yeptris 0.6.56.1-arm-linux-eabihf → 0.6.57.1-arm-linux-eabihf

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92277802904cb56365eae27dfc3929fcbeceec3db850dbc95138127b3990f715
-  data.tar.gz: cf8b22137e0eea5536a25bbc9fa702ead3a939fea02681256632ee2041fd173f
+  metadata.gz: 2ff669641748a920b861c211a4acdcd175c18f0be28b2d917fd81ddcbee85012
+  data.tar.gz: df7abbc39687b9d532cd8e49d64c8bb738102dea0b18bb486639933616b2f4de
 SHA512:
-  metadata.gz: 5805c0315c67b0b3db2fc87575d39dc61a7c5f906a265bd580c22b6ec74bb349e9a7df8efbfaf8ff70f88505c6b58777ec6bf5598ece063c94b9cf3e5f5d4edd
-  data.tar.gz: 467fc637747e2249e18ee22dda61a58ed475ebaede6f4196c6f9f4e3b905105f0813e4ad55e481ee280ba767c6f28e067bc859e896e2b5bc4938df8f587c3a87
+  metadata.gz: 621f9036c39cef1b661382ea245ee40ff1f9a1134199888475697b7e54f63f83887f3abecb4f370d23f45bc74d3f4ba110b47fca676f328bb045113764a5b620
+  data.tar.gz: acf1b5c5ff2025e0885d2b302074f9b327bde962ba943809bc361212d444f839c89916d1b09576d1a9d8a90f759279eef67740ebcdaa6fe585a3e331ec0855b0

data/ext/yeptris_native/version.h

@@ -11,8 +11,8 @@
 
 #define YEPTRIS_VERSION_MAJOR 0
 #define YEPTRIS_VERSION_MINOR 6
-#define YEPTRIS_VERSION_PATCH 56
-#define YEPTRIS_VERSION_STRING "0.6.56"
+#define YEPTRIS_VERSION_PATCH 57
+#define YEPTRIS_VERSION_STRING "0.6.57"
 
 #ifdef __cplusplus
 extern "C" {

data/lib/yeptris/psych/visitors.rb

@@ -437,6 +437,10 @@ module Yeptris
           when /\A!ruby\/object(?::(.+))?\z/
             klass = resolve_class(Regexp.last_match(1).to_s)
             revive_object(klass, node)
+          when /\A!ruby\/hash:(.+)\z/
+            revive_hash_class(resolve_class(Regexp.last_match(1)), node)
+          when /\A!ruby\/exception(?::(.*))?\z/
+            revive_exception(resolve_class(Regexp.last_match(1).to_s), node)
           else
             # Psych.load_tags first (the class registry, #95 bug 4);
             # anything else stays the plain mapping
@@ -452,9 +456,13 @@ module Yeptris
         # key's SHAPE decides (an explicit !!str '<<' is a literal key,
         # not a merge), the VALUE's node kind picks the arm, and every
         # merge is TypeError-guarded (a bad element keeps the whole
-        # '<<' pair literal — merges are all-or-nothing).
-        def hash_into(h, node)
-          anchors[node.anchor] = h if node.anchor
+        # '<<' pair literal — merges are all-or-nothing). The anchor
+        # registrant is the receiver by default; the object revivals
+        # pass the revived OBJ (psych's revive(): the object itself is
+        # registered before the children walk, so an alias inside an
+        # ivar pointing back at the object resolves to it).
+        def hash_into(h, node, anchor: nil)
+          anchors[node.anchor] = (anchor || h) if node.anchor
           node.children.each_slice(2) do |k, v|
             key = visit(k)
             val = visit(v)
@@ -502,29 +510,124 @@ module Yeptris
         end
 
         def revive_object(klass, node)
-          # bare !ruby/object (no class): Psych.dump(Object.new)'s form.
-          # An Object has no declared state — allocation is the whole
-          # revival (no reflection, no protocol needed).
-          return ::Object.allocate if klass.nil?
+          obj = klass ? klass.allocate : ::Object.allocate
+          # psych's revive(): the object registers BEFORE the children
+          # walk — an alias inside the state pointing back at the
+          # object resolves to it (identity through ivars)
+          anchors[node.anchor] = obj if node.anchor
 
-          raise ::Yeptris::DumpError, "#{klass} is not Yeptris::Psych::Encodable: implement init_with(coder)" unless klass <= ::Yeptris::Psych::Encodable
+          if klass
+            # The yeptris encoder's format (visit_encode_with): the
+            # Encodable protocol rides the __init__ marker, so the
+            # state passes back through init_with(coder) without
+            # library-side ivar reflection. The format decides on the
+            # RAW key before any value is visited (the old walk's
+            # shape; sibling values stay untouched when it fires).
+            init = nil
+            node.children.each_slice(2) do |k, v|
+              init = v if k.to_ruby.to_s == "__init__"
+            end
+            if init
+              unless klass <= ::Yeptris::Psych::Encodable
+                raise ::Yeptris::DumpError,
+                      "#{klass} is not Yeptris::Psych::Encodable: implement init_with(coder)"
+              end
 
