Merge branch 'main' into dev

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: "daily"
+  target-branch: "main"

.github/workflows/build.yml

@@ -0,0 +1,140 @@
+name: CI
+permissions: read-all
+
+on:
+  push:
+    branches: [ main, dev ]
+  pull_request:
+    branches: [ main, dev ]
+
+
+# When a PR is updated, cancel the jobs from the previous version. Merges
+# do not define head_ref, so use run_id to never cancel those jobs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  TinyCBOR:
+    timeout-minutes: 45
+    # Common environment variables
+    env:
+      HOMEBREW_NO_INSTALL_CLEANUP: 1
+      HOMEBREW_NO_ANALYTICS: 1
+
+    strategy:
+      # Always run all jobs in the matrix, even if one fails.
+      fail-fast: false
+      matrix:
+        os: [ ubuntu-latest ]
+        build_cfg: [
+          { "name": "gcc-no-math",
+            "flags":
+              '{ "QMAKESPEC": "linux-gcc-no-math",
+                 "EVAL": "export CXX=false && touch math.h float.h",
+                 "CFLAGS": "-ffreestanding -DCBOR_NO_FLOATING_POINT -Os",
+                 "LDFLAGS": "-Wl,--no-undefined",
+                 "LDLIBS": ""
+              }',
+          },
+          { "name": "gcc-freestanding",
+            "flags":
+              '{ "QMAKESPEC": "linux-gcc-freestanding",
+                 "EVAL": "export CXX=false",
+                 "CFLAGS": "-ffreestanding -Os",
+                 "LDFLAGS": "-Wl,--no-undefined -lm"
+              }',
+          },
+          { "name": "clang",
+            "flags":
+              '{ "QMAKESPEC": "linux-clang",
+                 "EVAL": "export CC=clang && export CXX=clang++",
+                 "CFLAGS": "-Oz",
+                 "LDFLAGS": "-Wl,--no-undefined -lm",
+                 "QMAKEFLAGS": "-config release",
+                 "MAKEFLAGS": "-s",
+                 "TESTARGS": "-silent"
+              }',
+          },
+          { "name": "linux-g++",
+            "flags":
+              '{ "QMAKESPEC": "linux-g++",
+                 "EVAL": "export CC=gcc && export CXX=g++",
+                 "CFLAGS": "-Os",
+                 "LDFLAGS": "-Wl,--no-undefined -lm",
+                 "QMAKEFLAGS": "-config release",
+                 "QT_NO_CPU_FEATURE": "rdrnd"
+              }'
+          }
+        ]
+        include:
+          - os: macos-13
+            build_cfg: { "name": "clang",
+                         "flags":
+                           '{ "QMAKESPEC": "macx-clang",
+                              "EVAL": "export CC=clang && export CXX=clang++",
+                              "CFLAGS": "-Oz",
+                              "QMAKEFLAGS": "-config debug",
+                              "MAKEFLAGS": "-s",
+                              "TESTARGS": "-silent",
+                              "PATH": "/usr/local/opt/qt/bin:$PATH"
+                            }'
+                        }
+
+    # Default job name is too long to be visible in the "Checks" tab.
+    name: ${{ matrix.os }}/${{ matrix.build_cfg.name }}
+    # The type of runner that the job will run on
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Clone tinycbor
+      uses: actions/checkout@v4
+
+    - name: install Linux software
+      if: matrix.os == 'ubuntu-latest'
+      run: |
+        # Need a recent Valgrind, otherwise debug info cannot be read.
+        sudo snap install valgrind --classic
+        sudo apt-get update
+        sudo apt-get install -y --no-install-recommends \
+          doxygen \
+          jq \
+          libc6-dbg \
+          libcjson-dev \
+          libfuntools-dev \
+          qtbase5-dev
+
+    - name: install macOS software
+      if: runner.os == 'macOS'
+      run: |
+        # Doxygen 1.9.7 is broken with ifdefs again, install 1.9.4 which works.
+        wget https://raw.githubusercontent.com/Homebrew/homebrew-core/41828ee36b96e35b63b2a4c8cfc2df2c3728944a/Formula/doxygen.rb
+        brew install doxygen.rb
+        rm doxygen.rb
+        brew install qt cjson
+
+    - name: Execute tests
+      run: |
+        set -x
+        PATH=`echo /opt/qt*/bin`:$PATH
+        eval $(echo '${{ matrix.build_cfg.flags }}' | jq -r 'to_entries[] | "\(.key)=\"\(.value)\""')
+        eval "$EVAL"
+        # FIXME: remove -Wno-error-line below.
+        export CFLAGS="$CFLAGS -Wno-error=implicit-function-declaration"
+        make OUT=.config V=1 -s -f Makefile.configure configure && cat .config
+        make -k \
+            CFLAGS="$CFLAGS -march=native -g1 -Wall -Wextra -Werror" \
+            CPPFLAGS="-DNDEBUG -DCBOR_ENCODER_WRITER_CONTROL=-1 -DCBOR_PARSER_READER_CONTROL=-1" \
+            lib/libtinycbor.a
+        size lib/libtinycbor.a | tee sizes
+        make -s clean
+        make -k \
+            CFLAGS="$CFLAGS -O0 -g" \
+            LDFLAGS="$LDFLAGS" ${LDLIBS+LDLIBS="$LDLIBS"}
+        grep -q freestanding-pass .config || make \
+            QMAKEFLAGS="$QMAKEFLAGS QMAKE_CXX=$CXX" \
+            tests/Makefile
+        grep -q freestanding-pass .config || \
+            (cd tests && make TESTARGS=-silent check -k \
+            TESTRUNNER=`which valgrind 2>/dev/null`)
+        make -s clean
+        ! [ $BUILD_DOCS ] || ./scripts/update-docs.sh

