ox 2.14.28 → 2.14.29

data/ext/ox/sax_as.c

@@ -4,6 +4,7 @@
  */
 
 #include <errno.h>
+#include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <strings.h>
@@ -18,19 +19,26 @@
 #include "ruby.h"
 #include "ruby/version.h"
 #include "sax.h"
+#include "time_conv.h"
 
 static VALUE parse_double_time(const char *text) {
-    long        v   = 0;
+    time_t      v   = 0;
     long        v2  = 0;
     const char *dot = 0;
     char        c;
+    bool        neg = false;
 
+    // A time before the epoch is written as a sign followed by the magnitude.
+    if ('-' == *text) {
+        neg = true;
+        text++;
+    }
     for (; '.' != *text; text++) {
         c = *text;
         if (c < '0' || '9' < c) {
             return Qnil;
         }
-        v = 10 * v + (long)(c - '0');
+        v = 10 * v + (time_t)(c - '0');
     }
     dot = text++;
     for (; '\0' != *text && text - dot <= 6; text++) {
@@ -43,6 +51,17 @@ static VALUE parse_double_time(const char *text) {
     for (; text - dot <= 9; text++) {
         v2 *= 10;
     }
+    if (neg) {
+        // rb_time_nano_new() wants a non negative nanosecond count, so the
+        // fraction goes back into the second count the way dump_time_thin()
+        // took it out.
+        if (0 == v2) {
+            v = -v;
+        } else {
+            v  = -v - 1;
+            v2 = 1000000000L - v2;
+        }
+    }
     return rb_time_nano_new(v, v2);
 }
 
@@ -69,7 +88,9 @@ static VALUE parse_xsd_time(const char *text) {
                           {2, '\0', '\0'},
                           {0, '\0', '\0'}};
     Tp         tp      = tpa;
-    struct tm  tm;
+    long       nsec    = 0;
+    long       offset;
+    bool       neg = false;
 
     memset(cargs, 0, sizeof(cargs));
     for (; 0 != tp->cnt; tp++) {
@@ -83,6 +104,15 @@ static VALUE parse_xsd_time(const char *text) {
             }
             v = 10 * v + (long)(c - '0');
         }
+        // The fraction is the only field terminated by the offset sign, and the
+        // sign is the only place the offset's direction is written down.
+        if ('+' == tp->end) {
+            nsec = v;
+            for (; 0 < i; i--) {
+                nsec *= 10;
+            }
+            neg = ('-' == *text);
+        }
         if ('\0' == c) {
             break;
         }
@@ -92,13 +122,15 @@ static VALUE parse_xsd_time(const char *text) {
         }
         *cp++ = v;
     }
-    tm.tm_year = (int)cargs[0] - 1900;
-    tm.tm_mon  = (int)cargs[1] - 1;
-    tm.tm_mday = (int)cargs[2];
-    tm.tm_hour = (int)cargs[3];
-    tm.tm_min  = (int)cargs[4];
-    tm.tm_sec  = (int)cargs[5];
-    return rb_time_nano_new(mktime(&tm), cargs[6]);
+    offset = cargs[7] * 3600 + cargs[8] * 60;
+    if (neg) {
+        offset = -offset;
+    }
+    // mktime() would read the wall clock as local time and throw the offset
+    // away, and returns -1 for everything before the epoch on Windows.
+    return rb_time_nano_new(
+        (time_t)(ox_epoch_from_civil(cargs[0], cargs[1], cargs[2], cargs[3], cargs[4], cargs[5]) - offset),
+        nsec);
 }
 
 /* call-seq: as_s()

data/ext/ox/sax_buf.c

@@ -133,14 +133,22 @@ static VALUE partial_io_cb(VALUE rbuf) {
     VALUE  args[1];
     VALUE  rstr;
     char  *str;
+    size_t max = (size_t)(buf->end - buf->tail);
     size_t cnt;
 
