/ 
Sereal-Decoder-5.010
⭐ Starred 413
Security Advisories (1)
CVE-2018-12913 (2018-06-27)

In Miniz 2.0.7, tinfl_decompress in miniz_tinfl.c has an infinite loop because sym2 and counter can both remain equal to zero.

Changes for version 5.010

  • Reset the pending frozen-object state (thaw_av and ref_thawhash) at the start of every decode. A decode that died before srl_finalize_structure ran -- a truncated document, for example -- left those populated, and the next decode on the same decoder then thawed items belonging to the failed document and looked up ref_thawhash keys pointing at freed AVs. That segfaulted or silently produced the wrong class. See https://github.com/Sereal/Sereal/pull/316

Modules

Sereal::Decoder
Fast, compact, powerful binary deserialization
Sereal::Performance
Getting the most out of the Perl-Sereal implementation

Provides

Sereal::Decoder::Constants
in lib/Sereal/Decoder/Constants.pm

Other files