-          obj = klass.allocate
-          anchors[node.anchor] = obj if node.anchor
-          # The class opts in via init_with(coder); the encoder wrote
-          # `coder["__init__"] = the mapping` so we can pass it back
-          # without library-side ivar reflection.
+              coder = ::Yeptris::Psych::CoderShim.new
+              if init.is_a?(::Yeptris::Psych::Nodes::Mapping)
+                init.children.each_slice(2) do |ck, cv|
+                  coder[ck.to_ruby.to_s] = visit(cv)
+                end
+              end
+              obj.init_with(coder)
+              return obj
+            end
+          end
+
+          # stdlib psych's format (visit_Object + dump_ivars): the
+          # mapping's own top-level pairs ARE the object state —
+          # revives through init_with when the class defines it, ivar
+          # assignment otherwise. THE AUDIT FIX: the __init__-only
+          # walk silently dropped the ivars of every stdlib
+          # Psych.dump-produced document.
+          init_with_state(obj, hash_into({}, node, anchor: obj), node)
+          obj
+        end
+
+        # !ruby/hash:K (stdlib visit_Hash of a Hash subclass): the
+        # SUBCLASS allocates and the mapping's own pairs fill it
+        # (merge keys included, hash_into semantics). A name that
+        # resolves to a non-Hash raises stdlib resolve_subclass's
+        # ArgumentError; an unresolvable name stays a plain Hash (the
+        # resolve_class-returns-nil convention this binding already
+        # applies to !ruby/object and !ruby/struct — safe_load raises
+        # DisallowedClass for it first).
+        def revive_hash_class(klass, node)
+          if klass
+            unless klass <= ::Hash
+              raise ::ArgumentError, "Invalid tag: expected a subclass of Hash, got #{klass}"
+            end
+
+            h = klass.allocate
+          else
+            h = {}
+          end
+          anchors[node.anchor] = h if node.anchor
+          hash_into(h, node)
+          h
+        end
+
+        # !ruby/exception[:K] (stdlib visit_Exception + build_exception):
+        # the message rides the exception's own construction surface
+        # (Class#exception — psych's C build_exception writes the
+        # engine-internal mesg slot on an allocated instance, which
+        # Ruby-level ivar assignment cannot reach: message would stay
+        # the class name), backtrace is consumed if present, and every
+        # other pair lands as ivars (message/backtrace excepted — they
+        # name the exception's own surface, not object state). Bare
+        # !ruby/exception rides ::Exception (psych's class_loader
+        # exception fallback). A subclass whose initialize refuses a
+        # message argument constructs bare — same fallback psych's
+        # Ruby-side build_exception carried before the C move.
+        def revive_exception(klass, node)
+          h = {}
           node.children.each_slice(2) do |k, v|
-            key = k.to_ruby.to_s
-            next unless key == "__init__"
+            h[visit(k)] = visit(v)
+          end
+          mesg = h.delete("message")
+          e = build_exception(klass || ::Exception, mesg)
+          anchors[node.anchor] = e if node.anchor
+          e.set_backtrace(h.delete("backtrace")) if h.key?("backtrace")
+          init_with_state(e, h, node)
+          e
+        end
 
+        def build_exception(klass, mesg)
+          return klass.exception if mesg.nil?
+
+          begin
+            klass.exception(mesg)
+          rescue ::ArgumentError, ::TypeError
+            klass.exception
+          end
+        end
+
+        # psych's init_with: a class defining init_with takes the coder
+        # (the raw pair map, coder.tag = the mapping's tag); everything
+        # else — bare Object included — takes the pairs as ivars. Keys
+        # are @-normalized both ways: stdlib DUMPS the ivars @-stripped
+        # (yaml_tree's dump_ivars), older psych and hand-written docs
+        # spell them WITH the @ — both map to the same ivar.
+        def init_with_state(obj, h, node)
+          if obj.respond_to?(:init_with)
             coder = ::Yeptris::Psych::CoderShim.new
-            if v.is_a?(::Yeptris::Psych::Nodes::Mapping)
-              v.children.each_slice(2) do |ck, cv|
-                coder[ck.to_ruby.to_s] = visit(cv)
-              end
-            end
+            coder.tag = node.tag
+            h.each { |k, v| coder[k] = v }
             obj.init_with(coder)
+          else
+            h.each do |k, v|
+              obj.instance_variable_set(:"@#{k.to_s.sub(/\A@/, "")}", v)
+            end
           end
           obj
         end

data/lib/yeptris/psych.rb

@@ -208,11 +208,14 @@ module Yeptris
 
       def safe_load(yaml, permitted_classes: [::Date, ::Time], aliases: false,
                     symbolize_names: false, **)
+        # ONE read at the boundary (read_input): IO-like input must be
+        # consumed once — the string rides parse AND the slice below
+        source = ::Yeptris.read_input(yaml)
         begin
-          doc = Yeptris::Document.parse(yaml, schema: :compat_11)
+          doc = Yeptris::Document.parse(source, schema: :compat_11)
           return nil if doc.nil? # the legal empty stream
 
-          res = force_utf8_scalars(walk_safe(doc.root(0), permitted_classes, aliases))
+          res = force_utf8_scalars(walk_safe(doc.root(0), permitted_classes, aliases, source))
           res = deep_symbolize_keys(res) if symbolize_names
           res
         rescue ::Yeptris::ParseError => e
@@ -290,23 +293,78 @@ module Yeptris
         ::Yeptris::Psych.dump(obj, io, options)
       end
 
-      def load_stream(yaml, **kwargs, &block)
-        # materialize each document's root directly — the stream
-        # children share one C document, so their handles would all
-        # resolve to the first document's tree. stdlib's block form
-        # yields each loaded document's object (#179 round 4).
-        doc = Yeptris::Document.parse(yaml, schema: :compat_11)
-        return nil if doc.nil? # the legal empty stream
-
-        begin
-          docs = (0...doc.document_count).map { |i| doc.root(i).to_ruby }
-        ensure
-          doc.free
+      # stdlib's load_stream (yeptris#881): every document of the
+      # stream, in order — the block form yields each loaded document.
+      # The engine's stream parse drives the boundaries (--- / ... /
+      # implicit documents after a ...); empty documents are nil
+      # elements, exactly what stdlib yields.
+      #
+      # errors: :raise (default) re-raises a bad document as stdlib's
+      # family — Psych::SyntaxError (parse() translates the same way).
+      # errors: :collect never raises for a bad document: the stream
+      # re-walks at marker boundaries (Yeptris::YAML._stream_slices)
+      # through this face's own DOM materialization, and the bad
+      # document's position carries the SyntaxError marker.
+      def load_stream(yaml, errors: :raise, **kwargs, &block)
+        unless %i[raise collect].include?(errors)
+          raise ArgumentError, "errors: must be :raise or :collect (got #{errors.inspect})"
         end
+
+        # once, up front: the collect fallback re-parses this text and
+        # an IO input would already be at EOF by then
+        yaml = ::Yeptris.read_input(yaml).to_s
+        docs =
+          begin
+            # materialize each document's root directly — the stream
+            # children share one C document, so their handles would all
+            # resolve to the first document's tree. stdlib's block form
+            # yields each loaded document's object (#179 round 4).
+            doc = ::Yeptris::Document.parse(yaml, schema: :compat_11)
+            if doc.nil?
+              # the legal empty stream: stdlib answers a stream object
+              # with no children; the array face answers []
+              []
+            else
+              begin
+                (0...doc.document_count).map { |i| doc.root(i).to_ruby }
+              ensure
+                doc.free
+              end
+            end
+          rescue ::Yeptris::ParseError => e
+            # stdlib's family for a bad document (parse() translates
+            # the same way); in collect mode the bad document's
+            # position carries the SyntaxError marker instead
+            raise SyntaxError.from_parse_error(e) if errors != :collect
+
+            _collect_stream(yaml)
+          end
         docs.each { |d| block.call(d) } if block
         docs
       end
 
