syck 1.6.1 → 1.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a6f8be592c6d196af5a6fbf7bdab813819b4303d817f48b2edbc2e3441362382
-  data.tar.gz: 309adadd5621cfecdee15f0e36e39b7c1205df6406ab2521cea915b7509196fb
+  metadata.gz: e27c3b9b21ba6e707479bdbfeadbd583d68cfef4b6f2e4882faff6316fc09f19
+  data.tar.gz: d5bfc236838cee8709f19789e641eadf9c218e39b668db1462a5a704cea444b3
 SHA512:
-  metadata.gz: ef57afc974162ffda31cf27709ed5bdad7219f0a181a95a833549d575bfd0edd8fb18967ce380120b477107a643f823294ca83092f17b93a518e49ae59961288
-  data.tar.gz: abbdbea1f6eaea32d639b8ea9bcaee50c012c2f362d24d7a49489938eb079eb5c813d437bbf002cdb2ff149d323fd7510db3494075f6bb6c9a0f9884ed87a485
+  metadata.gz: 4f5de63e2fcd1c793fc25049c3cc36d7fcbb30c661f74b41af5e2f13cdca7145d99820812c6a3729a627810286c2a70b318e3ff2f252f9620514dad9f099ae0f
+  data.tar.gz: a98dbb0151212292f8d2cc47ef00730b607fb0032427c0eec333a66a4b52872429f8c85e9e9aa3effc1ae716cf24e92be7920f9ee68bf556021cc3d2955dfdf6

data/ext/syck/rubyext.c

@@ -148,6 +148,7 @@ rb_syck_compile(VALUE self, VALUE port)
     SYMID oid;
     int taint;
     char *ret;
+    long blen;
     VALUE bc;
     bytestring_t *sav = NULL;
     void *data = NULL;
@@ -160,18 +161,25 @@ rb_syck_compile(VALUE self, VALUE port)
     syck_parser_taguri_expansion( parser, 0 );
     oid = syck_parse( parser );
     if (!syck_lookup_sym( parser, oid, &data )) {
+	syck_free_parser( parser );
 	rb_raise(rb_eSyntaxError, "root node <%p> not found", (void *)oid);
     }
     sav = data;
 
-    ret = S_ALLOCA_N( char, strlen( sav->buffer ) + 3 );
-    ret[0] = '\0';
-    strcat( ret, "D\n" );
-    strcat( ret, sav->buffer );
-
+    /*
+     * Steal the buffer from the parser's symbol table (S_FREE ignores
+     * the NULLed pointer) so the parser can be freed before rb_str_new,
+     * which may raise and would otherwise leak the parser.
+     */
+    ret = sav->buffer;
+    sav->buffer = NULL;
     syck_free_parser( parser );
 
-    bc = rb_str_new2( ret );
+    blen = (long)strlen( ret );
+    bc = rb_str_new( 0, blen + 2 );
+    memcpy( RSTRING_PTR(bc), "D\n", 2 );
+    memcpy( RSTRING_PTR(bc) + 2, ret, (size_t)blen );
+    S_FREE( ret );
     if ( taint )      OBJ_TAINT( bc );
     return bc;
 }
@@ -1213,13 +1221,17 @@ syck_set_ivars(
 )
 {
     VALUE ivname = rb_ary_entry( vars, 0 );
+    VALUE ivn_v;
     char *ivn;
+    long ivn_len;
     StringValue( ivname );
-    ivn = S_ALLOCA_N( char, RSTRING_LEN(ivname) + 2 );
+    ivn_len = RSTRING_LEN(ivname);
+    ivn = ALLOCV_N( char, ivn_v, ivn_len + 2 );
     ivn[0] = '@';
-    ivn[1] = '\0';
-    strncat( ivn, RSTRING_PTR(ivname), RSTRING_LEN(ivname) );
+    memcpy( ivn + 1, RSTRING_PTR(ivname), (size_t)ivn_len );
+    ivn[ivn_len + 1] = '\0';
     rb_iv_set( obj, ivn, rb_ary_entry( vars, 1 ) );
+    ALLOCV_END( ivn_v );
     return Qnil;
 }
 

data/test/test_large_input.rb

@@ -0,0 +1,26 @@
+require 'helper'
+
+module Syck
+  # Both of these sized an `alloca` from the document. They are run on a Thread
+  # because a Ruby thread's stack is far smaller than the main stack, which is
+  # the shape a web or job worker actually has.
+  class TestLargeInput < Test::Unit::TestCase
+    SIZE = 4 * 1024 * 1024
+
+    def on_thread
+      Thread.new { yield }.value
+    end
+
+    def test_long_ivar_name
+      doc = "--- !ruby/object:Object\n" + ('n' * SIZE) + ": 1\n"
+      obj = on_thread { Syck.load(doc) }
+      assert_equal 1, obj.instance_variable_get("@#{'n' * SIZE}")
+    end
+
+    def test_long_compile_input
+      doc = "--- \n" + (0...(SIZE / 20)).map { |i| "k#{i}: v#{i}\n" }.join
+      bc = on_thread { Syck.compile(doc) }
+      assert_equal "D\n", bc[0, 2]
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: syck
 version: !ruby/object:Gem::Version
-  version: 1.6.1
+  version: 1.6.2
 platform: ruby
 authors:
 - Hiroshi SHIBATA
@@ -107,6 +107,7 @@ files:
 - test/test_exception.rb
 - test/test_gc.rb
 - test/test_hash.rb
+- test/test_large_input.rb
 - test/test_null.rb
 - test/test_omap.rb
 - test/test_set.rb
@@ -147,6 +148,7 @@ test_files:
 - test/test_exception.rb
 - test/test_gc.rb
 - test/test_hash.rb
+- test/test_large_input.rb
 - test/test_null.rb
 - test/test_omap.rb
 - test/test_set.rb