Skip to content

13.0.1

Latest
Compare
Choose a tag to compare
@jandupej jandupej released this 02 Oct 14:43
· 2 commits to master since this release

13.0.1: 2024-10-02

  • IDL core version: 3.0
  • C++ version: 13.0.1
  • C# NuGet version: 13.0.1
  • Java version: 13.0.1
  • gbc & compiler library: 0.13.0.0

Java

  • There were no Java changes in this release.

C++

  • InputBuffer throws a StreamException when trying to skip beyond the
    end of the stream. This mitigates a CPU DoS vulnerability.
  • Deserialization from JSON payloads will no longer process very deeply
    nested structures. Instead, a bond::CoreException will be thrown in
    order to protect against stack overflows. The depth limit may be changed
    by calling the function bond::SetDeserializeMaxDepth(uint32_t).
  • Breaking change: Protocols must now implement CanReadArray method and
    Buffers must implement CanRead method. These are used to perform checks that
    mitigate memory allocation vulnerabilities.
  • Breaking change: Custom containers must implement reset_list and list_insert.
    Standard implementations are provided. This API is used to incrementally fill
    containers of complex types when preallocation may be unsafe. Expected container
    size is provided in reset_list, where client code can perform sanity checks before
    any memory is allocated by Bond.
  • bond::CoreException is thrown when the payload has a greater declared size
    than the backing buffer.
  • Known issue: Debug builds with MSVC 14.0 (Visual Studio 2015) may fail at
    runtime if custom allocators for containers are used. Newer MSVC versions and
    other compilers are not affected, neither are Release builds with MSVC 14.0. This
    can be worked around by using newer MSVC version or building in Release configuration.
  • Added support for Boost 1.83.

C#

  • Fixed compatibility with .NET 9.