rage-iodine 5.2.0 → 5.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7be7852385079072038ac11985d101e7b05b4a179d9cca4d9714b5259b2e7976
-  data.tar.gz: 89cfe5691372d27ea1cc2093fa9f47e11b86011013b453a23c90371e7849e4c5
+  metadata.gz: 51d87d746e9c30552afbb177d23f52600d6b39668596921d396573cafb2296fc
+  data.tar.gz: 8f30fe5b42df456d0322712155ebada9c71c6c71f82748bd49d424ba2ad34707
 SHA512:
-  metadata.gz: ffadced84f5141ee01debbb951cf7313d9c1f8fda94db7cec4512c717dd6f71c43d0f5e6375c3a736cc1f5c36820db530397c01196aac9e727c0ee47c95ed832
-  data.tar.gz: 7cdf3c7c92c855dcb6f07b8063134f6c537f63e4f28bdab4a7b6e58911969c4f069a3d52f3d74ded830bd49a57033bc2fa6e33c77b5ffa1cbdda9d90c7b7307c
+  metadata.gz: 71cd1ec57ac2ea2680e4953207a7cbb2541b76e3eab7ce148ec06ab782079d056abb18a15fcbee8c62f6d1c6300ccce4a6951632e7c5b61f4ecac51deb8a8f05
+  data.tar.gz: 9c9091274cdecc5feff09ba84957162cfc466b4261eea2f74bf57bcd17ffeae05215b4f791d0250736828b04144e204367e64c6527bf189dabe23b39125fe6ab

data/.github/workflows/release.yml

@@ -0,0 +1,28 @@
+name: Release
+
+on: 
+  push:
+    branches:
+      - master
+    paths:
+      - lib/iodine/version.rb
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+          ruby-version: 3.4
+
+      - uses: rubygems/release-gem@v1

data/CHANGELOG.md

@@ -6,6 +6,20 @@ Please notice that this change log contains changes for upcoming releases as wel
 
 ## Changes:
 
+#### Change log v.5.3.0 (2026-06-03)
+
+**Update**: Add Iodine::WorkerPool
+
+**Update**: Allow to wake up the reactor from non-reactor threads
+
+**Fix**: Correctly process async requests that return empty body
+
+#### Change log v.5.2.1 (2026-03-18)
+
+**Fix**: Fix memory leak when setting `x-accel-buffering` header
+
+**Fix**: Fix memory leak with async SSE flows
+
 #### Change log v.5.2.0 (2026-03-10)
 
 **Update**: Skip connection validity check when closing SSE connections
@@ -138,6 +152,12 @@ Please notice that this change log contains changes for upcoming releases as wel
 
 **Update**: Allow to pause and resume fiber requests.
 
+#### Change log v.0.7.58 (2024-04-28)
+
+**Fix**: possible fix for compilation issues on Fedora. Credit to @garytaylor for opening issue #155.
+
+**Fix**: possible fix for an OpenSSL certificate chain import issue that would cause certificate chains to be imported incorrectly. Credit to @dwolrdcojp for opening the facil.io repo PR #151.
+
 #### Change log v.0.7.57 (2023-09-04)
 
 **Fix**: Fixes possible name collision when loading gem (`.rb` vs. `.so` loading). Credit to @noraj (Alexandre ZANNI) for opening issue #148. Credit to @janbiedermann (Jan Biedermann) for discovering the root cause and offering a solution.

data/Gemfile

@@ -5,6 +5,8 @@ group :test do
   gem 'rspec'
   gem 'rack'
   gem 'http'
+  gem 'base64'
+  gem 'benchmark'
 end
 
 # Specify your gem's dependencies in iodine.gemspec

data/README.md

@@ -10,42 +10,42 @@
 
 Iodine is a fast concurrent web application server for real-time Ruby applications, with native support for WebSockets and Pub/Sub services - but it's also so much more.
 
-Iodine is a Ruby wrapper for many of the [facil.io](https://facil.io) C framework, leveraging the speed of C for many common web application tasks. In addition, iodine abstracts away all network concerns, so you never need to worry about the transport layer, free to concentrate on your application logic.
+Iodine is a Ruby wrapper for much of the [facil.io](https://facil.io) C framework, leveraging the speed of C for many common web application tasks. In addition, iodine abstracts away all network concerns, so you never need to worry about the transport layer, leaving you free to concentrate on your application logic.
 