+      # The errors: :collect fallback: parse the marker-boundary
+      # slices through this face's own DOM materialization; a failed
+      # slice's position carries the SyntaxError marker.
+      def _collect_stream(yaml)
+        results = []
+        ::Yeptris::YAML._stream_slices(yaml).each do |slice|
+          begin
+            doc = ::Yeptris::Document.parse(slice, schema: :compat_11)
+            next if doc.nil?
+
+            begin
+              (0...doc.document_count).each { |i| results << doc.root(i).to_ruby }
+            ensure
+              doc.free
+            end
+          rescue ::Yeptris::ParseError => e
+            results << SyntaxError.from_parse_error(e)
+          end
+        end
+        results
+      end
+
       # safe_load_stream: stdlib's surface — the stream form of
       # safe_load. Our load_stream is already safe-by-default
       # (Psych 5 semantics), so this is the yielding wrapper.
@@ -406,7 +464,25 @@ module Yeptris
       # class outside the permitted set raises too (issue #69: a
       # compat_11 date must not become a Date unless Date is
       # permitted — Psych::DisallowedClass semantics).
-      def walk_safe(root, permitted, aliases_enabled)
+      #
+      # The single-pass slice (#862): the gate walk IS the cost —
+      # per-node FFI reads. Three provable facts retire it for clean
+      # documents: the parser cannot build an alias without a `*`
+      # byte in the source, cannot build an explicit tag without a
+      # `!` byte, and the marshal builder REFUSES timestamps and
+      # merge keys (its success proves none exist — every
+      # timestamp-typed shape is refused, verified per shape). So
+      # `marshal_fast` doubles as the probe AND the build in one C
+      # call: on a gate-free source its success proves check() could
+      # not have raised, and the walk disappears; a refusal or a gate
+      # byte falls back to the checked walk, which is byte-for-byte
+      # the old path.
+      def walk_safe(root, permitted, aliases_enabled, source = nil)
+        if root && !source.nil? &&
+           !source.include?("*") && !source.include?("!")
+          fast = root.marshal_fast
+          return fast unless fast.nil?
+        end
         check(root, permitted, aliases_enabled) if root
         root.to_ruby
       end

data/lib/yeptris/yaml.rb

@@ -44,11 +44,100 @@ module Yeptris
       Psych.safe_load(yaml.to_s, permitted_classes: permitted_classes, aliases: aliases)
     end
 
-    # Every document in the stream, in order.
-    def load_stream(yaml, schema: :compat_11)
+    # Every document in the stream, in order (the multi-document stream
+    # API, yeptris#881 — Psych's load_stream parity). Document boundary
+    # detection follows the engine's stream parse: explicit --- / ...
+    # markers, implicit documents after a ... terminator, and empty
+    # documents — nil elements, exactly what Psych yields for them.
+    #
+    # errors: :raise (default) raises Yeptris::ParseError on the first
+    # bad document — psych's behavior (a stream parse cannot resume
+    # past it). errors: :collect never raises for a bad document: the
+    # text re-walks at marker boundaries (see _stream_slices) and the
+    # bad document's position carries a Yeptris::ParseError marker
+    # (skip with results.grep(Yeptris::ParseError)). A stream that
+    # parses whole collects to the same plain document array as :raise.
+    #
+    # With a block, every element — documents and, under :collect,
+    # error markers — is yielded in order; the array is returned.
+    def load_stream(yaml, schema: :compat_11, errors: :raise, &block)
+      unless %i[raise collect].include?(errors)
+        raise ArgumentError, "errors: must be :raise or :collect (got #{errors.inspect})"
+      end
+
       yaml = Yeptris.read_input(yaml)
       yaml = yaml.to_s
-      _drain_all(yaml, schema)
+      docs =
+        begin
+          docs = _drain_all(yaml, schema)
+          # The value drain emits a nil record even for a stream with
+          # ZERO documents ("", a blank line, a comment) — stdlib's
+          # load_stream answers zero documents there, and the corner
+          # must not mask a real empty document ("---\n" IS [nil]).
+          # Only the [nil] shape needs the discriminating DOM count,
+          # so the good path pays nothing.
+          if docs == [nil]
+            doc = Document.parse(yaml, schema: schema)
+            docs = [] if doc.nil? || doc.document_count.zero?
+            doc&.free
+          end
+          docs
+        rescue ParseError
+          raise if errors != :collect
+
+          _collect_stream(yaml, schema)
+        end
+      docs.each { |d| block.call(d) } if block
+      docs
+    end
+
+    # A column-0 --- / ... marker line. A real document boundary in
+    # every valid YAML stream (block/scalar content can never carry one
+    # unindented), so the scan is exact — it never splits inside a
+    # document. Marker-less boundaries (implicit documents after a
+    # ...) stay INSIDE their slice, and each slice parses through the
+    # full stream face, so nothing is lost there either. Slices keep
+    # their marker lines so every slice parses standalone. Used only by
+    # the errors: :collect fallback — a stream that parses whole never
+    # splits (the fallback's lossy cases are the whole reason #881
+    # exists; the good path must stay exact).
+    STREAM_MARKER = /\A(?:---|\.\.\.)(?:[ \t]|\r?\n|\z)/
+
+    # The marker-delimited slices of a stream. A slice that began at a
+    # marker line always survives (a trailing bare `---` is an empty
+    # document — nil, like psych yields); only a comments/blank-only
+    # leading prefix (no document) drops.
+    def _stream_slices(yaml)
+      slices = []
+      current = +""
+      markered = false
+      yaml.each_line do |line|
+        if line.match?(STREAM_MARKER)
+          slices << current if markered || !current.strip.empty?
+          current = line.dup
+          markered = true
+        else
+          current << line
+        end
+      end
+      slices << current if markered || !current.strip.empty?
+      slices
+    end
+
+    # The errors: :collect fallback: parse marker-boundary slices
+    # through the full stream face; a failed slice's position carries
+    # the ParseError. Documents before the bad one still load — the
+    # per-document rescue-and-skip contract, centralized.
+    def _collect_stream(yaml, schema)
+      results = []
+      _stream_slices(yaml).each do |slice|
+        begin
+          results.concat(_drain_all(slice, schema))
+        rescue ParseError => e
+          results << e
+        end
+      end
+      results
     end
 
