-                *out->cur++ = 'o';
-                *out->cur++ = 's';
-                *out->cur++ = ';';
-                break;
-            case '<':
-                *out->cur++ = '&';
-                *out->cur++ = 'l';
-                *out->cur++ = 't';
-                *out->cur++ = ';';
+            APPEND_CHARS_SMALL(out->cur, value, size);
+        }
+        *out->cur = '\0';
+        return;
+    }
+    const char *end = value + size;
+
+    while (value < end) {
+        /* Copy runs of pass-through bytes a word at a time. A word with no byte
+         * of interest is stored whole; on a hit the store is kept up to the
+         * first flagged byte and the rest is redone by the loops below. xsize
+         * was reserved for the whole escaped result so out->cur stays inside the
+         * buffer, and out->cur + 8 <= out->end keeps the wide store in bounds on
+         * its own.
+         */
+        while (value + 8 <= end && out->cur + 8 <= out->end) {
+            uint64_t v;
+            uint64_t mask;
+
+            memcpy(&v, value, 8);
+            mask = xml_bytes_of_interest(v);
+            memcpy(out->cur, value, 8);
+            if (0 != mask) {
+                int n = xml_first_of_interest((const unsigned char *)value, mask);
+
+                value += n;
+                out->cur += n;
                 break;
-            case '>':
-                *out->cur++ = '&';
-                *out->cur++ = 'g';
-                *out->cur++ = 't';
-                *out->cur++ = ';';
+            }
+            value += 8;
+            out->cur += 8;
+        }
+        /* Pass-through bytes the word loop could not take: the tail shorter than
+         * a word, and the '"' or '\'' the element table keeps that the predicate
+         * flags anyway.
+         */
+        while (value < end) {
+            uchar c = (uchar)*value;
+
+            if (c < 0x20 || '"' == c || '\'' == c || '&' == c || '<' == c || '>' == c) {
                 break;
-            default:
-                // Must be one of the invalid characters.
-                if (StrictEffort == out->opts->effort) {
-                    rb_raise(ox_syntax_error_class, "'\\#x%02x' is not a valid XML character.", *value);
-                }
-                if (Yes == out->opts->allow_invalid) {
-                    *out->cur++ = '&';
-                    *out->cur++ = '#';
-                    *out->cur++ = 'x';
-                    *out->cur++ = '0';
-                    *out->cur++ = '0';
-                    dump_hex(*value, out);
-                    *out->cur++ = ';';
-                } else if ('\0' != *out->opts->inv_repl) {
-                    // If the empty string then ignore. The first character of
-                    // the replacement is the length.
-                    memcpy(out->cur, out->opts->inv_repl + 1, (size_t)*out->opts->inv_repl);
-                    out->cur += *out->opts->inv_repl;
+            }
+            *out->cur++ = *value++;
+        }
+        if (value < end) {
+            char c = *value++;
+
+            if ('1' == table[(uchar)c]) {
+                *out->cur++ = c;
+            } else {
+                switch (c) {
+                case '"': APPEND_CHARS_SMALL(out->cur, "&quot;", 6); break;
+                case '&': APPEND_CHARS_SMALL(out->cur, "&amp;", 5); break;
+                case '\'': APPEND_CHARS_SMALL(out->cur, "&apos;", 6); break;
+                case '<': APPEND_CHARS_SMALL(out->cur, "&lt;", 4); break;
+                case '>': APPEND_CHARS_SMALL(out->cur, "&gt;", 4); break;
+                default:
+                    // Must be one of the invalid characters.
+                    if (NotSet == out->opts->allow_invalid) {
+                        rb_raise(ox_syntax_error_class, "'\\#x%02x' is not a valid XML character.", c);
+                    }
+                    if (Yes == out->opts->allow_invalid) {
+                        // A character reference has to resolve to a Char, which #x0 is not.
+                        // Reading &#x0000; back ends the text at the NUL and drops the rest
+                        // without an error, so the byte is left out instead.
+                        if ('\0' != c) {
+                            APPEND_CHARS_SMALL(out->cur, "&#x00", 5);
+                            dump_hex(c, out);
+                            *out->cur++ = ';';
+                        }
+                    } else if ('\0' != *out->opts->inv_repl) {
+                        // If the empty string then ignore. The first character of
+                        // the replacement is the length.
+                        memcpy(out->cur, out->opts->inv_repl + 1, (size_t)*out->opts->inv_repl);
+                        out->cur += *out->opts->inv_repl;
+                    }
+                    break;
                 }
-                break;
             }
         }
     }
@@ -407,30 +451,27 @@ inline static void dump_num(Out out, VALUE obj) {
     char  buf[32];
     char *b   = buf + sizeof(buf) - 1;
     long  num = NUM2LONG(obj);
-    int   neg = 0;
+    bool  neg = false;
+    long  size;
 
