yeptris 0.6.52.0-arm-linux-eabihf → 0.6.54.0-arm-linux-eabihf

data/vendor/libyeptris/src/yeptris/emit/writer.c

@@ -24,6 +24,7 @@
 
 #include "style.h"
 
+#include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
 
@@ -95,6 +96,40 @@ static void wr_put(yep_writer* w, const char* p, uint32_t n) {
         w->len += n;
         return;
     }
+    if (w->sink != NULL && !w->grow && !w->bounded && w->cap > 0 &&
+        (size_t)n > w->cap - w->len - 1) {
+        /* the fixed-window streaming route cannot hold this put even
+         * after the watermark flush: CHUNK it — window-sized pieces
+         * with a flush between each. Append-only output makes any cut
+         * a safe cut; the sink sees more, smaller chunks. Memory stays
+         * bounded by the window (the route's whole point) — the old
+         * unconditional memcpy wrote straight past it for any scalar
+         * larger than the remaining room (the 2026-10-31 audit's
+         * streaming-overflow finding). */
+        size_t off = 0;
+        while (off < (size_t)n) {
+            if (w->sink_aborted) {
+                w->len += (size_t)n - off; /* keep counting: the caller fails */
+                return;
+            }
+            size_t room = w->cap - w->len - 1;
+            if (room > (size_t)n - off) {
+                room = (size_t)n - off;
+            }
+            memcpy(w->p + w->len, p + off, room);
+            w->len += room;
+            off += room;
+            if (off < (size_t)n) {
+                if (w->sink(w->sink_ctx, w->p, w->len) != 0) {
+                    w->sink_aborted = 1;
+                } else {
+                    w->flushed += w->len;
+                    w->len = 0;
+                }
+            }
+        }
+        return;
+    }
     /* the +1 reserves the terminator slot: the serializers write the
      * NUL at p[len] after the run, and a write landing exactly on cap
      * (len + n == cap) put that NUL one byte past the buffer — the
@@ -487,10 +522,11 @@ enum { YEP_SC_NOTHING = 0, YEP_SC_PLAIN, YEP_SC_SQ, YEP_SC_DQ, YEP_SC_LITERAL, Y
  * a key whose content demotes to DQ re-parses as a QUOTED key and must
  * ride simple, or round two's render differs (the nightly's round 118). */
 static uint8_t sc_route(yep_writer* w, const char* p, uint32_t len, int as_key, uint8_t sty_in,
-                        int has_tag, int no_exotic) {
-    /* the parse-time fact bit (#352 lane 2): a dnode verified clean of
-     * the dq-forced set skips the rescan — 0 (mutation-built or JSON
-     * classes) keeps the scan */
+                        int has_tag, int no_exotic, int plain_fact) {
+    /* the parse-time fact bits (#352 lanes 2-3): a dnode verified clean
+     * of the dq-forced set skips that rescan, and a verified plain-safe
+     * span skips the safety walk — 0 (mutation-built or JSON classes)
+     * keeps the derive */
     if (!no_exotic && yep_scan_dq_forced(p, len)) {
         return YEP_SC_DQ;
     }
@@ -535,7 +571,10 @@ static uint8_t sc_route(yep_writer* w, const char* p, uint32_t len, int as_key,
     int plain_ok = 0;
     int plain_checked = 0;
     if ((sty_in == 1) && len > 0) {
-        plain_ok = as_key ? yep_style_plain_key_safe(p, len) : yep_style_plain_safe(p, len);
+        plain_ok = plain_fact;
+        if (!plain_ok) {
+            plain_ok = as_key ? yep_style_plain_key_safe(p, len) : yep_style_plain_safe(p, len);
+        }
         plain_checked = 1;
         if (plain_ok) {
             return YEP_SC_PLAIN; /* plain-safe implies no breaks: memchr skipped */
@@ -594,7 +633,10 @@ static uint8_t sc_route(yep_writer* w, const char* p, uint32_t len, int as_key,
             return as_key ? YEP_SC_DQ : YEP_SC_NOTHING;
         }
         if (!plain_checked) {
-            plain_ok = as_key ? yep_style_plain_key_safe(p, len) : yep_style_plain_safe(p, len);
+            plain_ok = plain_fact;
+            if (!plain_ok) {
+                plain_ok = as_key ? yep_style_plain_key_safe(p, len) : yep_style_plain_safe(p, len);
+            }
             plain_checked = 1;
         }
         if (plain_ok) {
@@ -635,14 +677,15 @@ static void emit_scalar(yep_writer* w, const yep_dnode* n, int parent_col, int a
      * memoized long scalars, in visit order either way. */
     if (w->sc_dec != NULL && len >= YEP_SC_MEMO_MIN) {
         if (w->dry) {
-            route = sc_route(w, p, len, as_key, n->style, n->tag.len > 0, n->no_exotic);
+            route =
+                sc_route(w, p, len, as_key, n->style, n->tag.len > 0, n->no_exotic, n->plain_ok);
             w->sc_dec[w->sc_i] = route;
         } else {
             route = w->sc_dec[w->sc_i];
         }
         w->sc_i++;
     } else {
-        route = sc_route(w, p, len, as_key, n->style, n->tag.len > 0, n->no_exotic);
+        route = sc_route(w, p, len, as_key, n->style, n->tag.len > 0, n->no_exotic, n->plain_ok);
     }
     switch (route) {
     case YEP_SC_NOTHING:
@@ -762,8 +805,14 @@ static void emit_anchor_ex(yep_emitter* em, const yep_dnode* n) {
     if (anchor_name_unspellable(w, n)) {
         return;
     }
-    wr_byte(w, '&');
     yep_view adec = wv(w, n->anchor);
+    if (w->json) {
+        /* JSON spells no anchors — but a name the emitter could never
+         * spell still fails the entry (the "{k: &a?b v}" law) */
+        wr_anchor_check(w, &adec);
+        return;
+    }
+    wr_byte(w, '&');
     if (w->canonical) {
         uint32_t idx = yep_nametab_get(&em->canon_names, adec);
         if (idx == YEP_NAMETAB_NIL) {
@@ -782,6 +831,12 @@ static void emit_anchor_ex(yep_emitter* em, const yep_dnode* n) {
 