 Iodine includes native support for:
 
 * HTTP, WebSockets and EventSource (SSE) Services (server);
 * WebSocket connections (server / client);
 * Pub/Sub (with optional Redis Pub/Sub scaling);
-* Fast(!) builtin Mustache template engine.
+* Fast(!) builtin Mustache templating;
 * Static file service (with automatic `gzip` support for pre-compressed assets);
-* Optimized Logging to `stderr`.
+* Optimized Logging to `stderr`;
 * Asynchronous event scheduling and timers;
 * HTTP/1.1 keep-alive and pipelining;
-* Heap Fragmentation Protection.
-* TLS 1.2 and above (Requires OpenSSL >= 1.1.0);
+* Heap Fragmentation Protection;
+* TLS 1.2 and above (Requiring OpenSSL >= 1.1.0);
 * TCP/IP server and client connectivity;
 * Unix Socket server and client connectivity;
-* Hot Restart (using the USR1 signal and without hot deployment);
+* Hot Restarts (using the USR1 signal and without hot deployment);
 * Custom protocol authoring;
-* [Sequel](https://github.com/jeremyevans/sequel) and ActiveRecord forking protection.
+* [Sequel](https://github.com/jeremyevans/sequel) and ActiveRecord forking protection;
 * and more!
 
-Since iodine wraps much of the [C facil.io framework](https://github.com/boazsegev/facil.io) to Ruby:
+Since iodine wraps much of the [C facil.io framework](https://github.com/boazsegev/facil.io) for Ruby:
 
-* Iodine can handle **thousands of concurrent connections** (tested with more then 20K connections on Linux)!
+* Iodine can handle **thousands of concurrent connections** (tested with more than 20K connections on Linux)!
 
 * Iodine is ideal for **Linux/Unix** based systems (i.e. macOS, Ubuntu, FreeBSD etc'), which are ideal for evented IO (while Windows and Solaris are better at IO *completion* events, which are very different).
 
 Iodine is a C extension for Ruby, developed and optimized for Ruby MRI 2.3 and up... it should support the whole Ruby 2.x and 3.x MRI family, but CI tests start at Ruby 2.3.
 
-**Note**: iodine does **not** support streaming when using Rack. It's recommended to avoid blocking the server when using `body.each` since the `each` loop will block the iodine's thread until it's finished and iodine won't send any data before the loop is done.
+**Note**: iodine does **not** support streaming when using Rack. It's recommended to avoid blocking the server when using `body.each` since the `each` loop will block  iodine's thread until it's finished and iodine won't send any data before the loop is done.
 
 ## Iodine - a fast & powerful HTTP + WebSockets server with native Pub/Sub
 
 Iodine includes a light and fast HTTP and Websocket server written in C that was written according to the [Rack interface specifications](http://www.rubydoc.info/github/rack/rack/master/file/SPEC) and the [Websocket draft extension](./SPEC-Websocket-Draft.md).
 
-With `Iodine.listen service: :http` it's possible to run multiple HTTP applications (please remember not to set more than a single application on a single TCP/IP port). 
+With `Iodine.listen service: :http` it's possible to run multiple HTTP applications (but please remember not to set more than a single application on a single TCP/IP port).
 
 Iodine also supports native process cluster Pub/Sub and a native RedisEngine to easily scale iodine's Pub/Sub horizontally.
 
@@ -278,11 +278,11 @@ module WebsocketChat
   extend self
 end
 APP = Proc.new do |env|
-  if env['rack.upgrade?'.freeze] == :websocket 
-    env['rack.upgrade'.freeze] = WebsocketChat 
+  if env['rack.upgrade?'.freeze] == :websocket
+    env['rack.upgrade'.freeze] = WebsocketChat
     [0,{}, []] # It's possible to set cookies for the response.
   elsif env['rack.upgrade?'.freeze] == :sse
-    puts "SSE connections can only receive data from the server, the can't write." 
+    puts "SSE connections can only receive data from the server, the can't write."
     env['rack.upgrade'.freeze] = WebsocketChat
     [0,{}, []] # It's possible to set cookies for the response.
   else
@@ -556,7 +556,7 @@ Iodine is written in C and allows some compile-time customizations, such as:
 * `FIO_MAX_SOCK_CAPACITY` - limits iodine's maximum client capacity. Defaults to 131,072 clients.
 