-    args[0] = ULONG2NUM(buf->end - buf->tail);
+    args[0] = ULONG2NUM(max);
     rstr    = rb_funcall2(buf->in.io, ox_readpartial_id, 1, args);
     str     = StringValuePtr(rstr);
-    cnt     = strlen(str);
+    // Clamp to the space actually requested. A misbehaving IO can return more
+    // than max bytes; copying it unclamped overflows the buffer (which starts
+    // on the C stack). Use the real byte length, not strlen(), so an embedded
+    // NUL does not cause a short copy that still leaves a longer string.
+    cnt = (size_t)RSTRING_LEN(rstr);
+    if (cnt > max) {
+        cnt = max;
+    }
     // printf("*** read partial %lu bytes, str: '%s'\n", cnt, str);
-    strcpy(buf->tail, str);
+    memcpy(buf->tail, str, cnt);
     buf->read_end = buf->tail + cnt;
 
     return Qtrue;
@@ -151,14 +159,19 @@ static VALUE io_cb(VALUE rbuf) {
     VALUE  args[1];
     VALUE  rstr;
     char  *str;
+    size_t max = (size_t)(buf->end - buf->tail);
     size_t cnt;
 
-    args[0] = ULONG2NUM(buf->end - buf->tail);
+    args[0] = ULONG2NUM(max);
     rstr    = rb_funcall2(buf->in.io, ox_read_id, 1, args);
     str     = StringValuePtr(rstr);
-    cnt     = strlen(str);
+    // See partial_io_cb: clamp to the requested size to prevent overflow.
+    cnt = (size_t)RSTRING_LEN(rstr);
+    if (cnt > max) {
+        cnt = max;
+    }
     // printf("*** read %lu bytes, str: '%s'\n", cnt, str);
-    strcpy(buf->tail, str);
+    memcpy(buf->tail, str, cnt);
     buf->read_end = buf->tail + cnt;
 
     return Qtrue;
@@ -180,9 +193,11 @@ static int read_from_fd(Buf buf) {
     if (cnt < 0) {
         ox_sax_drive_error(buf->dr, "failed to read from file");
         return -1;
-    } else if (0 != cnt) {
-        buf->read_end = buf->tail + cnt;
+    } else if (0 == cnt) {  // EOF
+        return -1;
     }
+    buf->read_end = buf->tail + cnt;
+
     return 0;
 }
 

data/ext/ox/sax_stack.h

@@ -13,6 +13,7 @@
 
 #define STACK_INC 32
 #define NV_BUF_MAX 64
+#define MAX_ELEMENT_DEPTH 1000
 
 typedef struct _nv {
     char        name_buf[NV_BUF_MAX];
@@ -40,6 +41,15 @@ inline static int stack_empty(NStack stack) {
 }
 
 inline static void stack_cleanup(NStack stack) {
+    Nv nv;
+
+    // Elements still on the stack were never popped, so their over-long names
+    // are still owned here.
+    for (nv = stack->head; nv < stack->tail; nv++) {
+        if (NULL != nv->name) {
+            xfree((char *)(nv->name));
+        }
+    }
     if (stack->base != stack->head) {
         xfree(stack->head);
     }
@@ -50,6 +60,9 @@ inline static void stack_push(NStack stack, const char *name, size_t nlen, VALUE
         size_t len  = stack->end - stack->head;
         size_t toff = stack->tail - stack->head;
 