 static void emit_alias_ex(yep_emitter* em, const yep_dnode* n) {
     yep_writer* w = &em->w;
+    if (w->json) {
+        /* JSON has no alias references: the projection writes null
+         * (bounded — dereferencing would loop on cycles) */
+        wr_put(w, "null", 4);
+        return;
+    }
     yep_view name_v = wv(w, n->value);
     if (w->in_flow && !w->canonical) {
         /* the alias twin of wr_anchor_check: a flow alias is spelled
@@ -916,6 +971,9 @@ static void emit_tag(yep_writer* w, const yep_dnode* n) {
     if (n->tag.len == 0) {
         return;
     }
+    if (w->json) {
+        return; /* JSON spells no tags (the ts probe: "k: !" -> {"k": ! ""}) */
+    }
     yep_view tdec = wv(w, n->tag);
     wr_tag_token(w, &tdec);
     wr_byte(w, ' ');
@@ -925,15 +983,18 @@ static void emit_tag(yep_writer* w, const yep_dnode* n) {
  * "key:"/"-" — properties may not precede a dash entry directly (the
  * suite's SY6V rule). */
 static void emit_props_tail(yep_writer* w, const yep_dnode* n) {
+    if (n->anchor.len > 0 && anchor_name_unspellable(w, n)) {
+        return;
+    }
+    if (w->json) {
+        return; /* JSON spells no properties */
+    }
     if (n->tag.len > 0) {
         wr_byte(w, ' ');
         yep_view tdec2 = wv(w, n->tag);
         wr_tag_token(w, &tdec2);
     }
     if (n->anchor.len > 0) {
-        if (anchor_name_unspellable(w, n)) {
-            return;
-        }
         wr_byte(w, ' ');
         yep_view adec2 = wv(w, n->anchor);
         wr_anchor_check(w, &adec2);
@@ -1120,42 +1181,57 @@ static void emit_block_map(yep_emitter* em, uint32_t id, int content_col) {
             vn0->count == 0) {
             yep_view kv = wv(w, kn0->value);
             yep_view vv = wv(w, vn0->value);
-            if (kv.len > 0 && !key_written_over_limit(w, kn0) &&
-                yep_style_plain_key_safe((const char*)kv.p, kv.len) &&
-                (vv.len == 0 || yep_style_plain_safe((const char*)vv.p, vv.len))) {
+            uint32_t f_ind = 0, f_nl = 0, f_total = 0;
+            int fused = kv.len > 0 && !key_written_over_limit(w, kn0) && kn0->plain_ok &&
+                        (vv.len == 0 || vn0->plain_ok);
+            if (fused) {
                 /* fused member write: plain-safe spans carry no breaks,
                  * so the col scan is arithmetic and one reservation
                  * covers the whole member (line + key + ':' + value) */
-                uint32_t ind = pair > 0 ? (uint32_t)content_col : 0u;
-                uint32_t nl = (pair > 0 && w->last != '\n') ? 1u : 0u;
-                uint32_t total = nl + ind + kv.len + 1u + (vv.len > 0 ? vv.len + 1u : 0u);
+                f_ind = pair > 0 ? (uint32_t)content_col : 0u;
+                f_nl = (pair > 0 && w->last != '\n') ? 1u : 0u;
+                f_total = f_nl + f_ind + kv.len + 1u + (vv.len > 0 ? vv.len + 1u : 0u);
+                /* the fixed-window streaming route: the fused write
+                 * bypasses wr_put (whose chunked path bounds every
+                 * put), and this block ends in continue — so a member
+                 * that does not fit the window must DECLINE THE WHOLE
+                 * ARM to reach the general body, which emits the
+                 * identical bytes through wr_put. cap==0 routes are the
+                 * old trusted-count forms: the writer cannot reason
+                 * about their capacity, and they keep the arm. */
+                if (!w->dry && !w->grow && w->cap != 0 && w->len + (size_t)f_total + 1 > w->cap) {
+                    fused = 0;
+                }
+            }
+            if (fused) {
                 w->last = vv.len > 0 ? (char)vv.p[vv.len - 1] : ':';
