🚨 [security] [ruby] Update json 2.21.1 → 2.21.2 (patch) by depfu[bot] · Pull Request #144 · practical-computer/practical

depfu · 2026-08-07T20:10:43Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ json (indirect, 2.21.1 → 2.21.2) · Repo · Changelog

Security Advisories 🚨

🚨 Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Summary

Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage.

When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process.

An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys.

The issue was reproduced in the native C extension from the official RubyGems releases:

JSON 2.20.0
JSON 2.21.0
JSON 2.21.1

The attached evidence demonstrates:

an AddressSanitizer-confirmed heap-use-after-free;
a native SIGSEGV using the official JSON 2.21.1 RubyGem;
an end-to-end loopback TCP attacker/victim reproduction;
four differential controls;
successful execution after applying a tested patch control.

This was originally reported privately through Ruby's HackerOne program as report #3867755. A Ruby maintainer independently confirmed reproduction of the ASan failure and requested that further coordination continue through this private advisory.

No code execution or information disclosure is claimed.

Details

The affected source is:

ext/json/ext/parser/parser.c

The vulnerable sequence in JSON 2.21.1 is:

cResumableParser_parse reaches the end of the current input buffer.
It calls json_str_clear(parser->buffer).
It sets parser->buffer = Qfalse.
The parser-state pointers into the released buffer are not reset.
partial_value makes a shallow copy of the parser state.
Reconstructing an incomplete object containing duplicate keys reaches the duplicate-key warning path.
cursor_position walks through the stale input pointers and reads released memory.

Relevant source locations:

Buffer release:

json/ext/json/ext/parser/parser.c

Lines 2562 to 2569 in fd61def

    <tbody>

    <tr class="border-0">
      <td id="L2563" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2563"></td>
      <td id="LC2563" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-s1">parser</span><span class="pl-c1">-&gt;</span><span class="pl-c1">incomplete_bytes</span> <span class="pl-c1">=</span> <span class="pl-s1">parser</span><span class="pl-c1">-&gt;</span><span class="pl-c1">complete</span> ? <span class="pl-c1">0</span> : <span class="pl-s1">parser</span><span class="pl-c1">-&gt;</span><span class="pl-c1">state</span>.<span class="pl-c1">end</span> <span class="pl-c1">-</span> <span class="pl-s1">parser</span><span class="pl-c1">-&gt;</span><span class="pl-c1">state</span>.<span class="pl-c1">cursor</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L2564" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2564"></td>
      <td id="LC2564" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L2565" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2565"></td>
      <td id="LC2565" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-en">json_eat_whitespace</span>(<span class="pl-c1">&amp;</span><span class="pl-s1">parser</span><span class="pl-c1">-&gt;</span><span class="pl-c1">state</span>, <span class="pl-c1">&amp;</span><span class="pl-s1">parser</span><span class="pl-c1">-&gt;</span><span class="pl-c1">config</span>, false); </td>
    </tr>

    <tr class="border-0">
      <td id="L2566" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2566"></td>
      <td id="LC2566" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-k">if</span> (<span class="pl-en">eos</span>(<span class="pl-c1">&amp;</span><span class="pl-s1">parser</span><span class="pl-c1">-&gt;</span><span class="pl-c1">state</span>)) { </td>
    </tr>

    <tr class="border-0">
      <td id="L2567" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2567"></td>
      <td id="LC2567" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-en">json_str_clear</span>(<span class="pl-s1">parser</span><span class="pl-c1">-&gt;</span><span class="pl-c1">buffer</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L2568" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2568"></td>
      <td id="LC2568" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-s1">parser</span><span class="pl-c1">-&gt;</span><span class="pl-c1">buffer</span> <span class="pl-c1">=</span> <span class="pl-s1">Qfalse</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L2569" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2569"></td>
      <td id="LC2569" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> } </td>
    </tr>
</tbody>

	parser->parsed_bytes += parser->state.cursor - initial_cursor;