 * `FIO_USE_RISKY_HASH` - replaces SipHash with RiskyHash for iodine's internal hash maps.
- 
+
     Since iodine hash maps have internal protection against collisions and hash flooding attacks, it's possible for iodine to leverage RiskyHash, which is faster than SipHash.
 
     By default, SipHash will be used. This is a community related choice, since the community seems to believe a hash function should protect the hash map rather than it being enough for a hash map implementation to be attack resistance.
@@ -611,7 +611,7 @@ end
 
 In pure Ruby (without using C extensions or Java), it's possible to do the same by using `select`... and although `select` has some issues, it could work well for lighter loads.
 
-The server events are fairly fast and fragmented (longer code is fragmented across multiple events), so one thread is enough to run the server including it's static file service and everything... 
+The server events are fairly fast and fragmented (longer code is fragmented across multiple events), so one thread is enough to run the server including it's static file service and everything...
 
 ...but single threaded mode should probably be avoided.
 
@@ -642,7 +642,7 @@ If you have the development headers but still can't compile the iodine extension
 
 ## Mr. Sandman, write me a server
 
-Iodine allows custom TCP/IP server authoring, for those cases where we need raw TCP/IP (UDP isn't supported just yet). 
+Iodine allows custom TCP/IP server authoring, for those cases where we need raw TCP/IP (UDP isn't supported just yet).
 
 Here's a short and sweet echo server - No HTTP, just use `telnet`:
 

data/SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policy
+
+Please report any security issues you discover on GitHub using the [`Security and quality`](https://github.com/boazsegev/iodine/security) reporting form.
+
+Please remember that this is an open source project that I work on in my free time. Take it as is, I don't promise anything.
+
+## Supported Versions
+
+I support what I have time to support, with my main focus being:
+
+| Version | Support      |
+| ------- | ------------------ |
+| 0.8.x   | :green_circle:     |
+| 0.7.x   | :orange_circle:    |
+| < 0.7.0 | :red_circle:       |
+
+
+
+### [facil.io](https://facil.io) Security Issues
+
+
+| Version | facil.io link      |
+| ------- | ------------------ |
+| 0.8.x   | https://github.com/facil-io/cstl/security |
+| 0.7.x   | https://github.com/boazsegev/facil.io/security |
+| < 0.7.0   | :red_circle:                |
+
+## Reporting a Vulnerability
+
+Please report any security issues you discover on GitHub using the [`Security and quality`](https://github.com/boazsegev/iodine/security) reporting form or privately using email.
+
+Usually I implement a security patch for the version reported before porting to the current developer version. Please note that it's usually possible to port the patch manually if you don't want to upgrade an older version.

data/ext/iodine/extconf.rb

@@ -107,4 +107,14 @@ EOS
   end
 end
 
+# Feature detection for blocking operation support (Ruby 4.0+)
+has_blocking_op_extract = have_func("rb_fiber_scheduler_blocking_operation_extract")
+
+if has_blocking_op_extract
+  puts "detected blocking_operation APIs - enabling WorkerPool"
+  $defs << "-DHAVE_IODINE_WORKER_POOL"
+else
+  puts "blocking_operation APIs not available (requires Ruby 4.0+) - WorkerPool disabled"
+end
+
 create_makefile 'iodine/iodine_ext'

data/ext/iodine/fio.c

@@ -1018,6 +1018,15 @@ static void init_static_throttle_key(void) {
 }
 
 static size_t fio_poll(void);
+
+/*
+ * Wake reactor when pushing tasks from non-reactor threads.
+ * fio_is_reactor_thread() assumes single-threaded reactor (threads=1).
+ * With multiple threads, fio_cycle can run on any worker, making this check
+ * unreliable. Safe for Rage which enforces single-thread mode.
+ */
+FIO_FUNC void fio_reactor_wakeup(void);
+FIO_FUNC int fio_is_reactor_thread(void);
 /**
  * A thread entering this function should wait for new events.
  */
@@ -1200,13 +1209,19 @@ critical_error:
         (fio_defer_task_s){.func = func_, .arg1 = arg1_, .arg2 = arg2_},       \
         &task_queue_normal);                                                   \
     fio_defer_thread_signal();                                                 \
+    if (!fio_is_reactor_thread())                                              \
+      fio_reactor_wakeup();                                                    \
   } while (0)
 