     if (0 > num) {
-        neg = 1;
+        neg = true;
         num = -num;
     }
     *b-- = '\0';
     if (0 < num) {
-        for (; 0 < num; num /= 10, b--) {
-            *b = (num % 10) + '0';
-        }
-        if (neg) {
-            *b = '-';
-        } else {
-            b++;
-        }
+        b = ox_longlong_to_string(num, neg, b);
     } else {
         *b = '0';
     }
-    if (out->end - out->cur <= (long)(sizeof(buf) - (b - buf))) {
-        grow(out, sizeof(buf) - (b - buf));
+    size = sizeof(buf) - (b - buf) - 1;
+    if (out->end - out->cur <= size) {
+        grow(out, size);
     }
-    for (; '\0' != *b; b++) {
-        *out->cur++ = *b;
+    if (16 < size) {
+        APPEND_CHARS(out->cur, b, size);
+    } else {
+        APPEND_CHARS_SMALL(out->cur, b, size);
     }
     *out->cur = '\0';
 }
@@ -443,22 +484,48 @@ static void dump_time_thin(Out out, VALUE obj) {
     long            nsec = ts.tv_nsec;
     char           *dot  = b - 10;
     long            size;
+    bool            neg = 0 > sec;
 
+    // tv_nsec is never negative, so a time before the epoch is a negative
+    // second count carrying a positive fraction. Writing those two out as they
+    // are would read as -1.5 for what is really -0.5, so move the fraction over
+    // and write the magnitude with a sign in front of it.
+    if (neg && 0 < nsec) {
+        sec++;
+        nsec = 1000000000L - nsec;
+    }
     *b-- = '\0';
     for (; dot < b; b--, nsec /= 10) {
         *b = '0' + (nsec % 10);
     }
     *b-- = '.';
-    for (; 0 < sec; b--, sec /= 10) {
-        *b = '0' + (sec % 10);
+    if (0 == sec) {
+        *b-- = '0';
+    } else if (neg) {
+        // sec is left negative instead of negated so that the most negative
+        // time_t does not overflow. C truncates the quotient toward zero, so
+        // the remainder carries the sign with it.
+        for (; 0 != sec; b--, sec /= 10) {
+            *b = (char)('0' - sec % 10);
+        }
+    } else {
+        for (; 0 < sec; b--, sec /= 10) {
+            *b = '0' + (sec % 10);
+        }
+    }
+    if (neg) {
+        *b-- = '-';
     }
     b++;
     size = sizeof(buf) - (b - buf) - 1;
     if (out->end - out->cur <= size) {
         grow(out, size);
     }
-    memcpy(out->cur, b, size);
-    out->cur += size;
+    if (16 < size) {
+        APPEND_CHARS(out->cur, b, size);
+    } else {
+        APPEND_CHARS_SMALL(out->cur, b, size);
+    }
 }
 
 static void dump_date(Out out, VALUE obj) {
@@ -468,61 +535,76 @@ static void dump_date(Out out, VALUE obj) {
     long  size;
 
     *b-- = '\0';
-    for (; 0 < jd; b--, jd /= 10) {
-        *b = '0' + (jd % 10);
-    }
-    b++;
-    if ('\0' == *b) {
-        b--;
+    if (0 < jd) {
+        b = ox_longlong_to_string((long long)jd, false, b);
+    } else {
         *b = '0';
     }
     size = sizeof(buf) - (b - buf) - 1;
     if (out->end - out->cur <= size) {
         grow(out, size);
     }
-    memcpy(out->cur, b, size);
-    out->cur += size;
+    if (16 < size) {
+        APPEND_CHARS(out->cur, b, size);
+    } else {
+        APPEND_CHARS_SMALL(out->cur, b, size);
+    }
 }
 
 static void dump_time_xsd(Out out, VALUE obj) {
-    struct tm      *tm;
-    struct timespec ts   = rb_time_timespec(obj);
-    time_t          sec  = ts.tv_sec;
-    long            nsec = ts.tv_nsec;
+    struct timespec ts     = rb_time_timespec(obj);
+    time_t          sec    = ts.tv_sec;
+    long            nsec   = ts.tv_nsec;
+    long            offset = NUM2LONG(rb_funcall2(obj, ox_utc_offset_id, 0, 0));
     int             tzhour, tzmin;
     char            tzsign = '+';
+    long long       year;
+    int             mon, day, hour, min, tsec;
+    char            buf[64];
+    int             cnt;
 
