diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml new file mode 100644 index 0000000..2199dea --- /dev/null +++ b/.github/FUNDING.yml @@ -0,0 +1,8 @@ +--- +github: fraillt +buy_me_a_coffee: fraillt +custom: + - "https://www.paypal.com/paypalme/fraillt" + - "https://explorer.solana.com/address/5uHU32nBuniRxg6RZu4tsLWrXGFFz4pwMGHGuCLmkGJQ" + - "https://etherscan.io/address/0xe51cb417d1BFcd3EE4cfad9fa11b05631823AADb" + - "https://polygonscan.com/address/0xe51cb417d1BFcd3EE4cfad9fa11b05631823AADb" diff --git a/CHANGELOG.md b/CHANGELOG.md index d78df22..41e7c2d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,15 @@ +# [5.2.5](https://github.com/fraillt/bitsery/compare/v5.2.4...v5.2.5) (2025-10-09) + +### Bug fixes +* fix security issue during deserialization where a crafted payload could cause a shared pointer to be assigned to a different type. More information is [here](https://gist.github.com/TrebledJ/750abc64a826f19dd2d6774724629b71). (huge thanks to [Johnathan](https://github.com/TrebledJ)) +* fix serialization of shared polymorphic pointer-like types by correctly identifying same object (e.g. the same object serialized through `Base` or `Derived` would otherwise have different pointer addresses). +* fix polymorphic type assignment to "observer" by adjusting pointer address. +* fix spelling of C++ "likely" attribute. #121 (thanks to [Jules](https://github.com/jules-ai)) + +### Other notes +* format code that was left unformatted in the previous version. +* remove broken patch for GCC 4.8.2 (CentOS 7). + # [5.2.4](https://github.com/fraillt/bitsery/compare/v5.2.3...v5.2.4) (2024-07-30) ### Improvements diff --git a/CMakeLists.txt b/CMakeLists.txt index 706b790..24c8a02 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,7 +1,7 @@ cmake_minimum_required(VERSION 3.25) project(bitsery LANGUAGES CXX - VERSION 5.2.4) + VERSION 5.2.5) #======== build options =================================== option(BITSERY_BUILD_EXAMPLES "Build examples" OFF) diff --git a/README.md b/README.md index 54a5c37..010be8a 100644 --- a/README.md +++ b/README.md @@ -102,9 +102,13 @@ Works with C++11 compiler, no additional dependencies, include ` -patch -p1 < patches/ -``` - -* [centos7_gcc4.8.2.diff](centos7_gcc4.8.2.diff) in this version, unordered_map is not fully C++11 compatible yet. It is lacking some constructors that accept allocator, and isn't using `std::allocator_traits`. \ No newline at end of file diff --git a/patches/centos7_gcc4.8.2.diff b/patches/centos7_gcc4.8.2.diff deleted file mode 100644 index bb87b50..0000000 --- a/patches/centos7_gcc4.8.2.diff +++ /dev/null @@ -1,119 +0,0 @@ -diff --git a/include/bitsery/details/serialization_common.h b/include/bitsery/details/serialization_common.h -index 6d5a441..462cee2 100644 ---- a/include/bitsery/details/serialization_common.h -+++ b/include/bitsery/details/serialization_common.h -@@ -380,7 +380,7 @@ namespace bitsery { - template - explicit AdapterAndContextRef(Context& ctx, TArgs&& ... args) - : _adapter{std::forward(args)...