 #if FIO_USE_URGENT_QUEUE
 #define fio_defer_push_urgent(func_, arg1_, arg2_)                             \
-  fio_defer_push_task_fn(                                                      \
-      (fio_defer_task_s){.func = func_, .arg1 = arg1_, .arg2 = arg2_},         \
-      &task_queue_urgent)
+  do {                                                                         \
+    fio_defer_push_task_fn(                                                    \
+        (fio_defer_task_s){.func = func_, .arg1 = arg1_, .arg2 = arg2_},       \
+        &task_queue_urgent);                                                   \
+    if (!fio_is_reactor_thread())                                              \
+      fio_reactor_wakeup();                                                    \
+  } while (0)
 #else
 #define fio_defer_push_urgent(func_, arg1_, arg2_)                             \
   fio_defer_push_task(func_, arg1_, arg2_)
@@ -1974,6 +1989,7 @@ Section Start Marker
 ***************************************************************************** */
 #if FIO_ENGINE_EPOLL
 #include <sys/epoll.h>
+#include <sys/eventfd.h>
 
 /**
  * Returns a C string detailing the IO engine selected during compilation.
@@ -1984,6 +2000,10 @@ char const *fio_engine(void) { return "epoll"; }
 
 /* epoll tester, in and out */
 static int evio_fd[3] = {-1, -1, -1};
+/* eventfd for cross-thread reactor wakeup */
+static int fio_wakeup_fd = -1;
+/* reactor thread ID */
+static pthread_t fio_reactor_thread;
 
 static void fio_poll_close(void) {
   for (int i = 0; i < 3; ++i) {
@@ -1992,6 +2012,10 @@ static void fio_poll_close(void) {
       evio_fd[i] = -1;
     }
   }
+  if (fio_wakeup_fd != -1) {
+    close(fio_wakeup_fd);
+    fio_wakeup_fd = -1;
+  }
 }
 
 static void fio_poll_init(void) {
@@ -2009,6 +2033,20 @@ static void fio_poll_init(void) {
     if (epoll_ctl(evio_fd[0], EPOLL_CTL_ADD, evio_fd[i], &chevent) == -1)
       goto error;
   }
+  /* initialize eventfd for cross-thread wakeup */
+  fio_wakeup_fd = eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC);
+  if (fio_wakeup_fd == -1) {
+    FIO_LOG_FATAL("couldn't create eventfd.");
+    goto error;
+  }
+  {
+    struct epoll_event ev = {.events = EPOLLIN, .data.fd = fio_wakeup_fd};
+    if (epoll_ctl(evio_fd[1], EPOLL_CTL_ADD, fio_wakeup_fd, &ev) == -1) {
+      FIO_LOG_FATAL("couldn't register eventfd with epoll.");
+      goto error;
+    }
+  }
+  fio_reactor_thread = pthread_self();
   return;
 error:
   FIO_LOG_FATAL("couldn't initialize epoll.");
@@ -2081,6 +2119,11 @@ static size_t fio_poll(void) {
         epoll_wait(internal[j].data.fd, events, FIO_POLL_MAX_EVENTS, 0);
     if (active_count > 0) {
       for (int i = 0; i < active_count; i++) {
+        if (events[i].data.fd == fio_wakeup_fd) {
+          uint64_t val;
+          read(fio_wakeup_fd, &val, sizeof(val));
+          continue;
+        }
         if (events[i].events & (~(EPOLLIN | EPOLLOUT | EPOLLHUP | EPOLLRDHUP | EPOLLERR))) {
           // errors are hendled as disconnections (on_close)
           fio_force_close_in_poll(fd2uuid(events[i].data.fd));
@@ -2109,6 +2152,17 @@ static size_t fio_poll(void) {
   return total;
 }
 
+FIO_FUNC int fio_is_reactor_thread(void) {
+  return pthread_equal(pthread_self(), fio_reactor_thread);
+}
+
+FIO_FUNC void fio_reactor_wakeup(void) {
+  if (fio_wakeup_fd == -1)
+    return;
+  uint64_t val = 1;
+  write(fio_wakeup_fd, &val, sizeof(val));
+}
+
 #endif
 /* *****************************************************************************
 Section Start Marker
@@ -2152,8 +2206,24 @@ Section Start Marker
 char const *fio_engine(void) { return "kqueue"; }
 
 static int evio_fd = -1;
+/* EVFILT_USER identifier for cross-thread reactor wakeup */
+#define FIO_WAKEUP_IDENT 0xF10A11EUL
+static volatile int fio_wakeup_registered = 0;
+/* reactor thread ID */
+static pthread_t fio_reactor_thread;
 