Parser-state copy:

json/ext/json/ext/parser/parser.c

Lines 2647 to 2654 in fd61def

    <tbody>

    <tr class="border-0">
      <td id="L2648" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2648"></td>
      <td id="LC2648" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> { </td>
    </tr>

    <tr class="border-0">
      <td id="L2649" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2649"></td>
      <td id="LC2649" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-smi">JSON_ResumableParser</span> <span class="pl-c1">*</span><span class="pl-s1">original_parser</span> <span class="pl-c1">=</span> <span class="pl-en">cResumableParser_get</span>(<span class="pl-s1">self</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L2650" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2650"></td>
      <td id="LC2650" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-smi">JSON_ResumableParser</span> <span class="pl-s1">parser</span> <span class="pl-c1">=</span> <span class="pl-c1">*</span><span class="pl-s1">original_parser</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L2651" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2651"></td>
      <td id="LC2651" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L2652" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2652"></td>
      <td id="LC2652" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-s1">parser</span>.<span class="pl-c1">state</span>.<span class="pl-c1">frames</span> <span class="pl-c1">=</span> <span class="pl-c1">&amp;</span><span class="pl-s1">parser</span>.<span class="pl-c1">frames</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L2653" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2653"></td>
      <td id="LC2653" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-s1">parser</span>.<span class="pl-c1">state</span>.<span class="pl-c1">value_stack</span> <span class="pl-c1">=</span> <span class="pl-c1">&amp;</span><span class="pl-s1">parser</span>.<span class="pl-c1">value_stack</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L2654" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="2654"></td>
      <td id="LC2654" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>
</tbody>

	static VALUE cResumableParser_partial_value_body(VALUE self)

Stale-pointer read in cursor_position:

json/ext/json/ext/parser/parser.c

Lines 590 to 628 in fd61def

    <tbody>

    <tr class="border-0">
      <td id="L591" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="591"></td>
      <td id="LC591" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> { </td>
    </tr>

    <tr class="border-0">
      <td id="L592" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="592"></td>
      <td id="LC592" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-en">JSON_ASSERT</span>(<span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">cursor</span> &lt;= <span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">end</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L593" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="593"></td>
      <td id="LC593" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L594" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="594"></td>
      <td id="LC594" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-c">// Redundant but helpful for hardening</span> </td>
    </tr>

    <tr class="border-0">
      <td id="L595" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="595"></td>
      <td id="LC595" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-k">if</span> (<span class="pl-en">RB_UNLIKELY</span>(<span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">cursor</span> <span class="pl-c1">&gt;</span> <span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">end</span>)) { </td>
    </tr>

    <tr class="border-0">
      <td id="L596" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="596"></td>
      <td id="LC596" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">cursor</span> <span class="pl-c1">=</span> <span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">end</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L597" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="597"></td>
      <td id="LC597" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     } </td>
    </tr>

    <tr class="border-0">
      <td id="L598" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="598"></td>
      <td id="LC598" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L599" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="599"></td>
      <td id="LC599" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-k">const</span> <span class="pl-smi">char</span> <span class="pl-c1">*</span><span class="pl-s1">cursor</span> <span class="pl-c1">=</span> <span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">cursor</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L600" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="600"></td>
      <td id="LC600" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-smi">long</span> <span class="pl-s1">column</span> <span class="pl-c1">=</span> <span class="pl-c1">0</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L601" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="601"></td>
      <td id="LC601" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-smi">long</span> <span class="pl-s1">line</span> <span class="pl-c1">=</span> <span class="pl-c1">1</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L602" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="602"></td>
      <td id="LC602" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L603" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="603"></td>
      <td id="LC603" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-k">while</span> (<span class="pl-s1">cursor</span> &gt;= <span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">start</span>) { </td>
    </tr>