Makefile

@@ -65,20 +65,6 @@ VERSION = $(shell cat $(SRCDIR)VERSION)
 SOVERSION = $(shell cut -f1-2 -d. $(SRCDIR)VERSION)
 PACKAGE = tinycbor-$(VERSION)
 
-# Check that QMAKE is Qt 5
-ifeq ($(origin QMAKE),file)
-  check_qmake = $(strip $(shell $(1) -query QT_VERSION 2>/dev/null | cut -b1))
-  ifneq ($(call check_qmake,$(QMAKE)),5)
-    QMAKE := qmake -qt5
-    ifneq ($(call check_qmake,$(QMAKE)),5)
-      QMAKE := qmake-qt5
-      ifneq ($(call check_qmake,$(QMAKE)),5)
-        QMAKE := @echo >&2 $(MAKEFILE): Cannot find a Qt 5 qmake; false
-      endif
-    endif
-  endif
-endif
-
 -include .config
 
 ifeq ($(wildcard .config),)

Makefile.configure

@@ -15,11 +15,12 @@ PROGRAM-freestanding += int main() {}
 CCFLAGS-freestanding = $(CFLAGS)
 
 PROGRAM-cjson  = \#include <stdlib.h>\n
+PROGRAM-cjson += \#include <math.h>\n
 PROGRAM-cjson += \#include <cjson/cJSON.h>\n
-PROGRAM-cjson += int main() { return cJSON_False; }
-CCFLAGS-cjson = -I$(dir $(MAKEFILE))src
+PROGRAM-cjson += int main() { double d = NAN; return cJSON_False; }
+CCFLAGS-cjson = -I. -I$(dir $(MAKEFILE))src
 PROGRAM-system-cjson = $(PROGRAM-cjson)
-CCFLAGS-system-cjson = -lcjson
+CCFLAGS-system-cjson = -I. -lcjson
 
 sink:
 	@echo >&2 Please run from the top-level Makefile.

SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+Intel is committed to rapidly addressing security vulnerabilities affecting our customers and providing clear guidance on the solution, impact, severity and mitigation.
+
+## Reporting a Vulnerability
+Please report any security vulnerabilities in this project utilizing the guidelines [here](https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html).

examples/simplereader.c

@@ -178,7 +178,7 @@ int main(int argc, char **argv)
 
     if (err) {
         fprintf(stderr, "CBOR parsing failure at offset %ld: %s\n",
-                it.ptr - buf, cbor_error_string(err));
+                cbor_value_get_next_byte(&it) - buf, cbor_error_string(err));
         return 1;
     }
     return 0;

src/cborparser_dup_string.c

@@ -35,14 +35,8 @@
 
 #include "cbor.h"
 #include "compilersupport_p.h"
+#include "memory.h"
 
-#if defined(CBOR_CUSTOM_ALLOC_INCLUDE)
-#  include CBOR_CUSTOM_ALLOC_INCLUDE
-#else
-#  include <stdlib.h>
-#  define cbor_malloc malloc
-#  define cbor_free   free
-#endif
 
 /**
  * \fn CborError cbor_value_dup_text_string(const CborValue *value, char **buffer, size_t *buflen, CborValue *next)

src/cbortojson.c

@@ -35,6 +35,7 @@
 #include "cborinternal_p.h"
 #include "compilersupport_p.h"
 #include "cborinternal_p.h"
+#include <memory.h>
 