-                if (nl) {
-                    w->col = (int)(total - 1u); /* the break resets, then the line */
+                if (f_nl) {
+                    w->col = (int)(f_total - 1u); /* the break resets, then the line */
                 } else {
-                    w->col += (int)total;
+                    w->col += (int)f_total;
                 }
                 if (w->dry) {
-                    w->len += total;
+                    w->len += f_total;
                 } else {
-                    if (w->grow && w->len + total + 1 > w->cap) {
+                    if (w->grow && w->len + f_total + 1 > w->cap) {
                         if (w->bounded) {
                             w->oom = 1; /* keep counting: the trusted caller reads the size */
                         } else {
-                            wr_grow(w, total);
+                            wr_grow(w, f_total);
                         }
                     }
                     if (w->oom) {
-                        w->len += total; /* keep counting: the caller fails on oom */
+                        w->len += f_total; /* keep counting: the caller fails on oom */
                     } else {
                         /* the fused write bypasses wr_put/wr_byte: keep
                          * the reservation honest (the #739 lane-1 law) */
-                        w->reserve = (size_t)total <= w->reserve ? w->reserve - (size_t)total : 0;
+                        w->reserve =
+                            (size_t)f_total <= w->reserve ? w->reserve - (size_t)f_total : 0;
                         char* q = w->p + w->len;
-                        if (nl) {
+                        if (f_nl) {
                             *q++ = '\n';
                         }
-                        for (uint32_t i = 0; i < ind; i++) {
+                        for (uint32_t i = 0; i < f_ind; i++) {
                             *q++ = ' ';
                         }
                         memcpy(q, kv.p, kv.len);
@@ -1165,7 +1241,7 @@ static void emit_block_map(yep_emitter* em, uint32_t id, int content_col) {
                             *q++ = ' ';
                             memcpy(q, vv.p, vv.len);
                         }
-                        w->len += total;
+                        w->len += f_total;
                         wr_maybe_flush(w);
                     }
                 }
@@ -1445,9 +1521,10 @@ static void emit_json_flow(yep_emitter* em, uint32_t id) {
         }
         if (map) {
             /* the one generic-path rule JSON keeps: a non-scalar key
-             * (or one carrying props) rides the explicit "? key : "
-             * form — same bytes emit_flow writes */
-            if (cn->anchor.len > 0 || cn->tag.len > 0 || cn->kind != 0) {
+             * rides the explicit "? key : " form — same bytes emit_flow
+             * writes. (Propertied scalar keys used to join it; JSON
+             * drops properties, so they ride the plain quoted form.) */
+            if (cn->kind != 0) {
                 wr_put(w, "? ", 2);
                 emit_json_node(em, child);
                 wr_put(w, " : ", 3);
@@ -1546,6 +1623,10 @@ typedef struct {
                  * 'I'-wrapped construct registers ONCE (at the 'I');
                  * its immediate inner must not add a second entry or
                  * every later '@' link shifts */
+    int depth;  /* mj_value recursion guard — the reader walks hostile
+                 * bytes, not Ruby's heap: nesting is unbounded in the
+                 * input, the stack is not (the parser's own
+                 * max_depth=1000 is the same law) */
 } mj_ctx;
 
