Skip to content

v7.8.3

Latest

Choose a tag to compare

@stephenberry stephenberry released this 23 Jun 14:25

Improvements

Fixes and Safety

  • guard minified skip_ws against end of non-null-terminated input by @uwezkhan in #2634
  • Bound non-null-terminated value scanners against end of input by @stephenberry in #2636
  • Fix integer overflow in REPE length validation (out-of-bounds read) by @arshsmith in #2638
  • Pre-screen key length in the shared hash dispatch by @stephenberry in #2643
  • Fix off-by-one heap overflow when decoding EETF atoms and strings by @arshsmith in #2642
  • reject wildcard origin with credentials in is_origin_allowed by @uwezkhan in #2644
  • Reject non-representable floats when reading a JSONB float into an integer by @stephenberry in #2645
  • Fix std::byte and fixed std::array<char,N> handling in CBOR/MsgPack/BSON by @stephenberry in #2650
  • Encode std::byte ranges compactly and read fixed char arrays in BEVE by @stephenberry in #2649
  • use end - it for length bounds checks in binary readers by @uwezkhan in #2653
  • Bound MessagePack array/map reserve against remaining input by @arshsmith in #2648
  • reject transfer-encoding requests in finish_request by @uwezkhan in #2654
  • Reject obs-fold and whitespace-before-colon in request headers (RFC 7230 3.2.4) by @stephenberry in #2661
  • Cap recursion depth in text-format readers and unify depth_guard by @stephenberry in #2662
  • guard eetf_to_json reads against end of input by @uwezkhan in #2659
  • Bound eetf number and container-header reads against end of input by @stephenberry in #2663
  • Fix compile error in tests, fix UBSan errors in BEVE read path by @nextsilicon-itay-bookstein in #2668

New Contributors

Full Changelog: v7.8.2...v7.8.3