 #include <inttypes.h>
 #include <stdio.h>
@@ -179,7 +180,7 @@ static CborError dump_bytestring_base16(char **result, CborValue *it)
         return err;
 
     /* a Base16 (hex) output is twice as big as our buffer */
-    buffer = (uint8_t *)malloc(n * 2 + 1);
+    buffer = (uint8_t *)cbor_malloc(n * 2 + 1);
     if (buffer == NULL)
         /* out of memory */
         return CborErrorOutOfMemory;
@@ -209,7 +210,7 @@ static CborError generic_dump_base64(char **result, CborValue *it, const char al
 
     /* a Base64 output (untruncated) has 4 bytes for every 3 in the input */
     size_t len = (n + 5) / 3 * 4;
-    buffer = (uint8_t *)malloc(len + 1);
+    buffer = (uint8_t *)cbor_malloc(len + 1);
     if (buffer == NULL)
         /* out of memory */
         return CborErrorOutOfMemory;
@@ -395,7 +396,7 @@ static CborError tagged_value_to_json(FILE *out, CborValue *it, int flags, Conve
         if (err)
             return err;
         err = fprintf(out, "\"%s%s\"", pre, str) < 0 ? CborErrorIO : CborNoError;
-        free(str);
+        cbor_free(str);
         status->flags = TypeWasNotNative | TypeWasTagged | CborByteStringType;
         return err;
     }
@@ -467,7 +468,7 @@ static CborError map_to_json(FILE *out, CborValue *it, int flags, ConversionStat
 
         /* first, print the key */
         if (fprintf(out, "\"%s\":", key) < 0) {
-            free(key);
+            cbor_free(key);
             return CborErrorIO;
         }
 
@@ -489,7 +490,7 @@ static CborError map_to_json(FILE *out, CborValue *it, int flags, ConversionStat
             }
         }
 
-        free(key);
+        cbor_free(key);
         if (err)
             return err;
     }
@@ -568,7 +569,7 @@ static CborError value_to_json(FILE *out, CborValue *it, int flags, CborType typ
         if (err)
             return err;
         err = (fprintf(out, "\"%s\"", str) < 0) ? CborErrorIO : CborNoError;
-        free(str);
+        cbor_free(str);
         return err;
     }
 

src/compilersupport_p.h

@@ -44,14 +44,14 @@
 #  include <stdbool.h>
 #endif
 
-#if __STDC_VERSION__ >= 201112L || (defined(__cplusplus) && __cplusplus >= 201103L) || (defined(__cpp_static_assert) && __cpp_static_assert >= 200410)
+#if (defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L) || (defined(__cplusplus) && __cplusplus >= 201103L) || (defined(__cpp_static_assert) && __cpp_static_assert >= 200410)
 #  define cbor_static_assert(x)         static_assert(x, #x)
 #elif !defined(__cplusplus) && defined(__GNUC__) && (__GNUC__ * 100 + __GNUC_MINOR__ >= 406) && (__STDC_VERSION__ > 199901L)
 #  define cbor_static_assert(x)         _Static_assert(x, #x)
 #else
 #  define cbor_static_assert(x)         ((void)sizeof(char[2*!!(x) - 1]))
 #endif
-#if __STDC_VERSION__ >= 199901L || defined(__cplusplus)
+#if (defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L) || defined(__cplusplus)
 /* inline is a keyword */
 #else
 /* use the definition from cbor.h */

src/memory.h

@@ -0,0 +1,31 @@
+/****************************************************************************
+**
+** Copyright (C) 2016 Intel Corporation
+**
+** Permission is hereby granted, free of charge, to any person obtaining a copy
+** of this software and associated documentation files (the "Software"), to deal
+** in the Software without restriction, including without limitation the rights
+** to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+** copies of the Software, and to permit persons to whom the Software is
+** furnished to do so, subject to the following conditions:
+**
+** The above copyright notice and this permission notice shall be included in
+** all copies or substantial portions of the Software.
+**
+** THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+** IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+** FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+** AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+** LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+** OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+** THE SOFTWARE.
+**
+****************************************************************************/
+
+#if defined(CBOR_CUSTOM_ALLOC_INCLUDE)
+#  include CBOR_CUSTOM_ALLOC_INCLUDE
+#else
+#  include <stdlib.h>
+#  define cbor_malloc malloc
+#  define cbor_free   free
+#endif

tests/tests.pro

@@ -1,3 +1,3 @@
 TEMPLATE = subdirs
-SUBDIRS = parser encoder c90 cpp tojson
+SUBDIRS = parser encoder cpp tojson
 msvc: SUBDIRS -= tojson