 static int mj_fail(mj_ctx* c) {
@@ -1672,7 +1753,23 @@ static int mj_ivar_pairs(mj_ctx* c) {
 }
 
 /* stream-position-only walk: consumes one value, emits nothing */
+
+#define MJ_DEPTH_MAX 1000
+
+/* the discard twin rides the same budget (its 'I'/'['/'{' recursion is
+ * just as hostile-byte reachable) */
+static int mj_discard_value_inner(mj_ctx* c);
+
 static int mj_discard_value(mj_ctx* c) {
+    if (c->depth >= MJ_DEPTH_MAX)
+        return mj_fail(c);
+    c->depth++;
+    int rc = mj_discard_value_inner(c);
+    c->depth--;
+    return rc;
+}
+
+static int mj_discard_value_inner(mj_ctx* c) {
     unsigned char t;
     int rc = mj_byte(c, &t);
     if (rc != 0)
@@ -1771,7 +1868,20 @@ static int mj_emit_memo(mj_ctx* c, const mj_obj* o) {
     return 0;
 }
 
+static int mj_value_inner(mj_ctx* c);
+
+/* the wrapper owns the recursion budget: hostile bytes can nest arrays
+ * without bound, the stack cannot (the parser's max_depth=1000 law) */
 static int mj_value(mj_ctx* c) {
+    if (c->depth >= MJ_DEPTH_MAX)
+        return mj_fail(c);
+    c->depth++;
+    int rc = mj_value_inner(c);
+    c->depth--;
+    return rc;
+}
+
+static int mj_value_inner(mj_ctx* c) {
     unsigned char t;
     size_t tpos = c->s.at;
     int reg_idx = -1;
@@ -1838,7 +1948,9 @@ static int mj_value(mj_ctx* c) {
             unsigned char lo, hi;
             if (mj_byte(c, &lo) != 0 || mj_byte(c, &hi) != 0)
                 return -1;
-            v |= (int64_t)(lo | ((uint64_t)hi << 8)) << (16 * i);
+            /* shift in the unsigned domain: the signed form put
+             * 0xFFFF into the sign bit at limb 3 (UB, UBSan-flagged) */
+            v |= (int64_t)((uint64_t)(lo | ((uint64_t)hi << 8)) << (16 * i));
         }
         if (sign == 0x2d)
             v = -v;
@@ -1858,9 +1970,11 @@ static int mj_value(mj_ctx* c) {
         memcpy(tmp, c->s.p + c->s.at, tl);
         tmp[tl] = '\0';
         c->s.at += (size_t)len;
-        if (strcmp(tmp, "inf") == 0 || strcmp(tmp, "-inf") == 0 || strcmp(tmp, "nan") == 0)
-            return mj_fail(c); /* JSON has no inf/nan spelling */
         double d = strtod(tmp, NULL);
+        if (!isfinite(d))
+            return mj_fail(c); /* JSON has no inf/nan spelling — and a
+                                * strtod OVERFLOW ("1e999") produces
+                                * one from text that never spells it */
         char buf[40];
         int wl = yep_d2s_json(d, buf);
         wr_put(c->w, buf, (uint32_t)wl);

data/vendor/libyeptris/src/yeptris/encoding/transcode.c

@@ -95,6 +95,15 @@ static int yep_transcode_utf16(const yep_allocator* sys, int big_endian, const u
 static int yep_transcode_utf32(const yep_allocator* sys, int big_endian, const unsigned char* src,
                                size_t len, unsigned char** out, size_t* out_len, size_t* err_pos) {
     size_t units = len / 4;
+    if (len % 4 != 0) {
+        /* a dangling final unit is an error, not a silent truncation
+         * (the UTF-16 twin rejects its own; the header contract says
+         * truncated units error at the offending byte) */
+        if (err_pos != NULL) {
+            *err_pos = units * 4;
+        }
+        return -2;
+    }
     unsigned char* dst = yep_alloc(sys, len ? len : 1);
     if (dst == NULL) {
         return -1;

data/vendor/libyeptris/src/yeptris/events/capture.c

@@ -29,8 +29,14 @@ void yep_rec_free(yep_rec_store* s) {
     yep_rec_init(s);
 }
 