    <tr class="border-0">
      <td id="L604" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="604"></td>
      <td id="LC604" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-k">if</span> (<span class="pl-c1">*</span><span class="pl-s1">cursor</span><span class="pl-c1">--</span> <span class="pl-c1">==</span> <span class="pl-c1">'\n'</span>) { </td>
    </tr>

    <tr class="border-0">
      <td id="L605" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="605"></td>
      <td id="LC605" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">             <span class="pl-s1">line</span><span class="pl-c1">++</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L606" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="606"></td>
      <td id="LC606" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">             <span class="pl-k">break</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L607" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="607"></td>
      <td id="LC607" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         } </td>
    </tr>

    <tr class="border-0">
      <td id="L608" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="608"></td>
      <td id="LC608" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-s1">column</span><span class="pl-c1">++</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L609" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="609"></td>
      <td id="LC609" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     } </td>
    </tr>

    <tr class="border-0">
      <td id="L610" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="610"></td>
      <td id="LC610" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L611" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="611"></td>
      <td id="LC611" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-k">while</span> (<span class="pl-s1">cursor</span> &gt;= <span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">start</span>) { </td>
    </tr>

    <tr class="border-0">
      <td id="L612" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="612"></td>
      <td id="LC612" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-k">if</span> (<span class="pl-c1">*</span><span class="pl-s1">cursor</span><span class="pl-c1">--</span> <span class="pl-c1">==</span> <span class="pl-c1">'\n'</span>) { </td>
    </tr>

    <tr class="border-0">
      <td id="L613" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="613"></td>
      <td id="LC613" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">             <span class="pl-s1">line</span><span class="pl-c1">++</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L614" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="614"></td>
      <td id="LC614" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         } </td>
    </tr>

    <tr class="border-0">
      <td id="L615" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="615"></td>
      <td id="LC615" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     } </td>
    </tr>

    <tr class="border-0">
      <td id="L616" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="616"></td>
      <td id="LC616" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-c1">*</span><span class="pl-s1">line_out</span> <span class="pl-c1">=</span> <span class="pl-s1">line</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L617" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="617"></td>
      <td id="LC617" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-c1">*</span><span class="pl-s1">column_out</span> <span class="pl-c1">=</span> <span class="pl-s1">column</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L618" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="618"></td>
      <td id="LC618" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> } </td>
    </tr>

    <tr class="border-0">
      <td id="L619" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="619"></td>
      <td id="LC619" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L620" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="620"></td>
      <td id="LC620" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-k">static</span> <span class="pl-k">const</span> <span class="pl-smi">unsigned <span class="pl-smi">int</span></span> <span class="pl-c1">MAX_DEPRECATIONS</span> <span class="pl-c1">=</span> <span class="pl-c1">5</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L621" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="621"></td>
      <td id="LC621" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L622" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="622"></td>
      <td id="LC622" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-k">static</span> <span class="pl-smi">void</span> <span class="pl-en">emit_parse_warning</span>(<span class="pl-k">const</span> <span class="pl-smi">char</span> <span class="pl-c1">*</span><span class="pl-s1">message</span>, <span class="pl-smi">JSON_ParserState</span> <span class="pl-c1">*</span><span class="pl-s1">state</span>) </td>
    </tr>

    <tr class="border-0">
      <td id="L623" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="623"></td>
      <td id="LC623" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> { </td>
    </tr>