-    if (out->end - out->cur <= 33) {
-        grow(out, 33);
-    }
     /* 2010-07-09T10:47:45.895826+09:00 */
-    tm = localtime(&sec);
-#if HAVE_ST_TM_GMTOFF
-    if (0 > tm->tm_gmtoff) {
+    // The offset comes from the Time rather than from localtime(), which has no
+    // tm_gmtoff in the Microsoft CRT and so wrote +00:00 next to a local wall
+    // clock there. Adding it before splitting gives that wall clock without a
+    // timezone database, so there is no platform branch and no NULL to check.
+    // xsd writes the offset as hh:mm, so one that is not a whole number of
+    // minutes -- Dublin was -00:25:21 until 1916 -- can not be written without
+    // moving the instant. UTC says the same thing and says it exactly.
+    if (0 != offset % 60) {
+        offset = 0;
+    }
+    if (0 > offset) {
         tzsign = '-';
-        tzhour = (int)(tm->tm_gmtoff / -3600);
-        tzmin  = (int)(tm->tm_gmtoff / -60) - (tzhour * 60);
+        tzhour = (int)(offset / -3600);
+        tzmin  = (int)(offset / -60) - (tzhour * 60);
     } else {
-        tzhour = (int)(tm->tm_gmtoff / 3600);
-        tzmin  = (int)(tm->tm_gmtoff / 60) - (tzhour * 60);
+        tzhour = (int)(offset / 3600);
+        tzmin  = (int)(offset / 60) - (tzhour * 60);
     }
-#else
-    tzhour = 0;
-    tzmin  = 0;
-#endif
+    ox_civil_from_epoch((int64_t)sec + offset, &year, &mon, &day, &hour, &min, &tsec);
     /* TBD replace with more efficient printer */
-    out->cur += sprintf(out->cur,
-                        "%04d-%02d-%02dT%02d:%02d:%02d.%06ld%c%02d:%02d",
-                        tm->tm_year + 1900,
-                        tm->tm_mon + 1,
-                        tm->tm_mday,
-                        tm->tm_hour,
-                        tm->tm_min,
-                        tm->tm_sec,
-                        nsec / 1000,
-                        tzsign,
-                        tzhour,
-                        tzmin);
+    // A year outside four digits is longer than the sample above, so reserve
+    // what was actually formatted instead of a fixed 33. buf can not overflow:
+    // the largest time_t puts the year at 12 digits, and the rest of the format
+    // is a fixed 28 characters.
+    cnt = snprintf(buf,
+                   sizeof(buf),
+                   "%04lld-%02d-%02dT%02d:%02d:%02d.%06ld%c%02d:%02d",
+                   year,
+                   mon,
+                   day,
+                   hour,
+                   min,
+                   tsec,
+                   nsec / 1000,
+                   tzsign,
+                   tzhour,
+                   tzmin);
+    if (out->end - out->cur <= cnt) {
+        grow(out, cnt);
+    }
+    APPEND_CHARS(out->cur, buf, cnt);
 }
 
 static void dump_first_obj(VALUE obj, Out out) {
@@ -711,9 +793,10 @@ static void dump_obj(ID aid, VALUE obj, int depth, Out out) {
         break;
     }
     case T_SYMBOL: {
-        const char *sym = rb_id2name(SYM2ID(obj));
+        volatile VALUE rsym = rb_sym2str(obj);
+        const char    *sym  = RSTRING_PTR(rsym);
 
-        cnt = (int)strlen(sym);
+        cnt = (int)RSTRING_LEN(rsym);
 #if USE_B64
         if (is_xml_friendly((uchar *)sym, cnt)) {
             e.type = SymbolCode;
@@ -789,18 +872,19 @@ static void dump_obj(ID aid, VALUE obj, int depth, Out out) {
         }
         clas = rb_obj_class(obj);
         if (rb_cRange == clas) {
-            VALUE beg  = RSTRUCT_GET(obj, 0);
-            VALUE end  = RSTRUCT_GET(obj, 1);
-            VALUE excl = RSTRUCT_GET(obj, 2);
-            int   d2   = depth + 1;
+            VALUE beg;
+            VALUE end;
+            int   excl;
+            int   d2 = depth + 1;
 