+        if (MAX_ELEMENT_DEPTH < toff) {
+            rb_raise(ox_parse_error_class, "sax nesting depth exceeded.\n");
+        }
         if (stack->base == stack->head) {
             stack->head = ALLOC_N(struct _nv, len + STACK_INC);
             memcpy(stack->head, stack->base, sizeof(struct _nv) * len);

data/ext/ox/time_conv.h

@@ -0,0 +1,62 @@
+/* time_conv.h
+ * Copyright (c) 2011, Peter Ohler
+ * All rights reserved.
+ */
+
+#ifndef OX_TIME_CONV_H
+#define OX_TIME_CONV_H
+
+#include <stdint.h>
+#include <time.h>
+
+// Howard Hinnant's civil_from_days and days_from_civil, which are inverses.
+// Neither consults a timezone database, and that is the point: mktime() reads
+// the wall clock as local time no matter what offset the document carries, and
+// the Microsoft CRT returns -1 for anything before the epoch.
+
+// Splits seconds since the epoch into a UTC date and wall clock.
+inline static void
+ox_civil_from_epoch(int64_t sec, long long *yearp, int *monp, int *dayp, int *hourp, int *minp, int *secp) {
+    long long days = (long long)sec / 86400;
+    long long rem  = (long long)sec % 86400;
+    long long era, doe, yoe, doy, mp;
+
+    if (0 > rem) {
+        rem += 86400;
+        days--;
+    }
+    *hourp = (int)(rem / 3600);
+    *minp  = (int)(rem % 3600 / 60);
+    *secp  = (int)(rem % 60);
+
+    // The era starts in March so the leap day is last in the year and needs no
+    // special case.
+    days += 719468;
+    era    = (0 <= days ? days : days - 146096) / 146097;
+    doe    = days - era * 146097;
+    yoe    = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;
+    doy    = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    mp     = (5 * doy + 2) / 153;
+    *dayp  = (int)(doy - (153 * mp + 2) / 5 + 1);
+    *monp  = (int)(10 > mp ? mp + 3 : mp - 9);
+    *yearp = yoe + era * 400 + (2 >= *monp);
+}
+
+// Joins a UTC date and wall clock back into seconds since the epoch.
+inline static int64_t ox_epoch_from_civil(long year, long mon, long day, long hour, long min, long sec) {
+    int64_t y = (int64_t)year;
+    int64_t era, yoe, doy, doe, days;
+
+    if (2 >= mon) {
+        y--;
+    }
+    era  = (0 <= y ? y : y - 399) / 400;
+    yoe  = y - era * 400;
+    doy  = (153 * (mon + (2 < mon ? -3 : 9)) + 2) / 5 + day - 1;
+    doe  = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    days = era * 146097 + doe - 719468;
+
+    return days * 86400 + (int64_t)hour * 3600 + (int64_t)min * 60 + (int64_t)sec;
+}
+
+#endif /* OX_TIME_CONV_H */

data/ext/ox/xml_check.h

@@ -0,0 +1,58 @@
+/* xml_check.h
+ * Copyright (c) 2011, Peter Ohler
+ * All rights reserved.
+ */
+
+#ifndef OX_XML_CHECK_H
+#define OX_XML_CHECK_H
+
+#include <stdbool.h>
+#include <stddef.h>
+
+#include "err.h"
+#include "xml_str.h"
+
+/* What a writer asks before it writes anything, shared by dump.c and builder.c.
+ * The scans are in xml_str.h, which stays free of Ruby so it can be reasoned
+ * about on its own; these are the wrappers that turn an answer into a raise.
+ */
+
+/* Raises on a character XML has no way to write, for a value that is copied
+ * through rather than escaped. The escape path answers the same question on its
+ * way past, but inside a CDATA section, a comment or an instruction a character
+ * reference is not expanded, so escaping is not an option for those.
+ */
+inline static void check_unescaped(const char *str, size_t size) {
+    const unsigned char *bad = xml_first_invalid((const unsigned char *)str, size);
+
+    if (NULL != bad) {
+        rb_raise(ox_syntax_error_class, "'\\#x%02x' is not a valid XML character.", *bad);
+    }
+}
+
+/* Refuses a name only for a character that could end it where it is written,
+ * the narrow rule #469 settled on, since anything else is odd but round trips.
+ * A byte XML can not hold at all keeps the message the values raise with.
+ *
+ * Escaping is not the answer here even where a table has an escape: a name is
+ * not a place a character reference is expanded, so &lt; in a name reads back
+ * as four more characters rather than as the one that was asked for.
+ */
+inline static void check_name_chars(const char *str, size_t size, bool attr) {
+    const char           ends = attr ? XML_NAME_ATTR : XML_NAME_ELEMENT;
+    const unsigned char *bad  = xml_first_bad_name((const unsigned char *)str, size, ends);
+    const char          *kind = attr ? "an attribute" : "an element";
+
+    if (NULL == bad) {
+        return;
+    }
+    if (0x20 > *bad && '\t' != *bad && '\n' != *bad && '\r' != *bad) {
+        rb_raise(ox_syntax_error_class, "'\\#x%02x' is not a valid XML character.", *bad);
+    }
+    if (0x20 >= *bad) {
+        rb_raise(ox_syntax_error_class, "'\\#x%02x' can not be used in %s name.", *bad, kind);
+    }
+    rb_raise(ox_syntax_error_class, "'%c' can not be used in %s name.", *bad, kind);
+}
+
+#endif /* OX_XML_CHECK_H */

