syck 1.6.0 → 1.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 840b03fd443a2db94f3eb4a5a0d4b20b6d5292ce4be81f2d2390b5f23aef3f97
-  data.tar.gz: cfb7139004022b747e170e46d54c39aaecd7468ea1d3bfe6a5dba5eb18555fc9
+  metadata.gz: e27c3b9b21ba6e707479bdbfeadbd583d68cfef4b6f2e4882faff6316fc09f19
+  data.tar.gz: d5bfc236838cee8709f19789e641eadf9c218e39b668db1462a5a704cea444b3
 SHA512:
-  metadata.gz: 07f844fab0e7d8fbcffc9df0b28701ffd29ed1d9fd5f2d433e65fbcfc2ed437d4a340b79591f69eb0bf8cd1d0a4e030a408ccdc80626a681821489944691e02a
-  data.tar.gz: c959e3ee17666ac383ee92d7f27ea2e6ddd037a7f7ec3b9b17cc6385ef53f533bc190af1a75efad4b01ae190f50eb9873bf2f29e7058f0c3273885b8c25335c6
+  metadata.gz: 4f5de63e2fcd1c793fc25049c3cc36d7fcbb30c661f74b41af5e2f13cdca7145d99820812c6a3729a627810286c2a70b318e3ff2f252f9620514dad9f099ae0f
+  data.tar.gz: a98dbb0151212292f8d2cc47ef00730b607fb0032427c0eec333a66a4b52872429f8c85e9e9aa3effc1ae716cf24e92be7920f9ee68bf556021cc3d2955dfdf6

data/ext/syck/implicit.c

@@ -11,7 +11,7 @@
 #include "ruby/ruby.h"
 #include "syck.h"
 
-#define YYCTYPE     char
+#define YYCTYPE     unsigned char
 #define YYCURSOR    cursor
 #define YYMARKER    marker
 #define YYLIMIT     limit

data/ext/syck/rubyext.c

@@ -13,29 +13,6 @@
 #include <sys/types.h>
 #include <time.h>
 
-typedef struct RVALUE {
-    union {
-#if 0
-    struct {
-        unsigned long flags;    /* always 0 for freed obj */
-        struct RVALUE *next;
-    } free;
-#endif
-    struct RBasic  basic;
-    struct RObject object;
-    /*struct RClass  klass;*/
-    /*struct RFloat  flonum;*/
-    /*struct RString string;*/
-    struct RArray  array;
-    /*struct RRegexp regexp;*/
-    /*struct RHash   hash;*/
-    /*struct RData   data;*/
-    /*struct RStruct rstruct;*/
-    /*struct RBignum bignum;*/
-    /*struct RFile   file;*/
-    } as;
-} RVALUE;
-
 typedef struct {
    long hash;
    char *buffer;
@@ -171,6 +148,7 @@ rb_syck_compile(VALUE self, VALUE port)
     SYMID oid;
     int taint;
     char *ret;
+    long blen;
     VALUE bc;
     bytestring_t *sav = NULL;
     void *data = NULL;
@@ -183,18 +161,25 @@ rb_syck_compile(VALUE self, VALUE port)
     syck_parser_taguri_expansion( parser, 0 );
     oid = syck_parse( parser );
     if (!syck_lookup_sym( parser, oid, &data )) {
+	syck_free_parser( parser );
 	rb_raise(rb_eSyntaxError, "root node <%p> not found", (void *)oid);
     }
     sav = data;
 
-    ret = S_ALLOCA_N( char, strlen( sav->buffer ) + 3 );
-    ret[0] = '\0';
-    strcat( ret, "D\n" );
-    strcat( ret, sav->buffer );
-
+    /*
+     * Steal the buffer from the parser's symbol table (S_FREE ignores
+     * the NULLed pointer) so the parser can be freed before rb_str_new,
+     * which may raise and would otherwise leak the parser.
+     */
+    ret = sav->buffer;
+    sav->buffer = NULL;
     syck_free_parser( parser );
 
-    bc = rb_str_new2( ret );
+    blen = (long)strlen( ret );
+    bc = rb_str_new( 0, blen + 2 );
+    memcpy( RSTRING_PTR(bc), "D\n", 2 );
+    memcpy( RSTRING_PTR(bc) + 2, ret, (size_t)blen );
+    S_FREE( ret );
     if ( taint )      OBJ_TAINT( bc );
     return bc;
 }
@@ -705,6 +690,99 @@ yaml_org_handler( SyckNode *n, VALUE *ref )
 }
 