     # The Marshal fast path when the loaded libyeptris has it (>= 0.1.11

data/lib/yeptris.rb

@@ -3,7 +3,7 @@
 module Yeptris
   # The gem's version lives in the parent namespace's file — the last
   # internal require (yeptris/version) retired with it.
-  VERSION = "0.6.56.1".freeze
+  VERSION = "0.6.57.1".freeze
 
   # Informational notices are OPT-IN (yeptris-ruby#217): consumers
   # embed yeptris inside CLIs that assert clean stderr, and a

data/vendor/libyeptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(yeptris
-    VERSION 0.6.56
+    VERSION 0.6.57
     DESCRIPTION "Ultra-fast YAML 1.2 parser, emitter and streamer in C"
     LANGUAGES C CXX
 )

data/vendor/libyeptris/src/include/yeptris/events.h

@@ -141,6 +141,13 @@ YEPTRIS_API YeptrisStatus yeptris_recorder_feed(YeptrisRecorder rec, const char*
  * the next feed; reset at every feed entry (drain per chunk). */
 YEPTRIS_API const YeptrisEventRecord* yeptris_recorder_records(YeptrisRecorder rec, size_t* count);
 YEPTRIS_API const char* yeptris_recorder_arena(YeptrisRecorder rec, size_t* len);
+
+/* Status of the last feed with its 1-based error position (0 = the
+ * failure carries no position, e.g. a capture allocation failure).
+ * Mirror of yeptris_pull_status / yeptris_iterparse_status. */
+YEPTRIS_API YeptrisStatus yeptris_recorder_status(const YeptrisRecorder rec, uint32_t* line,
+                                                  uint32_t* col);
+
 YEPTRIS_API void yeptris_recorder_free(YeptrisRecorder rec);
 
 /* ---- iterparse -------------------------------------------------------- */

data/vendor/libyeptris/src/yeptris/dom/dom.c

@@ -26,16 +26,35 @@ static int cap_arena(const yep_dom* d, uint32_t need) {
     return d->input_len == 0 || (size_t)(d->str_len + need) <= d->input_len * 128 + (1u << 20);
 }
 
+/* Doubling with the uint32 ceiling (the audit's wrap finding): the old
+ * `while (cap < target) cap *= 2` wrapped to 0 and span forever once a
+ * cap crossed 2^31 with a target above it. A cap that cannot double
+ * inside uint32 — or a target past the 32-bit space at all — is an
+ * alloc failure, never a wrapped capacity. */
+static int dom_cap_next(uint32_t cap, size_t target, uint32_t* out) {
+    if (target > UINT32_MAX) {
+        return 0;
+    }
+    while (cap < target) {
+        if (cap > UINT32_MAX / 2) {
+            return 0;
+        }
+        cap *= 2;
+    }
+    *out = cap;
+    return 1;
+}
+
 int dom_grow_nodes(yep_dom* d, uint32_t need) {
-    if (d->ncount + need <= d->ncap) {
+    if ((size_t)d->ncount + need <= d->ncap) {
         return 1;
     }
     if (!cap_nodes(d)) {
         return 0;
     }
-    uint32_t ncap = d->ncap ? d->ncap * 2 : 64;
-    while (ncap < d->ncount + need) {
-        ncap *= 2;
+    uint32_t ncap;
+    if (!dom_cap_next(d->ncap ? d->ncap : 64, (size_t)d->ncount + need, &ncap)) {
+        return 0;
     }
     yep_dnode* nd = yep_pool_alloc(d->pool, (size_t)ncap * sizeof(yep_dnode), 16);
     if (nd == NULL) {
@@ -50,15 +69,15 @@ int dom_grow_nodes(yep_dom* d, uint32_t need) {
 }
 
 int dom_grow_docs(yep_dom* d, uint32_t need) {
-    if (d->dcount + need <= d->dcap) {
+    if ((size_t)d->dcount + need <= d->dcap) {
         return 1;
     }
     if (d->input_len != 0 && (size_t)d->dcount > d->input_len / 2 + 16) {
         return 0;
     }
-    uint32_t ncap = d->dcap ? d->dcap * 2 : 16;
-    while (ncap < d->dcount + need) {
-        ncap *= 2;
+    uint32_t ncap;
+    if (!dom_cap_next(d->dcap ? d->dcap : 16, (size_t)d->dcount + need, &ncap)) {
+        return 0;
     }
     uint32_t* nd = yep_pool_alloc(d->pool, (size_t)ncap * sizeof(uint32_t), 16);
     if (nd == NULL) {
@@ -75,15 +94,15 @@ int dom_grow_docs(yep_dom* d, uint32_t need) {
 /* Doubles the arena until cap bytes fit; 0 on OOM. Offsets stored in
  * nodes stay valid across the move. */
 static int str_grow(yep_dom* d, uint32_t need) {
-    if (d->str_len + need <= d->str_cap) {
+    if ((size_t)d->str_len + need <= d->str_cap) {
         return 1;
     }
     if (!cap_arena(d, need)) {
         return 0;
     }
-    uint32_t cap = d->str_cap ? d->str_cap : 256;
-    while (cap < d->str_len + need) {
-        cap *= 2;
+    uint32_t cap;
+    if (!dom_cap_next(d->str_cap ? d->str_cap : 256, (size_t)d->str_len + need, &cap)) {
+        return 0;
     }
     char* ns = yep_alloc(d->sys, cap);
     if (ns == NULL) {
@@ -100,8 +119,15 @@ static int str_grow(yep_dom* d, uint32_t need) {
 