    <tr class="border-0">
      <td id="L624" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="624"></td>
      <td id="LC624" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-smi">long</span> <span class="pl-s1">line</span>, <span class="pl-s1">column</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L625" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="625"></td>
      <td id="LC625" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-en">cursor_position</span>(<span class="pl-s1">state</span>, <span class="pl-c1">&amp;</span><span class="pl-s1">line</span>, <span class="pl-c1">&amp;</span><span class="pl-s1">column</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L626" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="626"></td>
      <td id="LC626" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L627" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="627"></td>
      <td id="LC627" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-smi">VALUE</span> <span class="pl-s1">warning</span> <span class="pl-c1">=</span> <span class="pl-en">rb_sprintf</span>(<span class="pl-s">"%s at line %ld column %ld"</span>, <span class="pl-s1">message</span>, <span class="pl-s1">line</span>, <span class="pl-s1">column</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L628" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="628"></td>
      <td id="LC628" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-en">rb_funcall</span>(<span class="pl-s1">mJSON</span>, <span class="pl-en">rb_intern</span>(<span class="pl-s">"deprecation_warning"</span>), <span class="pl-c1">1</span>, <span class="pl-s1">warning</span>); </td>
    </tr>
</tbody>

	static void cursor_position(JSON_ParserState state, long line_out, long *column_out)

Duplicate-key handling path:

json/ext/json/ext/parser/parser.c

Lines 1196 to 1255 in fd61def

    <tbody>

    <tr class="border-0">
      <td id="L1197" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1197"></td>
      <td id="LC1197" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> { </td>
    </tr>

    <tr class="border-0">
      <td id="L1198" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1198"></td>
      <td id="LC1198" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-smi">VALUE</span> <span class="pl-s1">message</span> <span class="pl-c1">=</span> <span class="pl-en">rb_sprintf</span>( </td>
    </tr>

    <tr class="border-0">
      <td id="L1199" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1199"></td>
      <td id="LC1199" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-s">"detected duplicate key %"</span><span class="pl-s1">PRIsVALUE</span><span class="pl-s">" in JSON object. This will raise an error in json 3.0 unless enabled via `allow_duplicate_key: true`"</span>, </td>
    </tr>

    <tr class="border-0">
      <td id="L1200" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1200"></td>
      <td id="LC1200" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-en">rb_inspect</span>(<span class="pl-s1">duplicate_key</span>) </td>
    </tr>

    <tr class="border-0">
      <td id="L1201" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1201"></td>
      <td id="LC1201" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     ); </td>
    </tr>

    <tr class="border-0">
      <td id="L1202" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1202"></td>
      <td id="LC1202" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L1203" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1203"></td>
      <td id="LC1203" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-en">emit_parse_warning</span>(<span class="pl-en">RSTRING_PTR</span>(<span class="pl-s1">message</span>), <span class="pl-s1">state</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L1204" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1204"></td>
      <td id="LC1204" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-en">RB_GC_GUARD</span>(<span class="pl-s1">message</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L1205" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1205"></td>
      <td id="LC1205" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> } </td>
    </tr>

    <tr class="border-0">
      <td id="L1206" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1206"></td>
      <td id="LC1206" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L1207" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1207"></td>
      <td id="LC1207" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-c1">NORETURN</span>(<span class="pl-smi">static</span>) <span class="pl-s1">void</span> <span class="pl-en">raise_duplicate_key_error</span>(<span class="pl-smi">JSON_ParserState</span> <span class="pl-c1">*</span><span class="pl-s1">state</span>, <span class="pl-smi">VALUE</span> <span class="pl-s1">duplicate_key</span>) </td>
    </tr>

    <tr class="border-0">
      <td id="L1208" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1208"></td>
      <td id="LC1208" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> { </td>
    </tr>

    <tr class="border-0">
      <td id="L1209" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1209"></td>
      <td id="LC1209" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-smi">VALUE</span> <span class="pl-s1">message</span> <span class="pl-c1">=</span> <span class="pl-en">rb_sprintf</span>( </td>
    </tr>

    <tr class="border-0">
      <td id="L1210" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1210"></td>
      <td id="LC1210" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-s">"duplicate key %"</span><span class="pl-s1">PRIsVALUE</span>, </td>
    </tr>

    <tr class="border-0">
      <td id="L1211" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1211"></td>
      <td id="LC1211" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-en">rb_inspect</span>(<span class="pl-s1">duplicate_key</span>) </td>
    </tr>