data/ext/ox/xml_str.h

@@ -0,0 +1,247 @@
+/* xml_str.h
+ * Copyright (c) 2011, Peter Ohler
+ * All rights reserved.
+ */
+
+#ifndef OX_XML_STR_H
+#define OX_XML_STR_H
+
+#include <stdint.h>
+#include <string.h>
+
+#ifndef __has_builtin
+#define __has_builtin(x) 0
+#endif
+
+#if __has_builtin(__builtin_memcpy)
+#define HAVE_FAST_MEMCPY 1
+
+inline static void fast_memcpy16(void *dest, const void *src, size_t n) {
+    char       *d = (char *)dest;
+    const char *s = (const char *)src;
+
+    if (n >= 8) {
+        __builtin_memcpy(d, s, 8);
+        __builtin_memcpy(d + n - 8, s + n - 8, 8);
+    } else if (n >= 4) {
+        __builtin_memcpy(d, s, 4);
+        __builtin_memcpy(d + n - 4, s + n - 4, 4);
+    } else if (n >= 2) {
+        __builtin_memcpy(d, s, 2);
+        __builtin_memcpy(d + n - 2, s + n - 2, 2);
+    } else if (n >= 1) {
+        *d = *s;
+    }
+}
+#endif
+
+/* Shared helpers for the serializer escape path used by both dump.c and
+ * builder.c. The size scan and the escape loop both walk the source string a
+ * word at a time and only fall to a byte at a time when a word contains a byte
+ * that might need escaping.
+ *
+ * Each escape table maps a byte to the length of its serialized form held as an
+ * ASCII digit, '1' meaning the byte is copied through unchanged. The tables in
+ * use (xml_element_chars, xml_quote_chars / xml_attr_chars) escape only a
+ * subset of
+ *
+ *     a byte below 0x20, '"', '\'', '&', '<', '>'
+ *
+ * so a word none of whose bytes are in that set is entirely pass-through and
+ * every one of its bytes is '1' in every table. The predicate below is that
+ * union. It is deliberately a superset: '"' and '\'' are pass-through in
+ * xml_element_chars, and 0x09, 0x0a and 0x0d are pass-through in every table,
+ * but flagging them only sends those bytes to the byte loop, which copies them
+ * through unchanged, so the output is identical. It must never miss a byte a
+ * table would escape, which is why the whole escaped union is covered even
+ * though no current table escapes '\''.
+ */
+
+#define XSTR_ONES 0x0101010101010101ULL
+#define XSTR_HIGH 0x8080808080808080ULL
+
+/* Sets the high bit of every byte of a word that is not guaranteed to be
+ * pass-through, that is a byte below 0x20, or a '"', '\'', '&', '<' or '>'.
+ *
+ * The byte below 0x20 test is the classic (v - ones*0x20) & ~v hasless, and the
+ * five character tests are haszero on v xored with the character broadcast to
+ * every byte. Bytes with the high bit already set, the UTF-8 lead and
+ * continuation bytes, are cleared by the & ~... term and so are never flagged.
+ *
+ * A borrow out of one byte can also flag the byte above it, but a borrow is
+ * only produced by a byte that already matched, so the lowest flagged byte is
+ * always a real match and there are never false negatives. That is what lets a
+ * zero result mean the whole word is pass-through, and the count of trailing
+ * zeros point at the first byte that has to go through the table.
+ */
+inline static uint64_t xml_bytes_of_interest(uint64_t v) {
+    uint64_t q = v ^ (XSTR_ONES * (uint64_t)'"');
+    uint64_t s = v ^ (XSTR_ONES * (uint64_t)'\'');