 yep_sview yep_dom_str_put(yep_dom* d, const char* p, uint32_t len) {
     yep_sview sv = {YEP_SV_INPUT, 0}; /* empty: arena offset 0 */
-    if (len == 0 || !str_grow(d, len)) {
-        return sv; /* len 0 or OOM: empty view */
+    if (len == 0) {
+        return sv;
+    }
+    if (!str_grow(d, len)) {
+        /* OOM: an empty view here would silently corrupt the document
+         * (the value reads as ""). Record it; dom_place/dom_open_node
+         * fail the parse with the memory status. */
+        d->oom = 1;
+        return sv;
     }
     memcpy(d->str + d->str_len, p, len);
     sv.off = YEP_SV_INPUT | d->str_len;
@@ -172,6 +198,11 @@ uint32_t dom_open_node(yep_dom* d, uint8_t kind, const yep_view* tag, const yep_
     n->kind = kind;
     n->tag = dom_str_in(d, tag, 0);
     n->anchor = dom_str_in(d, anchor, anchor_borrowed);
+    if (d->oom) {
+        /* the tag/anchor arena write failed: refuse the node (the slot
+         * is uncommitted — the next open re-initializes it) */
+        return UINT32_MAX;
+    }
     n->style = style;
     n->implicit = implicit;
     n->flow = flow;
@@ -213,8 +244,8 @@ static int dom_anchor_set(yep_dom* d, uint32_t ordinal, uint32_t node) {
                 cap = sized;
             }
         }
-        while (cap < ordinal) {
-            cap *= 2;
+        if (!dom_cap_next(cap, ordinal, &cap)) {
+            return -1; /* the wrap-checked doubling (audit round 5) */
         }
         uint32_t* na = yep_alloc(d->sys, cap * sizeof(*na));
         if (na == NULL) {
@@ -271,9 +302,9 @@ static int dom_mut_grow(yep_dom* d, uint32_t need) {
     if (need <= d->mut_tbl_cap) {
         return 1;
     }
-    uint32_t cap = d->mut_tbl_cap ? d->mut_tbl_cap : 64;
-    while (cap < need) {
-        cap *= 2;
+    uint32_t cap;
+    if (!dom_cap_next(d->mut_tbl_cap ? d->mut_tbl_cap : 64, need, &cap)) {
+        return 0; /* the wrap-checked doubling (audit round 5) */
     }
     uint8_t* na = yep_alloc(d->sys, (size_t)cap / 8 + 1);
     uint16_t* nd = yep_alloc(d->sys, (size_t)cap * sizeof(uint16_t));
@@ -335,8 +366,13 @@ void dom_mut_set_depth(yep_dom* d, uint32_t id, uint16_t depth) {
 }
 
 /* Places a completed node: value for a pending key, child of the top
- * collection, or document root. */
+ * collection, or document root. Every builder path ends here, so it is
+ * also the OOM choke: an arena write that failed (d->oom) must fail
+ * the node, never leave a silently-empty value in the tree. */
 int dom_place(yep_dom* d, uint32_t id) {
+    if (d->oom) {
+        return -1;
+    }
     if (d->depth == 0) {
         if (!dom_grow_docs(d, 1)) {
             return -1;

data/vendor/libyeptris/src/yeptris/dom/dom.h

@@ -119,6 +119,11 @@ typedef struct yep_dom {
      * OFFSETS into it, so growth never dangles (dom_str_put) */
     char* str;
     uint32_t str_len, str_cap;
+    /* an arena write failed (str_put under OOM): the value would have
+     * silently become the empty view — doc corruption. Sticky; every
+     * builder path checks it at dom_place/dom_open_node and fails the
+     * parse with the memory status. */
+    int oom;
     const char* input_base; /* borrowed parse input (offset base) */
     /* handle arena: thread-safe (atomic bump) — query APIs allocate
      * YeptrisNode wrappers here, so read-only document sharing across

data/vendor/libyeptris/src/yeptris/events/iterparse.c

@@ -11,12 +11,20 @@
 
 #include "../../include/yeptris/events.h"
 #include "../common/simd_text.h"
+#include "../encoding/encoding.h"
+#include "../memory/allocator.h"
 #include "../parse/engine.h"
 #include "capture.h"
 
 typedef struct {
     yep_rec_store* store;
     int doc_ends; /* DOCUMENT_END events seen this run */
+    int oom;      /* the capture failed: yep_rec_on_event returned
+                   * nonzero — the engine's rc (-2) is shared with the
+                   * normal document-abort, so without this bit an OOM
+                   * was indistinguishable from doc-complete and the
+                   * final event vanished silently (the audit's
+                   * finding) */
 } yep_iter_sink;
 