+            rb_range_values(obj, &beg, &end, &excl);
             e.type     = RangeCode;
             e.clas.len = 5;
             e.clas.str = "Range";
             out->w_start(out, &e);
             dump_obj(ox_beg_id, beg, d2, out);
             dump_obj(ox_end_id, end, d2, out);
-            dump_obj(ox_excl_id, excl, d2, out);
+            dump_obj(ox_excl_id, excl ? Qtrue : Qfalse, d2, out);
             out->w_end(out, &e);
         } else {
             char num_buf[16];
@@ -1009,6 +1093,7 @@ static void dump_gen_element(VALUE obj, int depth, Out out) {
     size_t         size;
     int            indent;
 
+    check_name_chars(name, (size_t)nlen, false);
     if (0 > out->indent) {
         indent = -1;
     } else if (0 == out->indent) {
@@ -1017,6 +1102,11 @@ static void dump_gen_element(VALUE obj, int depth, Out out) {
         indent = depth * out->indent;
     }
     size = indent + 4 + nlen + out->opts->margin_len;
+    if (0 == depth && 0 < out->indent) {
+        // The margin is written here and again by fill_indent(), so reserve it
+        // twice.
+        size += out->opts->margin_len;
+    }
     if (out->end - out->cur <= (long)size) {
         grow(out, size);
     }
@@ -1030,24 +1120,36 @@ static void dump_gen_element(VALUE obj, int depth, Out out) {
     if (Qnil != attrs) {
         rb_hash_foreach(attrs, dump_gen_attr, (VALUE)out);
     }
+    // The attribute loop runs Ruby, so both the reservation above and the name
+    // pointer are spent: dump_gen_attr() calls rb_String() on each value, and
+    // growing the name String there frees the buffer name points at. The type
+    // check is not repeated: StringValuePtr() above left rname a String and a
+    // VALUE does not change type, only where its bytes live.
+    name = RSTRING_PTR(rname);
+    nlen = RSTRING_LEN(rname);
+    size = indent + 5 + nlen + out->opts->margin_len;
+    if (out->end - out->cur <= (long)size) {
+        grow(out, size);
+    }
     if (Qnil != nodes && 0 < RARRAY_LEN(nodes)) {
         int do_indent;
 
         *out->cur++ = '>';
         do_indent   = dump_gen_nodes(nodes, depth, out);
+        // The children run Ruby as well.
+        name = RSTRING_PTR(rname);
+        nlen = RSTRING_LEN(rname);
+        size = indent + 5 + nlen + out->opts->margin_len;
         if (out->end - out->cur <= (long)size) {
             grow(out, size);
         }
         if (do_indent) {
             fill_indent(out, indent);
         }
-        *out->cur++ = '<';
-        *out->cur++ = '/';
+        APPEND_CHARS_SMALL(out->cur, "</", 2);
         fill_value(out, name, nlen);
     } else if (out->opts->no_empty) {
-        *out->cur++ = '>';
-        *out->cur++ = '<';
-        *out->cur++ = '/';
+        APPEND_CHARS_SMALL(out->cur, "></", 3);
         fill_value(out, name, nlen);
     } else {
         *out->cur++ = '/';
@@ -1066,18 +1168,19 @@ static void dump_gen_instruct(VALUE obj, int depth, Out out) {
     long           clen     = 0;
     size_t         size;
 