-static uint32_t arena_put(yep_rec_store* s, const char* p, uint32_t len) {
+/* Returns 0 ok / -1 OOM. On OOM the record is NOT committed (the
+ * caller unwinds before s->n++): the old drop-the-string form left
+ * value_len set with offset 0, so materialize read whatever string
+ * lived at the arena head - or past a NULL arena on first-alloc
+ * failure. */
+static int arena_put(yep_rec_store* s, const char* p, uint32_t len, uint32_t* off) {
     if (len == 0 || p == NULL) {
+        *off = 0;
         return 0;
     }
     if (s->arena_len + len > s->arena_cap) {
@@ -40,15 +46,15 @@ static uint32_t arena_put(yep_rec_store* s, const char* p, uint32_t len) {
         }
         char* na = realloc(s->arena, cap);
         if (na == NULL) {
-            return 0; /* OOM: the string is dropped, not fatal */
+            return -1;
         }
         s->arena = na;
         s->arena_cap = cap;
     }
     memcpy(s->arena + s->arena_len, p, len);
-    uint32_t off = (uint32_t)s->arena_len;
+    *off = (uint32_t)s->arena_len;
     s->arena_len += len;
-    return off;
+    return 0;
 }
 
 int yep_rec_on_event(void* ctx, const yep_event* ev) {
@@ -116,11 +122,17 @@ int yep_rec_on_event(void* ctx, const yep_event* ev) {
     r->col = ev->col;
     r->end_line = ev->end_line;
     r->end_col = ev->end_col;
-    r->value_off = arena_put(s, (const char*)ev->value.p, (uint32_t)ev->value.len);
+    if (arena_put(s, (const char*)ev->value.p, (uint32_t)ev->value.len, &r->value_off) != 0) {
+        return -1;
+    }
     r->value_len = (uint32_t)ev->value.len;
-    r->anchor_off = arena_put(s, (const char*)ev->anchor.p, (uint32_t)ev->anchor.len);
+    if (arena_put(s, (const char*)ev->anchor.p, (uint32_t)ev->anchor.len, &r->anchor_off) != 0) {
+        return -1;
+    }
     r->anchor_len = (uint32_t)ev->anchor.len;
-    r->tag_off = arena_put(s, (const char*)ev->tag.p, (uint32_t)ev->tag.len);
+    if (arena_put(s, (const char*)ev->tag.p, (uint32_t)ev->tag.len, &r->tag_off) != 0) {
+        return -1;
+    }
     r->tag_len = (uint32_t)ev->tag.len;
     s->n++;
     return 0;

data/vendor/libyeptris/src/yeptris/events/iterparse.c

@@ -161,7 +161,7 @@ YEPTRIS_API const YeptrisEvent* yeptris_iterparse_next(YeptrisIterparse it, size
         yep_engine_destroy(eng);
         if (rc == -1) {
             it->done = 1;
-            it->status = YEPTRIS_ERROR_PARSE;
+            it->status = err != NULL ? YEPTRIS_ERROR_PARSE : YEPTRIS_ERROR_MEMORY;
             if (it->store.n == 0) {
                 if (!it->emitted_stream_start) {
                     /* the engine emitted +STR before failing: match it */

data/vendor/libyeptris/src/yeptris/events/recorder.c

@@ -74,9 +74,13 @@ YEPTRIS_API YeptrisStatus yeptris_recorder_feed(YeptrisRecorder rec, const char*
         if (err != NULL) {
             rec->err_line = err->line;
             rec->err_col = err->col;
+            rec->status = YEPTRIS_ERROR_PARSE;
+        } else {
+            /* a clean error channel means the SINK failed: the capture
+             * ran out of memory, the bytes never were a parse error */
+            rec->status = YEPTRIS_ERROR_MEMORY;
         }
-        rec->final_fed = 1; /* a parse error kills the stream */
-        rec->status = YEPTRIS_ERROR_PARSE;
+        rec->final_fed = 1; /* a failed feed kills the stream */
         return rec->status;
     }
     rec->status = YEPTRIS_OK;