+    uint64_t a = v ^ (XSTR_ONES * (uint64_t)'&');
+    uint64_t l = v ^ (XSTR_ONES * (uint64_t)'<');
+    uint64_t g = v ^ (XSTR_ONES * (uint64_t)'>');
+
+    return (((v - XSTR_ONES * 0x20) & ~v) | ((q - XSTR_ONES) & ~q) | ((s - XSTR_ONES) & ~s) | ((a - XSTR_ONES) & ~a) |
+            ((l - XSTR_ONES) & ~l) | ((g - XSTR_ONES) & ~g)) &
+           XSTR_HIGH;
+}
+
+/* Offset of the lowest flagged byte, which is the first byte of the word that
+ * has to go through the table. Only ever called with a non-zero mask.
+ */
+inline static int xml_first_of_interest(const unsigned char *s, uint64_t mask) {
+#if defined(__GNUC__) || defined(__clang__)
+#if defined(__BYTE_ORDER__) && defined(__ORDER_BIG_ENDIAN__) && (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__)
+    (void)s;
+    return (int)(__builtin_clzll(mask) >> 3);
+#else
+    (void)s;
+    return (int)(__builtin_ctzll(mask) >> 3);
+#endif
+#else
+    int i;
+
+    (void)mask;
+    for (i = 0; i < 8; i++) {
+        unsigned char u = s[i];
+
+        if (u < 0x20 || '"' == u || '\'' == u || '&' == u || '<' == u || '>' == u) {
+            break;
+        }
+    }
+    return i;
+#endif
+}
+
+/* Length of str once serialized through table, the sum of the table entries
+ * less len * '0' so that a pass-through byte counts as one. A word none of
+ * whose bytes need escaping contributes 8 * '1' with no table lookup at all;
+ * only words with a byte of interest are summed one byte at a time. The word
+ * loop is bounded by str + len so it never reads past the string.
+ */
+inline static size_t xml_str_len(const unsigned char *str, size_t len, const char *table) {
+    const unsigned char *end  = str + len;
+    size_t               size = 0;
+
+    while (str + 8 <= end) {
+        uint64_t v;
+
+        memcpy(&v, str, 8);
+        if (0 == xml_bytes_of_interest(v)) {
+            size += 8 * (size_t)'1';
+        } else {
+            int i;
+
+            for (i = 0; i < 8; i++) {
+                size += table[str[i]];
+            }
+        }
+        str += 8;
+    }
+    for (; str < end; str++) {
+        size += table[*str];
+    }
+    return size - len * (size_t)'0';
+}
+
+/* First byte of str that no XML table lets through, or NULL.
+ *
+ * Every table marks the same set - the bytes under 0x20 other than 0x09, 0x0a
+ * and 0x0d - so this takes no table and answers for all of them. They are all
+ * under 0x20, which is the first term of xml_bytes_of_interest(), so a word
+ * that term does not flag holds none of them and is skipped whole.
+ *
+ * A caller that has to write a delimiter before the value it is escaping uses
+ * this to find out first, since the escape loop only reaches the byte after
+ * the delimiter is already out.
+ */
+inline static const unsigned char *xml_first_invalid(const unsigned char *str, size_t len) {
+    const unsigned char *end = str + len;
+
+    while (str + 8 <= end) {
+        uint64_t v;
+
+        memcpy(&v, str, 8);
+        if (0 != (((v - XSTR_ONES * 0x20) & ~v) & XSTR_HIGH)) {
+            int i;
+
+            for (i = 0; i < 8; i++) {
+                unsigned char c = str[i];
+
+                if (c < 0x20 && '\t' != c && '\n' != c && '\r' != c) {
+                    return str + i;
+                }
+            }
+        }
+        str += 8;
+    }
+    for (; str < end; str++) {
+        if (*str < 0x20 && '\t' != *str && '\n' != *str && '\r' != *str) {
+            return str;
+        }
+    }
+    return NULL;
+}
+
+/* What a byte does to a name, in the same shape as the escape tables. '2' ends
+ * a name wherever one is written - a byte at or below a space, either white
+ * space or one XML can not hold at all, or one of the five characters a start
+ * tag is read with. '1' ends only an attribute name, the quote its value is
+ * written in. '0' is a byte a name can hold.
+ */
+#define XML_NAME_ELEMENT '2'
+#define XML_NAME_ATTR '1'
+
+static const char xml_name_chars[257] = "\
+22222222222222222222222222222222\
+20100020000000020000000000002220\
+00000000000000000000000000000000\
+00000000000000000000000000000000\
+00000000000000000000000000000000\
+00000000000000000000000000000000\
+00000000000000000000000000000000\
+00000000000000000000000000000000";
+
+/* First byte of str that ends a name written where ends says it is written, or
+ * NULL. One load and one compare a byte, since every one of these is a name and
+ * a name is short enough that a word loop would spend more on its own setup
+ * than it saves.
+ */
+inline static const unsigned char *xml_first_bad_name(const unsigned char *str, size_t len, char ends) {
+    const unsigned char *end = str + len;
+
+    for (; str < end; str++) {
+        if (ends <= xml_name_chars[*str]) {
+            return str;
+        }
+    }
+    return NULL;
+}
+
+/* A CDATA section ends at the first "]]>", so a value holding one closes its
+ * own section and the rest is read as markup. Both writers split each
+ * occurrence into "]]" + "]]>" + "<![CDATA[" + ">", which reads back as the
+ * same three characters, so this is what they scan with.
+ */
+#define CDATA_SPLIT_EXTRA 12
+
+inline static const char *xml_cdata_end(const char *str, const char *end) {
+    for (; str + 3 <= end; str++) {
+        if (']' == *str && ']' == str[1] && '>' == str[2]) {
+            return str;
+        }
+    }
+    return NULL;
+}
+
+inline static size_t xml_cdata_end_cnt(const char *str, const char *end) {
+    size_t cnt = 0;
+
+    while (NULL != (str = xml_cdata_end(str, end))) {
+        cnt++;
+        str += 2;
+    }
+    return cnt;
+}
+
+#endif /* OX_XML_STR_H */

data/lib/ox/version.rb

@@ -1,4 +1,4 @@
 module Ox
   # Current version of the module.
-  VERSION = '2.14.28'
+  VERSION = '2.14.29'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ox
 version: !ruby/object:Gem::Version
-  version: 2.14.28
+  version: 2.14.29
 platform: ruby
 authors:
 - Peter Ohler
@@ -72,7 +72,10 @@ files:
 - ext/ox/slotcache.h
 - ext/ox/special.c
 - ext/ox/special.h
+- ext/ox/time_conv.h
 - ext/ox/type.h
+- ext/ox/xml_check.h
+- ext/ox/xml_str.h
 - lib/ox.rb
 - lib/ox/bag.rb
 - lib/ox/cdata.rb
@@ -122,7 +125,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.17
 specification_version: 4
 summary: A fast XML parser and object serializer.
 test_files: []