 static int iter_on_event(void* ctx, const yep_event* ev) {
@@ -31,6 +39,7 @@ static int iter_on_event(void* ctx, const yep_event* ev) {
     }
     int rc = yep_rec_on_event(s->store, ev);
     if (rc != 0) {
+        s->oom = 1;
         return rc;
     }
     if (s->doc_ends >= 1) {
@@ -44,6 +53,11 @@ struct yeptris_iterparse {
     size_t len;
     size_t cursor;
     int done;
+    int gated;            /* the encoding front-end ran once: after it, buf
+                           * indexes the space every engine run's pos lives
+                           * in (the resume arithmetic requires it) */
+    unsigned char* owned; /* UTF-16/32 transcode output (buf moved) */
+    char* norm;           /* NEL/LS/PS-normalized copy (buf moved) */
     int emitted_stream_start;
     int pending_stream_end; /* deliver a final lone STREAM_END slice */
     YeptrisStatus status;
@@ -76,6 +90,55 @@ YEPTRIS_API const YeptrisEvent* yeptris_iterparse_next(YeptrisIterparse it, size
         return NULL;
     }
     for (;;) {
+        /* the encoding front-end, ONCE (the yep_engine_run law): the
+         * resume arithmetic below adds the engine's pos to it->cursor,
+         * and pos lives in the buffer space the RUN parsed — never the
+         * raw bytes. The front-end's consumed prefix broke that twice:
+         * the BOM it strips (pos cannot see it, so a BOM'd stream
+         * re-parsed the previous document's tail), and the UTF-16/32
+         * transcode (pos counts UTF-8 bytes, cursor counts raw ones —
+         * slices corrupted). The NEL/LS/PS break normalizer inside the
+         * run shifts pos the same way, so the gate owns both: encode
+         * to UTF-8 and normalize here, move buf, and the spaces agree. */
+        if (!it->gated) {
+            it->gated = 1;
+            const yep_allocator* sys = yep_system_allocator();
+            yep_encoding enc = YEP_ENC_UNKNOWN;
+            size_t bom = yep_bom_sniff((const unsigned char*)it->buf, it->len, &enc);
+            if (enc == YEP_ENC_UTF16LE || enc == YEP_ENC_UTF16BE || enc == YEP_ENC_UTF32LE ||
+                enc == YEP_ENC_UTF32BE) {
+                size_t tlen = 0;
+                size_t terr = 0;
+                int rc = yep_transcode_to_utf8(sys, enc, (const unsigned char*)it->buf + bom,
+                                               it->len - bom, &it->owned, &tlen, &terr);
+                if (rc != 0) {
+                    it->done = 1;
+                    it->status = YEPTRIS_ERROR_ENCODING;
+                    it->err_line = 1;
+                    it->err_col = 1;
+                    return NULL;
+                }
+                /* the copy IS the post-gate buffer: it opens at the
+                 * first content byte (the mark never entered it), so
+                 * cursor restarts at zero — keeping `bom` here skipped
+                 * the copy's first unit and corrupted the first slice */
+                it->buf = (const char*)it->owned;
+                it->len = tlen;
+                it->cursor = 0;
+            } else {
+                it->cursor = bom; /* the mark is the front-end's prefix */
+            }
+            size_t nlen = 0;
+            int kept_raw = 0;
+            char* norm = yep_engine_normalize_breaks(sys, it->buf + it->cursor,
+                                                     it->len - it->cursor, &nlen, &kept_raw);
+            if (norm != NULL) {
+                it->norm = norm;
+                it->buf = norm;
+                it->len = nlen;
+                it->cursor = 0; /* the copy starts at its own zero */
+            }
+        }
         if (it->done && it->pending_stream_end && it->next >= it->store.n) {
             it->pending_stream_end = 0;
             if (!it->emitted_stream_start) {
@@ -133,7 +196,7 @@ YEPTRIS_API const YeptrisEvent* yeptris_iterparse_next(YeptrisIterparse it, size
          * document's start on the resumed run */
         yep_rec_reset(&it->store);
         it->next = 0;
-        yep_iter_sink s = {&it->store, 0};
+        yep_iter_sink s = {&it->store, 0, 0};
         yep_engine* eng = yep_engine_create(yep_system_allocator());
         if (eng == NULL) {
             it->done = 1;
@@ -153,15 +216,39 @@ YEPTRIS_API const YeptrisEvent* yeptris_iterparse_next(YeptrisIterparse it, size
         yep_engine_prepare(eng, &pst);
         int rc = yep_engine_run(eng, it->buf + it->cursor, it->len - it->cursor, &sink);
         size_t pos = yep_engine_pos(eng);
-        const yep_error* err = yep_engine_error(eng);
-        if (rc == -1 && err != NULL) {
-            it->err_line = err->line;
-            it->err_col = err->col;
+        /* the error slot lives inside the engine and destroy munmaps it
+         * (glibc serves the ~260KB engine with mmap): copy the verdict
+         * out BEFORE the free */
+        yep_err_code err_code = YEP_ERR_NONE;
+        uint32_t err_line = 0, err_col = 0;
+        {
+            const yep_error* err = yep_engine_error(eng);
+            if (err != NULL) {
+                err_code = err->code;
+                err_line = err->line;
+                err_col = err->col;
+            }
         }
         yep_engine_destroy(eng);
-        if (rc == -1) {
+        /* A failed run with a SET channel is a parse-class error and the
+         * CODE picks the public status; a failed run with a CLEAN
+         * channel is the capture sink dying — memory, never a parse
+         * error, and never a silent stream end (the old code fell into
+         * the doc-complete arm on rc == -2 and the final event
+         * vanished). The abort (rc == -2 without s.oom) stays the
+         * normal per-document completion. */
+        int failed = rc == -1 || s.oom;
+        if (failed) {
             it->done = 1;
-            it->status = err != NULL ? YEPTRIS_ERROR_PARSE : YEPTRIS_ERROR_MEMORY;
+            if (err_code != YEP_ERR_NONE) {
+                it->err_line = err_line;
+                it->err_col = err_col;
+                it->status = err_code == YEP_ERR_MEMORY     ? YEPTRIS_ERROR_MEMORY
+                             : err_code == YEP_ERR_ENCODING ? YEPTRIS_ERROR_ENCODING
+                                                            : YEPTRIS_ERROR_PARSE;
+            } else {
+                it->status = YEPTRIS_ERROR_MEMORY;
+            }
             if (it->store.n == 0) {
                 if (!it->emitted_stream_start) {
                     /* the engine emitted +STR before failing: match it */
@@ -202,6 +289,9 @@ YEPTRIS_API void yeptris_iterparse_free(YeptrisIterparse it) {
     if (it == NULL) {
         return;
     }
+    const yep_allocator* sys = yep_system_allocator();
+    yep_free(sys, it->owned);
+    yep_free(sys, it->norm);
     yep_rec_free(&it->store);
     free(it->mat);
     free(it);

data/vendor/libyeptris/src/yeptris/events/pull.c

@@ -44,13 +44,33 @@ YEPTRIS_API YeptrisPullParser yeptris_pull_new(const char* buf, size_t len) {
     yep_text_active()->scan_stats(buf, len, &pst);
     yep_engine_prepare(eng, &pst);
     int rc = yep_engine_run(eng, buf, len, &sink);
-    const yep_error* err = yep_engine_error(eng);
-    if (err != NULL && rc != 0) {
-        p->err_line = err->line;
-        p->err_col = err->col;
+    /* the error slot lives INSIDE the engine, and the engine is a
+     * ~260KB allocation glibc serves with mmap — destroy munmaps it,
+     * so the slot's verdict must be copied out BEFORE destroy (the
+     * round-5 CI segfaulted reading err->code after the free). */
+    yep_err_code err_code = YEP_ERR_NONE;
+    uint32_t err_line = 0, err_col = 0;
+    {
+        const yep_error* err = yep_engine_error(eng);
+        if (err != NULL) {
+            err_code = err->code;
+            err_line = err->line;
+            err_col = err->col;
+        }
     }
     yep_engine_destroy(eng);
-    p->status = rc == 0 ? YEPTRIS_OK : YEPTRIS_ERROR_PARSE;
+    /* the error CODE decides the public status — the parse route's law
+     * (the recorder twin carries the full comment). A clean channel
+     * under a failed run is the capture sink failing: memory. */
+    if (rc != 0 && err_code != YEP_ERR_NONE) {
+        p->err_line = err_line;
+        p->err_col = err_col;
+        p->status = err_code == YEP_ERR_MEMORY     ? YEPTRIS_ERROR_MEMORY
+                    : err_code == YEP_ERR_ENCODING ? YEPTRIS_ERROR_ENCODING
+                                                   : YEPTRIS_ERROR_PARSE;
+    } else {
+        p->status = rc == 0 ? YEPTRIS_OK : YEPTRIS_ERROR_MEMORY;
+    }
     return p;
 }
 