data/vendor/libyeptris/src/yeptris/marshal.c

@@ -291,8 +291,13 @@ static int psych_int_text(const char* p, uint32_t len) {
 }
 
 /* decimal text -> bignum limbs (base 2^16 LE), then Marshal's 'l':
- * sign + w_long(limb count) + limbs. 128 limbs = 2048 bits covers
- * ~616 decimal digits; longer texts stay Strings (pathological). */
+ * sign + w_long(limb count) + limbs. The gate (marshal_node: text
+ * under 1300 chars) bounds the digits at 1299 -> ceil(1299*log2(10)/16)
+ * = 270 limbs; the arrays are sized from that bound so no carry is
+ * ever dropped (the old 128-limb cap silently truncated 617..1299-digit
+ * values into wrong numbers). */
+#define E_BIGNUM_LIMBS_MAX 272
+
 static void e_bignum_text(E* e, const char* p, uint32_t len) {
     int neg = 0;
     if (p[0] == '-' || p[0] == '+') {
@@ -300,7 +305,7 @@ static void e_bignum_text(E* e, const char* p, uint32_t len) {
         p++;
         len--;
     }
-    uint16_t limbs[128];
+    uint16_t limbs[E_BIGNUM_LIMBS_MAX];
     memset(limbs, 0, sizeof(limbs));
     int nl = 1;
     for (uint32_t i = 0; i < len; i++) {
@@ -313,7 +318,7 @@ static void e_bignum_text(E* e, const char* p, uint32_t len) {
             limbs[j] = (uint16_t)(t & 0xffffu);
             carry = t >> 16;
         }
-        while (carry != 0 && nl < 128) {
+        while (carry != 0 && nl < E_BIGNUM_LIMBS_MAX) {
             limbs[nl++] = (uint16_t)(carry & 0xffffu);
             carry >>= 16;
         }
@@ -324,7 +329,7 @@ static void e_bignum_text(E* e, const char* p, uint32_t len) {
     e_byte(e, 'l');
     e_byte(e, neg ? '-' : '+');
     e_long(e, nl);
-    unsigned char b[256];
+    unsigned char b[E_BIGNUM_LIMBS_MAX * 2];
     for (int i = 0; i < nl; i++) {
         b[2 * i] = (unsigned char)(limbs[i] & 0xff);
         b[2 * i + 1] = (unsigned char)(limbs[i] >> 8);

data/vendor/libyeptris/src/yeptris/memory/arena.c

@@ -85,6 +85,14 @@ void* yep_arena_alloc(yep_arena* arena, size_t size, size_t align) {
     if (arena == NULL || size == 0 || !yep_align_ok(align)) {
         return NULL;
     }
+    /* a hostile size near SIZE_MAX must FAIL the fit test, not wrap
+     * start+size past the pointer space and pass it (the sizing sums
+     * below stay inside the guard's slack) */
+    if (size > (SIZE_MAX - align) / 2) {
+        /* half the pointer space: both the fit test's start+size and
+         * the new-block payload sums stay wrap-free below this */
+        return NULL;
+    }
 
     yep_arena_block* b = arena->head;
     uintptr_t base = (uintptr_t)b + sizeof(yep_arena_block);

data/vendor/libyeptris/src/yeptris/memory/pool.c

@@ -43,6 +43,13 @@ void* yep_pool_alloc(yep_pool* pool, size_t size, size_t align) {
     if (pool == NULL || size == 0 || !yep_align_ok(align)) {
         return NULL;
     }
+    /* mirror of the arena guard: the fit test's start+size and the
+     * payload sums must not wrap on a hostile size */
+    if (size > (SIZE_MAX - align) / 2) {
+        /* half the pointer space: both the fit test's start+size and
+         * the new-block payload sums stay wrap-free below this */
+        return NULL;
+    }
 
     yep_block* b = pool->head;
     if (b == NULL) { /* the lazy first block (#157) */