+    check_unescaped(name, (size_t)nlen);
     if (T_STRING == rb_type(rcontent)) {
         content = StringValuePtr(rcontent);
         clen    = RSTRING_LEN(rcontent);
-        size    = 4 + nlen + clen;
+        check_unescaped(content, (size_t)clen);
+        size = 4 + nlen + clen;
     } else {
         size = 4 + nlen;
     }
     if (out->end - out->cur <= (long)size) {
         grow(out, size);
     }
-    *out->cur++ = '<';
-    *out->cur++ = '?';
+    APPEND_CHARS_SMALL(out->cur, "<?", 2);
     fill_value(out, name, nlen);
     if (0 != content) {
         if (' ' != *content) {
@@ -1087,9 +1190,8 @@ static void dump_gen_instruct(VALUE obj, int depth, Out out) {
     } else if (Qnil != attrs) {
         rb_hash_foreach(attrs, dump_gen_attr, (VALUE)out);
     }
-    *out->cur++ = '?';
-    *out->cur++ = '>';
-    *out->cur   = '\0';
+    APPEND_CHARS_SMALL(out->cur, "?>", 2);
+    *out->cur = '\0';
 }
 
 static int dump_gen_nodes(VALUE obj, int depth, Out out) {
@@ -1131,31 +1233,34 @@ static int dump_gen_nodes(VALUE obj, int depth, Out out) {
 }
 
 static int dump_gen_attr(VALUE key, VALUE value, VALUE ov) {
-    Out out = (Out)ov;
-
-    const char *ks;
-    size_t      klen;
-    size_t      size;
+    Out            out = (Out)ov;
+    volatile VALUE kv  = key;
+    const char    *ks;
+    size_t         klen;
+    size_t         size;
 
     switch (rb_type(key)) {
-    case T_SYMBOL: ks = rb_id2name(SYM2ID(key)); break;
-    case T_STRING: ks = StringValuePtr(key); break;
-    default:
-        key = rb_String(key);
-        ks  = StringValuePtr(key);
-        break;
-    }
-    klen  = strlen(ks);
-    value = rb_String(value);
-    size  = 4 + klen + RSTRING_LEN(value);
+    case T_SYMBOL: kv = rb_sym2str(key); break;
+    case T_STRING: break;
+    default: kv = rb_String(key); break;
+    }
+    // Every arm above leaves kv a String, so no second type check is needed.
+    ks   = RSTRING_PTR(kv);
+    klen = (size_t)RSTRING_LEN(kv);
+    // Before the space, so a rescued raise leaves the element as it was. The
+    // NUL this used to check for on its own is the low end of the same set.
+    check_name_chars(ks, klen, true);
+    if (!RB_TYPE_P(value, T_STRING)) {
+        value = rb_String(value);
+    }
+    size = 4 + klen + RSTRING_LEN(value);
     if (out->end - out->cur <= (long)size) {
         grow(out, size);
     }
     *out->cur++ = ' ';
     fill_value(out, ks, klen);
-    *out->cur++ = '=';
-    *out->cur++ = '"';
-    dump_str_value(out, StringValuePtr(value), RSTRING_LEN(value), xml_quote_chars);
+    APPEND_CHARS_SMALL(out->cur, "=\"", 2);
+    dump_str_value(out, RSTRING_PTR(value), RSTRING_LEN(value), xml_quote_chars);
     *out->cur++ = '"';
 
     return ST_CONTINUE;
@@ -1165,8 +1270,12 @@ static void
 dump_gen_val_node(VALUE obj, int depth, const char *pre, size_t plen, const char *suf, size_t slen, Out out) {
     volatile VALUE v = rb_attr_get(obj, ox_at_value_id);
     const char    *val;
+    const char    *end;
+    const char    *from;
+    const char    *split;
     size_t         vlen;
     size_t         size;
+    size_t         cdata_cnt = 0;
     int            indent;
 
     if (T_STRING != rb_type(v)) {
@@ -1174,6 +1283,13 @@ dump_gen_val_node(VALUE obj, int depth, const char *pre, size_t plen, const char
     }
     val  = StringValuePtr(v);
     vlen = RSTRING_LEN(v);
+    from = val;
+    end  = val + vlen;
+    // Ox::Raw is documented as going out untouched, so it is the one value node
+    // that is not checked. The rest are markup ox wrote the delimiters for.
+    if (ox_raw_clas != rb_obj_class(obj)) {
+        check_unescaped(val, vlen);
+    }
     if (0 > out->indent) {
         indent = -1;
     } else if (0 == out->indent) {
@@ -1182,33 +1298,36 @@ dump_gen_val_node(VALUE obj, int depth, const char *pre, size_t plen, const char
         indent = depth * out->indent;
     }
     size = indent + plen + slen + vlen + out->opts->margin_len;
+    // Only a CDATA section can be closed by its own value; see xml_cdata_end().
+    if (9 == plen && 0 == strncmp("<![CDATA[", pre, 9)) {
+        cdata_cnt = xml_cdata_end_cnt(val, end);
+        size += cdata_cnt * CDATA_SPLIT_EXTRA;
+    }
     if (out->end - out->cur <= (long)size) {
         grow(out, size);
     }
     fill_indent(out, indent);
     fill_value(out, pre, plen);
-    fill_value(out, val, vlen);
+    // The ']]' stays in this section and the '>' opens the next one, so from
+    // lands on the '>' each time round.
+    while (0 < cdata_cnt && NULL != (split = xml_cdata_end(from, end))) {
+        fill_value(out, from, (size_t)((split + 2) - from));
+        fill_value(out, "]]><![CDATA[", CDATA_SPLIT_EXTRA);
+        from = split + 2;
+    }
+    fill_value(out, from, (size_t)(end - from));
     fill_value(out, suf, slen);
     *out->cur = '\0';
 }
 