    <tr class="border-0">
      <td id="L1212" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1212"></td>
      <td id="LC1212" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     ); </td>
    </tr>

    <tr class="border-0">
      <td id="L1213" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1213"></td>
      <td id="LC1213" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L1214" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1214"></td>
      <td id="LC1214" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-en">rb_str_concat</span>(<span class="pl-s1">message</span>, <span class="pl-en">build_parse_error_message</span>(<span class="pl-s">""</span>, <span class="pl-s1">state</span>)); </td>
    </tr>

    <tr class="border-0">
      <td id="L1215" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1215"></td>
      <td id="LC1215" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-k">if</span> (<span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">parser</span>) { <span class="pl-c">// line and columns can't be accurate in resumable</span> </td>
    </tr>

    <tr class="border-0">
      <td id="L1216" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1216"></td>
      <td id="LC1216" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-en">rb_exc_raise</span>(<span class="pl-en">parse_error_new</span>(<span class="pl-s1">state</span>, <span class="pl-s1">message</span>, <span class="pl-c1">0</span>, <span class="pl-c1">0</span>, false)); </td>
    </tr>

    <tr class="border-0">
      <td id="L1217" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1217"></td>
      <td id="LC1217" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     } <span class="pl-k">else</span> { </td>
    </tr>

    <tr class="border-0">
      <td id="L1218" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1218"></td>
      <td id="LC1218" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-smi">long</span> <span class="pl-s1">line</span>, <span class="pl-s1">column</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L1219" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1219"></td>
      <td id="LC1219" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-en">cursor_position</span>(<span class="pl-s1">state</span>, <span class="pl-c1">&amp;</span><span class="pl-s1">line</span>, <span class="pl-c1">&amp;</span><span class="pl-s1">column</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L1220" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1220"></td>
      <td id="LC1220" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-en">rb_str_catf</span>(<span class="pl-s1">message</span>, <span class="pl-s">" at line %ld column %ld"</span>, <span class="pl-s1">line</span>, <span class="pl-s1">column</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L1221" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1221"></td>
      <td id="LC1221" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-en">rb_exc_raise</span>(<span class="pl-en">parse_error_new</span>(<span class="pl-s1">state</span>, <span class="pl-s1">message</span>, <span class="pl-s1">line</span>, <span class="pl-s1">column</span>, false)); </td>
    </tr>

    <tr class="border-0">
      <td id="L1222" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1222"></td>
      <td id="LC1222" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     } </td>
    </tr>

    <tr class="border-0">
      <td id="L1223" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1223"></td>
      <td id="LC1223" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> } </td>
    </tr>

    <tr class="border-0">
      <td id="L1224" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1224"></td>
      <td id="LC1224" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L1225" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1225"></td>
      <td id="LC1225" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-c1">NOINLINE</span>(<span class="pl-smi">static</span>) <span class="pl-s1">void</span> <span class="pl-en">json_on_duplicate_key</span>(<span class="pl-smi">JSON_ParserState</span> <span class="pl-c1">*</span><span class="pl-s1">state</span>, <span class="pl-smi">JSON_ParserConfig</span> <span class="pl-c1">*</span><span class="pl-s1">config</span>, <span class="pl-smi">size_t</span> <span class="pl-s1">count</span>, <span class="pl-k">const</span> <span class="pl-smi">VALUE</span> <span class="pl-c1">*</span><span class="pl-s1">pairs</span>) </td>
    </tr>

    <tr class="border-0">
      <td id="L1226" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1226"></td>
      <td id="LC1226" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> { </td>
    </tr>

    <tr class="border-0">
      <td id="L1227" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1227"></td>
      <td id="LC1227" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-k">switch</span> (<span class="pl-s1">config</span><span class="pl-c1">-&gt;</span><span class="pl-c1">on_duplicate_key</span>) { </td>
    </tr>