data/vendor/libyeptris/src/yeptris/events/push.c

@@ -61,6 +61,12 @@ static int push_on_event(void* ctx, const yep_event* ev) {
     e.flow = ev->flow;
     e.line = ev->line;
     e.col = ev->col;
+    /* the cross-model identity law (#179, test_event_marks): push,
+     * pull and the recorder emit identical mark data — dropping the
+     * end marks here made the push route's events half-marked where
+     * pull/recorder carried all four fields */
+    e.end_line = ev->end_line;
+    e.end_col = ev->end_col;
     e.value = ev->value.len > 0 ? (const char*)ev->value.p : NULL;
     e.value_len = ev->value.len;
     e.anchor = ev->anchor.len > 0 ? (const char*)ev->anchor.p : NULL;
@@ -95,10 +101,26 @@ YEPTRIS_API YeptrisStatus yeptris_push_parse(const char* buf, size_t len, yeptri
     yep_text_active()->scan_stats(buf, len, &pst);
     yep_engine_prepare(eng, &pst);
     int rc = yep_engine_run(eng, buf, len, &sink);
+    /* the error slot lives inside the engine and destroy munmaps it
+     * (glibc serves the ~260KB engine with mmap): copy the verdict out
+     * BEFORE the free — reading err->code after destroy segfaulted the
+     * round-5 CI */
+    yep_err_code err_code = YEP_ERR_NONE;
+    {
+        const yep_error* err = yep_engine_error(eng);
+        if (err != NULL) {
+            err_code = err->code;
+        }
+    }
     yep_engine_destroy(eng);
     if (rc == 0) {
         return YEPTRIS_OK;
     }
-    /* -2: the callback aborted — reported as a parse stop, not a bug */
+    /* the engine's own memory failures report MEMORY (the parse route's
+     * law); the callback abort keeps its documented contract — a parse
+     * stop, clean channel */
+    if (err_code == YEP_ERR_MEMORY) {
+        return YEPTRIS_ERROR_MEMORY;
+    }
     return YEPTRIS_ERROR_PARSE;
 }

data/vendor/libyeptris/src/yeptris/events/recorder.c

@@ -37,6 +37,23 @@ YEPTRIS_API YeptrisRecorder yeptris_recorder_new_ex(YeptrisSchema schema) {
     return r;
 }
 
+/* The engine's error code decides the public status — the parse
+ * route's law (parse.c maps YEP_ERR_* to the pinned codes). A clean
+ * channel means the SINK failed: the capture ran out of memory, the
+ * bytes never were a parse error. The MEMORY arm: the engine's own
+ * allocation failures (e_fail(YEP_ERR_MEMORY)) used to read as a parse
+ * error here — yep_engine_error always returns the slot, so the old
+ * `err != NULL` discriminator could never fire (the audit's finding). */
+static YeptrisStatus rec_status_from_err(const yep_error* err) {
+    if (err == NULL || err->code == YEP_ERR_NONE || err->code == YEP_ERR_MEMORY) {
+        return YEPTRIS_ERROR_MEMORY;
+    }
+    if (err->code == YEP_ERR_ENCODING) {
+        return YEPTRIS_ERROR_ENCODING;
+    }
+    return YEPTRIS_ERROR_PARSE;
+}
+
 YEPTRIS_API YeptrisStatus yeptris_recorder_feed(YeptrisRecorder rec, const char* chunk, size_t len,
                                                 int final) {
     if (rec == NULL || (chunk == NULL && len != 0)) {
@@ -71,15 +88,11 @@ YEPTRIS_API YeptrisStatus yeptris_recorder_feed(YeptrisRecorder rec, const char*
     int rc = yep_engine_step(rec->eng, chunk, len, final, &sink);
     if (rc != 0) {
         const yep_error* err = yep_engine_error(rec->eng);
-        if (err != NULL) {
+        if (err != NULL && err->code != YEP_ERR_NONE) {
             rec->err_line = err->line;
             rec->err_col = err->col;
-            rec->status = YEPTRIS_ERROR_PARSE;
-        } else {
-            /* a clean error channel means the SINK failed: the capture
-             * ran out of memory, the bytes never were a parse error */
-            rec->status = YEPTRIS_ERROR_MEMORY;
         }
+        rec->status = rec_status_from_err(err);
         rec->final_fed = 1; /* a failed feed kills the stream */
         return rec->status;
     }
@@ -107,6 +120,20 @@ YEPTRIS_API const char* yeptris_recorder_arena(YeptrisRecorder rec, size_t* len)
     return rec->store.arena;
 }
 
+YEPTRIS_API YeptrisStatus yeptris_recorder_status(const YeptrisRecorder rec, uint32_t* line,
+                                                  uint32_t* col) {
+    if (rec == NULL) {
+        return YEPTRIS_ERROR_ARG;
+    }
+    if (line != NULL) {
+        *line = rec->err_line;
+    }
+    if (col != NULL) {
+        *col = rec->err_col;
+    }
+    return rec->status;
+}
+
 YEPTRIS_API void yeptris_recorder_free(YeptrisRecorder rec) {
     if (rec == NULL) {
         return;

data/vendor/libyeptris/src/yeptris/memory/arena.c

@@ -98,7 +98,15 @@ void* yep_arena_alloc(yep_arena* arena, size_t size, size_t align) {
     uintptr_t base = (uintptr_t)b + sizeof(yep_arena_block);
     uintptr_t start = yep_round_up(base + b->used, align);
 