 static void syck_node_mark( SyckNode *n );
+static VALUE id_hash_new(void);
+
+/*
+ * Rewrite every reference to `from` inside `obj` so it points at `to`.
+ *
+ * A self-referential anchor (`--- &a\n- *a\n`) is aliased before the anchored
+ * node is finished, so the parser hands out a BadAlias placeholder and only
+ * later learns which object the anchor really is.  Only containers can hold a
+ * placeholder, so the walk stops at anything else.  `seen` must compare by
+ * identity, otherwise equal-but-distinct nodes collapse and cycles that are
+ * already in place would recurse forever.
+ */
+static void
+syck_swap_placeholder(VALUE obj, VALUE from, VALUE to, VALUE seen)
+{
+    long i;
+    VALUE ivars;
+
+    if ( SPECIAL_CONST_P( obj ) || OBJ_FROZEN( obj ) ) return;
+
+    switch ( BUILTIN_TYPE( obj ) )
+    {
+        case T_ARRAY:
+        case T_HASH:
+        case T_STRUCT:
+        case T_OBJECT:
+        break;
+
+        default:
+        return;
+    }
+
+    if ( RTEST( rb_hash_lookup( seen, obj ) ) ) return;
+    rb_hash_aset( seen, obj, Qtrue );
+
+    switch ( BUILTIN_TYPE( obj ) )
+    {
+        case T_ARRAY:
+            for ( i = 0; i < RARRAY_LEN( obj ); i++ )
+            {
+                VALUE v = rb_ary_entry( obj, i );
+                if ( v == from ) rb_ary_store( obj, i, to );
+                else syck_swap_placeholder( v, from, to, seen );
+            }
+        break;
+
+        case T_HASH:
+        {
+            VALUE keys = rb_funcall( obj, s_keys, 0 );
+            for ( i = 0; i < RARRAY_LEN( keys ); i++ )
+            {
+                VALUE key = rb_ary_entry( keys, i );
+                VALUE val = rb_hash_aref( obj, key );
+
+                if ( key == from || val == from )
+                {
+                    VALUE new_key = key == from ? to : key;
+                    VALUE new_val = val == from ? to : val;
+
+                    if ( new_key != key ) rb_hash_delete( obj, key );
+                    rb_hash_aset( obj, new_key, new_val );
+                    key = new_key;
+                    val = new_val;
+                }
+
+                syck_swap_placeholder( key, from, to, seen );
+                syck_swap_placeholder( val, from, to, seen );
+            }
+        }
+        break;
+
+        case T_STRUCT:
+            for ( i = 0; i < RSTRUCT_LEN( obj ); i++ )
+            {
+                VALUE v = rb_struct_aref( obj, LONG2NUM( i ) );
+                if ( v == from ) rb_struct_aset( obj, LONG2NUM( i ), to );
+                else syck_swap_placeholder( v, from, to, seen );
+            }
+        break;
+
+        default:
+        break;
+    }
+
+    ivars = rb_obj_instance_variables( obj );
+    for ( i = 0; i < RARRAY_LEN( ivars ); i++ )
+    {
+        ID name = SYM2ID( rb_ary_entry( ivars, i ) );
+        VALUE v = rb_ivar_get( obj, name );
+        if ( v == from ) rb_ivar_set( obj, name, to );
+        else syck_swap_placeholder( v, from, to, seen );
+    }
+}
 
 /*
  * {native mode} node handler
@@ -738,13 +816,19 @@ rb_syck_load_handler(SyckParser *p, SyckNode *n)
     DATA_PTR( node_wrapper ) = NULL;
 
     /*
-     * ID already set, let's alter the symbol table to accept the new object
+     * A placeholder was handed out for this node while it was still being
+     * parsed.  Syck used to fuse the two by copying the real object over the
+     * placeholder's heap slot, which is wrong on every count the GC cares
+     * about: the slot is sized for the placeholder, the copied flags carry
+     * the source object's age bits, no write barrier fires, and zeroing the
+     * source turns a live object into T_NONE behind the GC's back.  The heap
+     * then stays corrupted until some unrelated allocation crashes.  Rewrite
+     * the references instead.
      */
     if (n->id > 0 && !NIL_P(obj))
     {
-        MEMCPY((void *)n->id, (void *)obj, RVALUE, 1);
-        MEMZERO((void *)obj, RVALUE, 1);
-        obj = n->id;
+        syck_swap_placeholder( obj, (VALUE)n->id, obj, id_hash_new() );
+        n->id = obj;
     }
 
     if ( bonus->taint)      OBJ_TAINT( obj );
@@ -1137,13 +1221,17 @@ syck_set_ivars(
 )
 {
     VALUE ivname = rb_ary_entry( vars, 0 );
+    VALUE ivn_v;
     char *ivn;
+    long ivn_len;
     StringValue( ivname );
-    ivn = S_ALLOCA_N( char, RSTRING_LEN(ivname) + 2 );
+    ivn_len = RSTRING_LEN(ivname);
+    ivn = ALLOCV_N( char, ivn_v, ivn_len + 2 );
     ivn[0] = '@';
-    ivn[1] = '\0';
-    strncat( ivn, RSTRING_PTR(ivname), RSTRING_LEN(ivname) );
+    memcpy( ivn + 1, RSTRING_PTR(ivname), (size_t)ivn_len );
+    ivn[ivn_len + 1] = '\0';
     rb_iv_set( obj, ivn, rb_ary_entry( vars, 1 ) );
+    ALLOCV_END( ivn_v );
     return Qnil;
 }
 

data/lib/syck/constants.rb

@@ -6,7 +6,7 @@ module Syck
 	#
 	# Constants
 	#
-	VERSION = '1.6.0'
+	VERSION = '1.6.1'
 	SUPPORTED_YAML_VERSIONS = ['1.0']
 