    <tr class="border-0">
      <td id="L1228" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1228"></td>
      <td id="LC1228" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-k">case</span> <span class="pl-c1">JSON_IGNORE</span>: </td>
    </tr>

    <tr class="border-0">
      <td id="L1229" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1229"></td>
      <td id="LC1229" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">             <span class="pl-k">return</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L1230" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1230"></td>
      <td id="LC1230" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L1231" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1231"></td>
      <td id="LC1231" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-k">case</span> <span class="pl-c1">JSON_DEPRECATED</span>: </td>
    </tr>

    <tr class="border-0">
      <td id="L1232" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1232"></td>
      <td id="LC1232" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">             <span class="pl-c">// Only emit the first few deprecations to avoid spamming.</span> </td>
    </tr>

    <tr class="border-0">
      <td id="L1233" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1233"></td>
      <td id="LC1233" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">             <span class="pl-k">if</span> (<span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">emitted_deprecations</span> <span class="pl-c1">&lt;</span> <span class="pl-c1">MAX_DEPRECATIONS</span>) { </td>
    </tr>

    <tr class="border-0">
      <td id="L1234" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1234"></td>
      <td id="LC1234" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">                 <span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">emitted_deprecations</span><span class="pl-c1">++</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L1235" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1235"></td>
      <td id="LC1235" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">                 <span class="pl-en">emit_duplicate_key_warning</span>(<span class="pl-s1">state</span>, <span class="pl-en">json_find_duplicated_key</span>(<span class="pl-s1">count</span>, <span class="pl-s1">pairs</span>)); </td>
    </tr>

    <tr class="border-0">
      <td id="L1236" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1236"></td>
      <td id="LC1236" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">             } </td>
    </tr>

    <tr class="border-0">
      <td id="L1237" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1237"></td>
      <td id="LC1237" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">             <span class="pl-k">return</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L1238" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1238"></td>
      <td id="LC1238" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L1239" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1239"></td>
      <td id="LC1239" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-k">case</span> <span class="pl-c1">JSON_RAISE</span>: </td>
    </tr>

    <tr class="border-0">
      <td id="L1240" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1240"></td>
      <td id="LC1240" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">             <span class="pl-en">raise_duplicate_key_error</span>(<span class="pl-s1">state</span>, <span class="pl-en">json_find_duplicated_key</span>(<span class="pl-s1">count</span>, <span class="pl-s1">pairs</span>)); </td>
    </tr>

    <tr class="border-0">
      <td id="L1241" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1241"></td>
      <td id="LC1241" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">             <span class="pl-k">return</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L1242" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1242"></td>
      <td id="LC1242" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     } </td>
    </tr>

    <tr class="border-0">
      <td id="L1243" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1243"></td>
      <td id="LC1243" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-c1">UNREACHABLE</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L1244" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1244"></td>
      <td id="LC1244" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> } </td>
    </tr>

    <tr class="border-0">
      <td id="L1245" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1245"></td>
      <td id="LC1245" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L1246" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1246"></td>
      <td id="LC1246" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> <span class="pl-k">static</span> <span class="pl-k">inline</span> <span class="pl-smi">VALUE</span> <span class="pl-en">json_decode_object</span>(<span class="pl-smi">JSON_ParserState</span> <span class="pl-c1">*</span><span class="pl-s1">state</span>, <span class="pl-smi">JSON_ParserConfig</span> <span class="pl-c1">*</span><span class="pl-s1">config</span>, <span class="pl-smi">size_t</span> <span class="pl-s1">count</span>) </td>
    </tr>

    <tr class="border-0">
      <td id="L1247" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1247"></td>
      <td id="LC1247" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line"> { </td>
    </tr>

    <tr class="border-0">
      <td id="L1248" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1248"></td>
      <td id="LC1248" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-smi">size_t</span> <span class="pl-s1">entries_count</span> <span class="pl-c1">=</span> <span class="pl-s1">count</span> / <span class="pl-c1">2</span>; </td>
    </tr>