-static void fio_poll_close(void) { close(evio_fd); }
+static void fio_poll_close(void) {
+  if (fio_wakeup_registered && evio_fd >= 0) {
+    struct kevent kev;
+    EV_SET(&kev, FIO_WAKEUP_IDENT, EVFILT_USER, EV_DELETE, 0, 0, NULL);
+    kevent(evio_fd, &kev, 1, NULL, 0, NULL);
+    fio_wakeup_registered = 0;
+  }
+  if (evio_fd >= 0) {
+    close(evio_fd);
+    evio_fd = -1;
+  }
+}
 
 static void fio_poll_init(void) {
   fio_poll_close();
@@ -2162,6 +2232,17 @@ static void fio_poll_init(void) {
     FIO_LOG_FATAL("couldn't open kqueue.\n");
     exit(errno);
   }
+  /* register EVFILT_USER for cross-thread wakeup */
+  {
+    struct kevent kev;
+    EV_SET(&kev, FIO_WAKEUP_IDENT, EVFILT_USER, EV_ADD | EV_CLEAR, 0, 0, NULL);
+    if (kevent(evio_fd, &kev, 1, NULL, 0, NULL) == -1) {
+      FIO_LOG_FATAL("couldn't register EVFILT_USER.\n");
+      exit(errno);
+    }
+    fio_wakeup_registered = 1;
+  }
+  fio_reactor_thread = pthread_self();
 }
 
 static inline void fio_poll_add_read(intptr_t fd) {
@@ -2226,6 +2307,11 @@ static size_t fio_poll(void) {
 
   if (active_count > 0) {
     for (int i = 0; i < active_count; i++) {
+      if (events[i].filter == EVFILT_USER &&
+          events[i].ident == FIO_WAKEUP_IDENT) {
+        /* EV_CLEAR auto-resets, nothing to drain */
+        continue;
+      }
       // test for event(s) type
       if (events[i].filter == EVFILT_WRITE) {
         fio_defer_push_urgent(deferred_on_ready,
@@ -2250,6 +2336,18 @@ static size_t fio_poll(void) {
   return active_count;
 }
 
+FIO_FUNC int fio_is_reactor_thread(void) {
+  return pthread_equal(pthread_self(), fio_reactor_thread);
+}
+
+FIO_FUNC void fio_reactor_wakeup(void) {
+  if (!fio_wakeup_registered)
+    return;
+  struct kevent kev;
+  EV_SET(&kev, FIO_WAKEUP_IDENT, EVFILT_USER, 0, NOTE_TRIGGER, 0, NULL);
+  kevent(evio_fd, &kev, 1, NULL, 0, NULL);
+}
+
 #endif
 /* *****************************************************************************
 Section Start Marker
@@ -2399,6 +2497,13 @@ finish:
   return count;
 }
 
+FIO_FUNC int fio_is_reactor_thread(void) {
+  return 1;
+}
+
+FIO_FUNC void fio_reactor_wakeup(void) {
+}
+
 #endif /* FIO_ENGINE_POLL */
 
 /* *****************************************************************************
@@ -2581,6 +2686,13 @@ finish:
   return count;
 }
 
+FIO_FUNC int fio_is_reactor_thread(void) {
+  return 1;
+}
+
+FIO_FUNC void fio_reactor_wakeup(void) {
+}
+
 #endif /* FIO_ENGINE_WSAPOLL */
 
 /* *****************************************************************************
@@ -3437,7 +3549,7 @@ read_error:
 static int fio_sock_sendfile_from_fd(int fd, fio_packet_s *packet) {
   ssize_t sent;
   sent =
-      sendfile64(fd, packet->data.fd, (off_t *)&packet->offset, packet->length);
+      sendfile(fd, packet->data.fd, (off_t *)&packet->offset, packet->length);
   if (sent < 0)
     return -1;
   packet->length -= sent;

data/ext/iodine/fio.h

@@ -109,7 +109,7 @@ Version and helper macros
 
 #define FIO_VERSION_MAJOR 0
 #define FIO_VERSION_MINOR 7
-#define FIO_VERSION_PATCH 4
+#define FIO_VERSION_PATCH 7
 #define FIO_VERSION_BETA 0
 