 	#

data/test/test_boolean.rb

@@ -32,5 +32,17 @@ module Syck
       assert_equal "n", Syck.load("--- n")
       assert_equal "N", Syck.load("--- N")
     end
+
+    ###
+    # https://github.com/ruby/syck/issues/22
+    # A boolean-like prefix followed by a non-ASCII byte must not be
+    # matched as a boolean
+    def test_bool_prefix_with_non_ascii
+      assert_equal "Noémie", Syck.load("--- Noémie")
+      assert_equal ["Noémie"], Syck.load("--- [Noémie]")
+      assert_equal "Yeså", Syck.load("--- Yeså")
+      assert_equal "trueé", Syck.load("--- trueé")
+      assert_equal "nullé", Syck.load("--- nullé")
+    end
   end
 end

data/test/test_large_input.rb

@@ -0,0 +1,26 @@
+require 'helper'
+
+module Syck
+  # Both of these sized an `alloca` from the document. They are run on a Thread
+  # because a Ruby thread's stack is far smaller than the main stack, which is
+  # the shape a web or job worker actually has.
+  class TestLargeInput < Test::Unit::TestCase
+    SIZE = 4 * 1024 * 1024
+
+    def on_thread
+      Thread.new { yield }.value
+    end
+
+    def test_long_ivar_name
+      doc = "--- !ruby/object:Object\n" + ('n' * SIZE) + ": 1\n"
+      obj = on_thread { Syck.load(doc) }
+      assert_equal 1, obj.instance_variable_get("@#{'n' * SIZE}")
+    end
+
+    def test_long_compile_input
+      doc = "--- \n" + (0...(SIZE / 20)).map { |i| "k#{i}: v#{i}\n" }.join
+      bc = on_thread { Syck.compile(doc) }
+      assert_equal "D\n", bc[0, 2]
+    end
+  end
+end

data/test/test_yaml.rb

@@ -1337,6 +1337,40 @@ EOY
         assert_equal( inspect_str, Syck::load( a.to_yaml ).inspect )
     end
 
+    #
+    # A self-referential anchor is aliased before the anchored node exists, so
+    # the parser hands out a placeholder and patches it up afterwards.  That
+    # used to be done by overwriting the placeholder's heap slot, which left
+    # the GC heap corrupted and crashed at some later allocation.
+    #
+    def test_self_referential_anchor
+        [ 1, 3, 6, 50 ].each do |n|
+            seq = Syck::load( "--- &id001\n" + "- *id001\n" * n )
+            assert_equal( n, seq.size )
+            seq.each { |item| assert_same( seq, item ) }
+        end
+
+        map = Syck::load( "--- &id001\nself: *id001\n" )
+        assert_same( map, map["self"] )
+
+        keyed = Syck::load( "--- &id001\n? *id001\n: 1\n" )
+        assert_same( keyed, keyed.keys.first )
+
+        # The alias appears as a key and again below the matching value, so
+        # rewriting the key must not stop the walk from reaching the rest.
+        both = Syck::load( "--- &id001\n? *id001\n: \n  - *id001\n" )
+        key, value = both.first
+        assert_same( both, key )
+        assert_same( both, value[0] )
+
+        nested = Syck::load( "--- &id001\n- &id002\n  - *id001\n- *id002\n" )
+        assert_same( nested, nested[0][0] )
+        assert_same( nested[0], nested[1] )
+
+        GC.start
+        assert_nothing_raised { GC.verify_internal_consistency }
+    end
+
     #
     # Test Symbol cycle
     #

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: syck
 version: !ruby/object:Gem::Version
-  version: 1.6.0
+  version: 1.6.2
 platform: ruby
 authors:
 - Hiroshi SHIBATA
@@ -107,6 +107,7 @@ files:
 - test/test_exception.rb
 - test/test_gc.rb
 - test/test_hash.rb
+- test/test_large_input.rb
 - test/test_null.rb
 - test/test_omap.rb
 - test/test_set.rb
@@ -147,6 +148,7 @@ test_files:
 - test/test_exception.rb
 - test/test_gc.rb
 - test/test_hash.rb
+- test/test_large_input.rb
 - test/test_null.rb
 - test/test_omap.rb
 - test/test_set.rb