    <tr class="border-0">
      <td id="L1249" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1249"></td>
      <td id="LC1249" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-smi">VALUE</span> <span class="pl-s1">object</span> <span class="pl-c1">=</span> <span class="pl-en">rb_hash_new_capa</span>(<span class="pl-s1">entries_count</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L1250" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1250"></td>
      <td id="LC1250" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-k">const</span> <span class="pl-smi">VALUE</span> <span class="pl-c1">*</span><span class="pl-s1">pairs</span> <span class="pl-c1">=</span> <span class="pl-en">rvalue_stack_peek</span>(<span class="pl-s1">state</span><span class="pl-c1">-&gt;</span><span class="pl-c1">value_stack</span>, <span class="pl-s1">count</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L1251" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1251"></td>
      <td id="LC1251" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-en">rb_hash_bulk_insert</span>(<span class="pl-s1">count</span>, <span class="pl-s1">pairs</span>, <span class="pl-s1">object</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L1252" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1252"></td>
      <td id="LC1252" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">  </td>
    </tr>

    <tr class="border-0">
      <td id="L1253" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1253"></td>
      <td id="LC1253" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     <span class="pl-k">if</span> (<span class="pl-en">RB_UNLIKELY</span>(<span class="pl-en">RHASH_SIZE</span>(<span class="pl-s1">object</span>) <span class="pl-c1">&lt;</span> <span class="pl-s1">entries_count</span>)) { </td>
    </tr>

    <tr class="border-0">
      <td id="L1254" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1254"></td>
      <td id="LC1254" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">         <span class="pl-en">json_on_duplicate_key</span>(<span class="pl-s1">state</span>, <span class="pl-s1">config</span>, <span class="pl-s1">count</span>, <span class="pl-s1">pairs</span>); </td>
    </tr>

    <tr class="border-0">
      <td id="L1255" class="blob-num border-0 tmp-px-3 py-0 color-bg-default" data-line-number="1255"></td>
      <td id="LC1255" class="blob-code border-0 tmp-px-3 py-0 color-bg-default blob-code-inner js-file-line">     } </td>
    </tr>
</tbody>

	NOINLINE(static) void emit_duplicate_key_warning(JSON_ParserState *state, VALUE duplicate_key)

When input is supplied to the resumable parser, the parser state stores direct pointers into the backing Ruby string:

RSTRING_GETMEM(parser->buffer, start, len);
parser->state.start = start;
parser->state.end = start + len;
parser->state.cursor = parser->state.start + offset;

After the current buffer has been consumed, cResumableParser_parse clears the string and removes the parser's reference to it:

if (eos(&parser->state)) {
    json_str_clear(parser->buffer);
    parser->buffer = Qfalse;
}

This path does not invalidate or replace:

parser->state.start
parser->state.cursor
parser->state.end

JSON::ResumableParser#partial_value subsequently makes a shallow copy of the parser structure:

JSON_ResumableParser *original_parser = cResumableParser_get(self);
JSON_ResumableParser parser = *original_parser;

When the partial object contains duplicate keys, reconstruction follows this call path:

cResumableParser_partial_value_body
  -> json_decode_object
  -> json_on_duplicate_key
  -> emit_duplicate_key_warning
  -> emit_parse_warning
  -> cursor_position

cursor_position then reads through pointers that may refer to released storage.

AddressSanitizer reports:

ERROR: AddressSanitizer: heap-use-after-free
cursor_position at parser.c:604
freed by cResumableParser_parse at parser.c:2567

The reproducer follows the normal resumable-parser API sequence:

parser << chunk
parser.parse
parser << next_chunk
parser.parse
parser.partial_value

The issue does not require:

an application-defined callback;
explicit garbage collection;
parser reentrancy;
custom parser options;
an attacker-supplied Ruby object;
manual modification of native parser state.