}, -- _context{ctx} -+ _context(ctx) - { - } - -diff --git a/include/bitsery/ext/inheritance.h b/include/bitsery/ext/inheritance.h -index f4c6655..5cd44ab 100644 ---- a/include/bitsery/ext/inheritance.h -+++ b/include/bitsery/ext/inheritance.h -@@ -36,7 +36,7 @@ namespace bitsery { - class InheritanceContext { - public: - explicit InheritanceContext(MemResourceBase* memResource = nullptr) -- :_virtualBases{pointer_utils::StdPolyAlloc{memResource}} -+ :_virtualBases{0, std::hash{}, std::equal_to{}, pointer_utils::StdPolyAlloc{memResource}} - {} - InheritanceContext(const InheritanceContext&) = delete; - InheritanceContext&operator = (const InheritanceContext&) = delete; -diff --git a/include/bitsery/ext/utils/memory_resource.h b/include/bitsery/ext/utils/memory_resource.h -index 472965a..18b3f31 100644 ---- a/include/bitsery/ext/utils/memory_resource.h -+++ b/include/bitsery/ext/utils/memory_resource.h -@@ -24,6 +24,7 @@ - #define BITSERY_EXT_MEMORY_RESOURCE_H - - #include "../../details/serialization_common.h" -+#include - #include - - namespace bitsery { -@@ -128,6 +129,40 @@ namespace bitsery { - public: - using value_type = T; - -+ using pointer = T*; -+ using const_pointer = const T*; -+ using reference = T&; -+ using const_reference = const T&; -+ using size_type = size_t; -+ using difference_type = ptrdiff_t; -+ -+ size_t max_size() const noexcept { -+ return std::numeric_limits::max() / sizeof(value_type); -+ } -+ -+ void construct(T *p, const T &val) { -+ new((void *) p) T(val); -+ } -+ -+ template -+ void construct(U *p, Args &&... args) { -+ new((void *) p) U(std::forward(args)...); -+ } -+ -+ void destroy(T *p) { -+ p->~T(); -+ } -+ -+ template -+ void destroy(U *p) { -+ p->~U(); -+ } -+ -+ template -+ struct rebind { -+ using other = StdPolyAlloc; -+ }; -+ - explicit constexpr StdPolyAlloc(MemResourceBase* memResource) - :_alloc{memResource} {} - explicit constexpr StdPolyAlloc(PolyAllocWithTypeId alloc) : _alloc{alloc} {} -diff --git a/include/bitsery/ext/utils/pointer_utils.h b/include/bitsery/ext/utils/pointer_utils.h -index f6f90da..6b65600 100644 ---- a/include/bitsery/ext/utils/pointer_utils.h -+++ b/include/bitsery/ext/utils/pointer_utils.h -@@ -153,7 +153,7 @@ namespace bitsery { - public: - explicit PointerLinkingContextSerialization(MemResourceBase* memResource = nullptr) - : _currId{0}, -- _ptrMap{StdPolyAlloc>{memResource}} {} -+ _ptrMap{0, std::hash{}, std::equal_to{}, StdPolyAlloc>{memResource}} {} - - PointerLinkingContextSerialization(const PointerLinkingContextSerialization&) = delete; - -@@ -198,7 +198,7 @@ namespace bitsery { - public: - explicit PointerLinkingContextDeserialization(MemResourceBase* memResource = nullptr) - : _memResource{memResource}, -- _idMap{StdPolyAlloc>{memResource}} {} -+ _idMap{0, std::hash{}, std::equal_to{}, StdPolyAlloc>{memResource}} {} - - PointerLinkingContextDeserialization(const PointerLinkingContextDeserialization&) = delete; - -diff --git a/include/bitsery/ext/utils/polymorphism_utils.h b/include/bitsery/ext/utils/polymorphism_utils.h -index 6678230..a2cef4d 100644 ---- a/include/bitsery/ext/utils/polymorphism_utils.h -+++ b/include/bitsery/ext/utils/polymorphism_utils.h -@@ -185,11 +185,8 @@ namespace bitsery { - - explicit PolymorphicContext(MemResourceBase* memResource = nullptr) - :_memResource{memResource}, -- _baseToDerivedMap{pointer_utils::StdPolyAlloc>>{memResource}}, -- _baseToDerivedArray{pointer_utils::StdPolyAlloc>>>{memResource}} -- {} -+ _baseToDerivedMap{0, BaseToDerivedKeyHashier{}, std::equal_to{}, pointer_utils::StdPolyAlloc>>{memResource}}, -+ _baseToDerivedArray{0, std::hash{}, std::equal_to{}, pointer_utils::StdPolyAlloc>>>{memResource}} {} - - PolymorphicContext(const PolymorphicContext& ) = delete; - PolymorphicContext& operator = (const PolymorphicContext&) = delete;