 /* Automatically convert version data to a string constant - ignore these two */
@@ -221,6 +221,7 @@ Version and helper macros
 #include <unistd.h>
 #ifdef __MINGW32__
 #include <winsock2.h>
+
 #include <winsock.h>
 #include <ws2tcpip.h>
 #endif
@@ -251,10 +252,10 @@ Version and helper macros
 #endif
 
 #ifdef __MINGW32__
-#define	__S_IFMT	              0170000
-#define __S_IFLNK               0120000
-#define	__S_ISTYPE(mode, mask)	(((mode) & __S_IFMT) == (mask))
-#define S_ISLNK(mode)	          __S_ISTYPE((mode), __S_IFLNK)
+#define __S_IFMT 0170000
+#define __S_IFLNK 0120000
+#define __S_ISTYPE(mode, mask) (((mode)&__S_IFMT) == (mask))
+#define S_ISLNK(mode) __S_ISTYPE((mode), __S_IFLNK)
 
 #define SIGKILL 9
 #define SIGTERM 15
@@ -4781,14 +4782,11 @@ static FIO_ARY_TYPE const FIO_NAME(s___const_invalid_object);
 /* minimizes allocation "dead space" by alligning allocated length to 16bytes */
 #undef FIO_ARY_SIZE2WORDS
 #define FIO_ARY_SIZE2WORDS(size)                                               \
-  ((sizeof(FIO_ARY_TYPE) & 1)                                                  \
-       ? (((size) & (~15)) + 16)                                               \
-       : (sizeof(FIO_ARY_TYPE) & 2)                                            \
-             ? (((size) & (~7)) + 8)                                           \
-             : (sizeof(FIO_ARY_TYPE) & 4)                                      \
-                   ? (((size) & (~3)) + 4)                                     \
-                   : (sizeof(FIO_ARY_TYPE) & 8) ? (((size) & (~1)) + 2)        \
-                                                : (size))
+  ((sizeof(FIO_ARY_TYPE) & 1)   ? (((size) & (~15)) + 16)                      \
+   : (sizeof(FIO_ARY_TYPE) & 2) ? (((size) & (~7)) + 8)                        \
+   : (sizeof(FIO_ARY_TYPE) & 4) ? (((size) & (~3)) + 4)                        \
+   : (sizeof(FIO_ARY_TYPE) & 8) ? (((size) & (~1)) + 2)                        \
+                                : (size))
 
 /* *****************************************************************************
 Array API
@@ -6086,7 +6084,7 @@ FIO_NAME(_insert_or_overwrite_)(FIO_NAME(s) * set, FIO_SET_HASH_TYPE hash_value,
   pos->hash = hash_value;
   pos->pos->hash = hash_value;
   FIO_SET_COPY(pos->pos->obj, obj);
-  
+
   return pos->pos->obj;
 }
 

data/ext/iodine/fio_json_parser.h

@@ -393,7 +393,7 @@ fio_json_parse(json_parser_s *parser, const char *buffer, size_t length) {
         goto error;
       break;
     case ']':
-      if ((parser->dict & 1))
+      if ((parser->dict & 1) || !parser->depth)
         goto error;
       --parser->depth;
       ++pos;
@@ -453,12 +453,12 @@ fio_json_parse(json_parser_s *parser, const char *buffer, size_t length) {
       long long i = fio_atol((char **)&tmp);
       if (tmp > limit)
         goto stop;
-      if (!tmp || JSON_NUMERAL[*tmp]) {
+      if (!tmp || tmp == pos || JSON_NUMERAL[*tmp]) {
         tmp = pos;
         double f = fio_atof((char **)&tmp);
         if (tmp > limit)
           goto stop;
-        if (!tmp || JSON_NUMERAL[*tmp])
+        if (!tmp || tmp == pos || JSON_NUMERAL[*tmp])
           goto error;
         fio_json_on_float(parser, f);
         pos = tmp;
@@ -481,8 +481,9 @@ fio_json_parse(json_parser_s *parser, const char *buffer, size_t length) {
       if (pos[1] == '*') {
         if (pos + 4 > limit)
           goto stop;
-        uint8_t *tmp = pos + 3; /* avoid this: /*/
+        uint8_t *tmp = pos + 2; /* avoid this: /*/
         do {
+          ++tmp;
           tmp = memchr(tmp, '/', (uintptr_t)(limit - tmp));
         } while (tmp && tmp[-1] != '*');
         if (!tmp)