-    if (start + size > base + b->size) {
+    /* the fit test in subtraction form (the audit's finding): the old
+     * `start + size > base + b->size` wraps when size rides past the
+     * pointer space and the request "fits". The limit-first clause
+     * covers the round_up overshoot — start can sit up to align-1
+     * bytes past the limit, where `limit - start` would underflow — so
+     * both comparisons are wrap-free without leaning on the
+     * hostile-size guard above. */
+    uintptr_t limit = base + b->size;
+    if (start >= limit || size > limit - start) {
         /* Amortized doubling: each new block is at least twice the last,
          * unless the request itself is larger. */
         size_t payload = arena->last_block_size * 2;

data/vendor/libyeptris/src/yeptris/memory/pool.c

@@ -64,7 +64,11 @@ void* yep_pool_alloc(yep_pool* pool, size_t size, size_t align) {
     uintptr_t base = (uintptr_t)b + sizeof(yep_block);
     uintptr_t start = yep_round_up(base + b->used, align);
 
-    if (start + size > base + b->size) {
+    /* the fit test in subtraction form — the arena twin carries the
+     * full comment (wrap-free comparisons, round_up overshoot covered
+     * by the limit-first clause) */
+    uintptr_t limit = base + b->size;
+    if (start >= limit || size > limit - start) {
         /* Dedicated-or-default new block, sized so the aligned request
          * always fits (malloc returns at least 16-byte-aligned memory, so
          * the correction is < align). */

data/vendor/libyeptris/src/yeptris/parse/engine.c

@@ -4798,8 +4798,40 @@ typedef struct yep_stepstate {
                          * state the whole-stream walk holds at the ---
                          * cut, so per-document normalization is
                          * byte-identical to the one-buffer walk */
+    int gated;          /* the encoding front-end ran: BOM decisions
+                         * belong to the stream's first bytes, never to
+                         * a mid-stream chunk (a later U+FEFF is
+                         * content). While 0 the head may still be a
+                         * BOM prefix, and scanned is 0 by the same
+                         * law -- every hold returns before step_scan. */
 } yep_stepstate;
 
+/* True when buf[0..len) could still be the PREFIX of a BOM (the rest
+ * arrives with the next chunk): the sniff needs its full width, so a
+ * 1-3-byte head holds the gate instead of reading a mark's bytes as
+ * content. A buffer long enough for the sniff to decide never gets
+ * here. */
+static int step_bom_prefix(const char* buf, size_t len) {
+    const unsigned char* p = (const unsigned char*)buf;
+    switch (p[0]) {
+    case 0xEF:
+        return len == 1 || (len == 2 && p[1] == 0xBB);
+    case 0xFF:
+    case 0xFE:
+        return len == 1;
+    case 0x00:
+        if (len == 1) {
+            return 1;
+        }
+        if (p[1] != 0x00) {
+            return 0;
+        }
+        return len == 2 || p[2] == 0xFE;
+    default:
+        return 0;
+    }
+}
+
 static int engine_run_impl(yep_engine* e, const char* buf, size_t len, const yep_sink* sink,
                            int emit_start, int emit_end);
 
@@ -5344,6 +5376,33 @@ int yep_engine_step(yep_engine* e, const char* chunk, size_t len, int final, con
         memcpy(st->buf + st->len, chunk, len);
         st->len += len;
     }
+    /* the encoding front-end the one-shot owns (yep_engine_run): the
+     * stepping route (and the recorder riding it) had NONE, so UTF-16
+     * bytes fed through it parsed garbage silently. The gate runs
+     * once, on the stream's first bytes: the UTF-8 BOM strips (a lone
+     * one is an empty stream, not a U+FEFF scalar -- the one-shot's
+     * round-122 law), a UTF-16/32 BOM rejects (chunk-wise transcoding
+     * cannot carry state across feeds: a surrogate pair split by the
+     * chunk boundary has nowhere to live), and an undecided prefix
+     * holds until enough bytes decide it. */
+    if (!st->gated && st->len > 0) {
+        yep_encoding enc = YEP_ENC_UNKNOWN;
+        size_t bom = yep_bom_sniff((const unsigned char*)st->buf, st->len, &enc);
+        if (enc == YEP_ENC_UTF8) {
+            memmove(st->buf, st->buf + bom, st->len - bom);
+            st->len -= bom;
+            st->gated = 1;
+        } else if (enc == YEP_ENC_UTF16LE || enc == YEP_ENC_UTF16BE || enc == YEP_ENC_UTF32LE ||
+                   enc == YEP_ENC_UTF32BE) {
+            yep_error_set(&e->err, YEP_ERR_ENCODING, 1, 1, bom,
+                          "the chunked route cannot decode UTF-16/32 input");
+            return -1;
+        } else if (st->len >= 4 || !step_bom_prefix(st->buf, st->len)) {
+            st->gated = 1;
+        } else if (!final) {
+            return 0; /* the head may still complete a BOM: hold */
+        }
+    }
     if (!final) {
         size_t cut = step_scan(st);
         if (cut == 0 || cut >= st->len) {

data/vendor/libyeptris/src/yeptris/parse.c

@@ -437,7 +437,12 @@ engine_enter:
     }
     if (rc != 0) {
         const yep_error* ee = yep_engine_error(eng);
-        yep_err_code code = ee ? ee->code : YEP_ERR_UNEXPECTED;
+        /* a CLEAN channel under a failed run means the SINK failed — a
+         * builder ran out of memory (the DOM's oom law), the bytes
+         * never were a parse error. Mapping it to PARSE let
+         * yep_dom_str_put's swallowed OOM surface as a syntax error
+         * (the audit's finding: silent doc corruption reads worse). */
+        yep_err_code code = (ee && ee->code != YEP_ERR_NONE) ? ee->code : YEP_ERR_MEMORY;
         if (ee) {
             yep_error* tls = yep_error_tls();
             *tls = *ee;

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yeptris
 version: !ruby/object:Gem::Version
-  version: 0.6.56.1
+  version: 0.6.57.1
 platform: arm-linux-eabihf
 authors:
 - Ribose Inc.