The release-build crash reproduced on JSON 2.20.0, 2.21.0, and 2.21.1.

This report covers the native C-extension implementation. The separate Java-platform implementation was not tested and is not claimed to be affected.

PoC

The complete evidence bundle is attached as:

ruby-json-resumable-partial-value-uaf-evidence-20260716.zip

SHA-256:

07bf8d47b115e45d6145d0447ab6c1c0255e4a7e9b2fb55c3c9a0e24406134ac

Requirements

Linux
Ruby with development headers
C compiler
make
RubyGems

Release-build, network, and differential reproduction

Extract the attachment:

unzip ruby-json-resumable-partial-value-uaf-evidence-20260716.zip
cd ruby-json-resumable-partial-value-uaf-evidence-20260716

Run the official JSON 2.21.1 release-build proof, loopback network proof, and differential controls:

./run_exact_2211.sh

Expected primary results:

release_exit=139
network_victim_exit=139
network_result=PASS
result=PASS

The following four differential controls must also report result=PASS:

unique_key
duplicate_allowed
no_partial
complete_document

The release-build crash stack includes:

cursor_position
emit_parse_warning
emit_duplicate_key_warning
json_decode_object
cResumableParser_partial_value_body

AddressSanitizer reproduction

Run:

./run_asan.sh

Expected vulnerable result:

asan_vulnerable_exit=134
ERROR: AddressSanitizer: heap-use-after-free
cursor_position at parser.c:604
freed by cResumableParser_parse at parser.c:2567

Expected patched-control result:

asan_patched_exit=0
asan_result=PASS

Affected-version matrix

The release-build crash was reproduced three times for each of the following official RubyGems releases:

json 2.20.0
json 2.21.0
json 2.21.1

Additional evidence is included in:

artifacts/exact-2211-e2e.txt
artifacts/asan-and-patched-control.txt
artifacts/version-matrix.txt
artifacts/source-and-release-verification.txt
source-slices.txt
prior-art.md
patch-control.diff

Impact

This is a use-after-free that can result in native Ruby process termination.

An attacker must be able to supply JSON stream data to an application that:

uses JSON::ResumableParser;
processes attacker-controlled streaming input;
calls partial_value after parsing an incomplete document containing duplicate object keys.

In network-facing deployments meeting these conditions, an attacker can cause process termination and denial of service.

The release-build crash was reproduced consistently in the tested Linux environment. The AddressSanitizer result confirms the underlying heap-use-after-free independently of normal allocator behavior.

The demonstrated impact is:

Denial of service through native process termination

No confidentiality impact, integrity impact, arbitrary code execution, or information disclosure is claimed.

Suggested remediation

Before clearing or releasing the resumable parser's input buffer, invalidate or replace every parser-state pointer that refers to the buffer's backing storage.

Delayed code paths such as duplicate-key warning generation must not calculate cursor positions using pointers after the corresponding buffer has been released.

The attached patch-control.diff demonstrates one tested control and is provided for validation rather than as a required final implementation.

Release Notes

2.21.2

What's Changed

Fix a use-after-free bug in JSON::ResumableParser. [GHSA-9hj4-r449-hfvc].

Full Changelog: v2.21.1...v2.21.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

Update json to version 2.21.2

b24e2ce

depfu Bot added the depfu label Aug 7, 2026

Navigation Menu

Uh oh!

🚨 [security] [ruby] Update json 2.21.1 → 2.21.2 (patch) - #144

🚨 [security] [ruby] Update json 2.21.1 → 2.21.2 (patch)#144
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/json-2.21.2

depfu Bot commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

depfu Bot commented Aug 7, 2026

What changed?

↗️ json (indirect, 2.21.1 → 2.21.2) · Repo · Changelog

🚨 Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Summary

Details

PoC

Requirements

Release-build, network, and differential reproduction

AddressSanitizer reproduction

Affected-version matrix

Impact

Suggested remediation

2.21.2

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants