ox 2.14.28 → 2.14.29

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 55a1d3d6cf3b51d434dc27e11ac62c93b2eab2b08426daf03c13f295b43cdd5e
-  data.tar.gz: 17b62fcfb67d670bf3693b6863d3906cd52a5f61b0344d5aa5fd1ed8dda26584
+  metadata.gz: 8ebfb30efd11a67a36973ca7fd8ada6eb2d193a0667882ccb78498cdb1362f32
+  data.tar.gz: a1a41cceb0750adc25b6ee9dff8d7b4c2921e6335ba49e1a2daac3de39f98d16
 SHA512:
-  metadata.gz: c063a565a7dc1f1edd042377fbf195d53533a8a3d1585f3a29455beefb9cc7d4c6e9e4911c4632ee48c45f67b4a16b34c8cde7fbcb5aa5c63db74240e7d72230
-  data.tar.gz: 4338c45e7ea8c81948d0dc44af7244593fd0594b9c6c38ffddd1bd247baaa1369e856b8604e09419f8c035cc36478a633d50c005c171ecc4d054c2def302d53a
+  metadata.gz: dfe7978d1f1164cdd391229803e960f929db444021ede9397e689624721b59aec4e92cbee41805d1ddf1272d04526d795a739708e386463c23240431cafd9f1b
+  data.tar.gz: 119ca72c836197ef6d8dcd8c259b1e198563c3b94f5aac6baec45b54db3e8dfc5aa84d763d2044e8ed2173d9451806aa9a9b3a925bc95ed5c6ffffbdcc5e8cf7

data/CHANGELOG.md

@@ -2,6 +2,109 @@
 
 All changes to the Ox gem are documented here. Releases follow semantic versioning.
 
+## [2.14.29] - 2026-07-08
+
+### Added
+
+- Speed up Ox.dump by not type checking the same String twice. See PR #471.
+- Speed up Ox.dump / Ox::Builder string escaping with a SWAR fast path.
+  See PR #423.
+- Speed up Ox.load text parsing with a SWAR fast path. See PR #421.
+- Speed up Ox.dump integer serialization. See PR #417.
+- Speed up Ox.dump string and indent writing. See PR #416.
+- Port oj's fast_memcpy16 into the Ox.dump short-copy path. See PR #424.
+- Drop a redundant strlen and newline scan from text node parsing.
+  See PR #422.
+- Added ruby_memcheck (Valgrind memcheck) integration as rake test:valgrind.
+  See PR #426.
+- Added Valgrind memcheck CI workflow. See PR #427.
+- Added a 20 minute timeout to the CI and Valgrind jobs. See PR #432.
+- Limited the CI workflows to a read-only token and stopped persisting
+  it. See PR #436.
+
+### Changed
+
+- An `<?ox mode="object"?>` processing instruction in a document no
+  longer switches a default `Ox.load` into object mode. Object mode
+  allocates the classes the document names without calling `initialize`
+  and sets their instance variables, so a document can no longer ask for
+  that on its own. Pass `mode: :object` to load in object mode.
+  `mode="generic"` and `mode="limited"` are unaffected. See issue #446.
+
+- Use rb_range_values() to dump a Range instead of struct slots. See PR #429.
+- Removed the dead buf_reset() from the builder's buf.h. See PR #453.
+
+### Fixed
+
+- Fix an element or attribute name going out unchecked. A name can now
+  end itself and start something else with nothing raised. See PR #470.
+- Fix a comment, CDATA, DOCTYPE or instruction value going out
+  unchecked. A NUL in these nodes could lose data. See PR #468.
+- Fix Ox::Builder counting more than it writes, and to_s writing to the
+  buffer. See PR #467.
+- Fix :invalid_replace having no effect unless :effort is moved. See
+  PR #466.
+- Fix a rescued raise leaving part of the value in the buffer. See
+  PR #465.
+- Fix a slash in a Regexp pattern coming back escaped. See PR #463.
+- Fix the arity -1 entry points reading past their arguments. See PR #462.
+- Fix a Symbol name being truncated at an embedded NUL. See PR #461.
+- Fix an encoding set in Ox.default_options never being cleared. See
+  PR #459.
+- Fix Ox::Builder truncating a value at an embedded NUL. See PR #458.
+- Fix a loaded Regexp ignoring the document's encoding. See PR #457.
+- Fix the xsd dateTime conversion discarding the timezone offset. See
+  PR #456.
+- Fix parse_regexp building a pointer before the start of its text. See
+  PR #455.
+- Fix a :nest_ok comment being dropped inside an :off element. See PR #454.
+- Fix Ox.load_file failing on Windows for files ox wrote itself. See
+  PR #452.
+- Fix the builder output buffer being freed with the wrong allocator.
+  See PR #451.
+- Fix a CDATA value being able to close its own section. See PR #450.
+- Fix buffer over-read of an Ox::Builder element name that holds a NUL.
+  See PR #449.
+- Fix a memory leak when an `<?ox mode?>` processing instruction
+  appears more than sixteen elements deep in a document.
+- Fix the SAX parser reading uninitialised memory after EOF on a file.
+  See PR #447.
+- Fix the double free of the hash mode mark list. See PR #445.
+- Fix the sample XML files carrying what look like real passwords. See
+  PR #444.
+- Fix the heap overflow and the stale element name in dump_gen_element.
+  See PR #443.
+- Fix SEGV when an object mode container is not what end_element
+  expects. See PR #442.
+- Fix the thin time format losing times before 1970 and after 2038. See
+  PR #438.
+- Fix Ox.load_file sizing the read from whatever the path reports. See
+  PR #441.
+- Fix the name cache pointer held across callbacks and the unchecked
+  allocations. See PR #440.
+- Fix the out-of-bounds read and write in the base64 decode. See PR #439.
+- Fix SEGV when dumping a Time localtime() can not represent. See
+  PR #437.
+- Fix out-of-bounds heap write and read in the circular reference table.
+  See PR #434.
+- Fix hash flooding by seeding the name cache hash per process. See
+  PR #435.
+- Fix memory leak of the object-mode circular reference table. See
+  PR #433.
+- Fix rake test_all silently skipping most of the test suite. See PR #431.
+- Fix memory leaks on parse error paths, the SAX element stack, and the
+  intern cache. See PR #428.
+- Fix heap out-of-bounds read and write after the Ox::Builder depth
+  raise. See PR #430.
+- Free the Ox.dump output buffer when a dump raises. See PR #425.
+- Fix GC crash from stack PInfo wrapper left dangling on a raised parse.
+  See PR #420.
+- Fix xml_str_len returning ~49x the escaped length. See PR #419.
+- Limit sax nesting. See PR #418.
+- Fix integer overflow with oversized dump :indent option. See PR #415.
+- Fix stack buffer overflow on long object-mode class names. See PR #414.
+- Fix buffer overflow in SAX IO read callbacks. See PR #413.
+
 ## [2.14.28] - 2026-06-28
 
 ### Fixed

data/ext/ox/base64.c

@@ -61,30 +61,30 @@ void to_base64(const uchar *src, int len, char *b64) {
     *b64 = '\0';
 }
 
+// Bytes from_base64() will write, not counting the terminator. It stops where
+// from_base64() stops instead of measuring the string, so the two can not
+// disagree about where the encoding ends.
 unsigned long b64_orig_size(const char *text) {
     const char   *start = text;
-    unsigned long size  = 0;
+    unsigned long cnt;
 
-    if ('\0' != *text) {
-        for (; 0 != *text; text++) {
-        }
-        size = (text - start) * 3 / 4;
-        text--;
-        if ('=' == *text) {
-            size--;
-            text--;
-            if ('=' == *text) {
-                size--;
-            }
-        }
+    for (; 'X' != s_digits[(uchar)*text]; text++) {
     }
-    return size;
+    cnt = (unsigned long)(text - start);
+
+    // Four characters carry three bytes. A trailing pair or triple carries one
+    // or two, a trailing single character none.
+    return cnt / 4 * 3 + (2 <= cnt % 4 ? cnt % 4 - 1 : 0);
 }
 
-void from_base64(const char *b64, uchar *str) {
-    uchar b0, b1, b2, b3;
+// size counts the terminator. It is honoured even if it disagrees with
+// b64_orig_size(), so the two can not drift back into an overflow.
+unsigned long from_base64(const char *b64, uchar *str, unsigned long size) {
+    uchar *start = str;
+    uchar *end   = str + size - 1;
+    uchar  b0, b1, b2, b3;
 
-    while (1) {
+    while (str < end) {
         if ('X' == (b0 = s_digits[(uchar)*b64++])) {
             break;
         }
@@ -92,14 +92,21 @@ void from_base64(const char *b64, uchar *str) {
             break;
         }
         *str++ = (b0 << 2) | ((b1 >> 4) & 0x03);
+        if (end <= str) {
+            break;
+        }
         if ('X' == (b2 = s_digits[(uchar)*b64++])) {
             break;
         }
         *str++ = (b1 << 4) | ((b2 >> 2) & 0x0F);
+        if (end <= str) {
+            break;
+        }
         if ('X' == (b3 = s_digits[(uchar)*b64++])) {
             break;
         }
         *str++ = (b2 << 6) | b3;
     }
     *str = '\0';
+    return (unsigned long)(str - start);
 }

data/ext/ox/base64.h

@@ -13,6 +13,7 @@ typedef unsigned char uchar;
 extern unsigned long b64_orig_size(const char *text);
 
 extern void to_base64(const uchar *src, int len, char *b64);
-extern void from_base64(const char *b64, uchar *str);
+// size counts the terminator, so pass b64_orig_size() + 1.
+extern unsigned long from_base64(const char *b64, uchar *str, unsigned long size);
 
 #endif /* BASE64_H */

data/ext/ox/buf.h

@@ -57,14 +57,9 @@ inline static void buf_init(Buf buf, int fd, long initial_size) {
     buf->err  = false;
 }
 
-inline static void buf_reset(Buf buf) {
-    buf->head = buf->base;
-    buf->tail = buf->head;
-}
-
 inline static void buf_cleanup(Buf buf) {
     if (buf->base != buf->head) {
-        free(buf->head);
+        xfree(buf->head);
     }
 }
 
@@ -85,7 +80,9 @@ inline static void buf_append_string(Buf buf, const char *s, size_t slen) {
                 return;
             }
             buf->tail = buf->head;
-            if (sizeof(buf->base) <= slen) {
+            // The buffer's capacity, not sizeof(base): init() may have taken a
+            // larger head.
+            if ((size_t)(buf->end - buf->head) <= slen) {
                 if (slen != (size_t)write(buf->fd, s, slen)) {
                     buf->err = true;
                     return;