-static void dump_obj_to_xml(VALUE obj, Options copts, Out out) {
+// The dump traversal, run under rb_protect so the output buffer is freed even
+// when it raises (invalid character, oversized indent, deep-recursion circular
+// reference, ...). out->obj and out->opts carry everything it needs.
+static VALUE dump_obj_to_xml_body(VALUE outv) {
+    Out   out  = (Out)outv;
+    VALUE obj  = out->obj;
     VALUE clas = rb_obj_class(obj);
 
-    out->w_time     = (Yes == copts->xsd_date) ? dump_time_xsd : dump_time_thin;
-    out->buf        = ALLOC_N(char, 65336);
-    out->end        = out->buf + 65325; /* 10 less than end plus extra for possible errors */
-    out->cur        = out->buf;
-    out->circ_cache = 0;
-    out->circ_cnt   = 0;
-    out->opts       = copts;
-    out->obj        = obj;
-    *out->cur       = '\0';
-    if (Yes == copts->circular) {
-        ox_cache8_new(&out->circ_cache);
-    }
-    out->indent = copts->indent;
-
     if (ox_document_clas == clas) {
         dump_gen_doc(obj, -1, out);
     } else if (ox_element_clas == clas) {
@@ -1229,9 +1348,39 @@ static void dump_obj_to_xml(VALUE obj, Options copts, Out out) {
     if (0 <= out->indent) {
         dump_value(out, "\n", 1);
     }
+    return Qnil;
+}
+
+static void dump_obj_to_xml(VALUE obj, Options copts, Out out) {
+    int state = 0;
+
+    out->w_time     = (Yes == copts->xsd_date) ? dump_time_xsd : dump_time_thin;
+    out->buf        = ALLOC_N(char, 65336);
+    out->end        = out->buf + 65325; /* 10 less than end plus extra for possible errors */
+    out->cur        = out->buf;
+    out->circ_cache = 0;
+    out->circ_cnt   = 0;
+    out->opts       = copts;
+    out->obj        = obj;
+    *out->cur       = '\0';
+    if (Yes == copts->circular) {
+        ox_cache8_new(&out->circ_cache);
+    }
+    out->indent = copts->indent;
+
+    // Run the traversal under rb_protect. On the normal path out->buf is handed
+    // back to the caller; on a raise the longjmp would otherwise skip the free,
+    // so release the buffer (and the circular cache) here before re-raising.
+    rb_protect(dump_obj_to_xml_body, (VALUE)out, &state);
+
     if (Yes == copts->circular) {
         ox_cache8_delete(out->circ_cache);
     }
+    if (0 != state) {
+        xfree(out->buf);
+        out->buf = NULL;
+        rb_jump_tag(state);
+    }
 }
 
 char *ox_write_obj_to_str(VALUE obj, Options copts) {
@@ -1248,11 +1397,15 @@ void ox_write_obj_to_file(VALUE obj, const char *path, Options copts) {
 
     dump_obj_to_xml(obj, copts, &out);
     size = out.cur - out.buf;
-    if (0 == (f = fopen(path, "w"))) {
+    if (0 == (f = fopen(path, "wb"))) {
+        xfree(out.buf);
         rb_raise(rb_eIOError, "%s\n", strerror(errno));
     }
     if (size != fwrite(out.buf, 1, size, f)) {
         int err = ferror(f);
+
+        fclose(f);
+        xfree(out.buf);
         rb_raise(rb_eIOError, "Write failed. [%d:%s]\n", err, strerror(err));
     }
     xfree(out.buf);