QCBOR 1.4.1

There are no known problems or test failures in 1.4, but this fix should be picked up. This restores some defensiveness in decoding that was present in v1.3.

Specifically it is defensive decoding of reserved values (28, 29, 30) in additional info in the CBOR head. The change is to put the QCBORItem initialization back in the right place. From analysis of the code, the only effect was when the header decode returned QCBOR_ERR_UNSUPPORTED, a recoverable error. It is assumed that no caller would examine the secondary fields of QCBORItem when this error occurs, so there's no issue.

QCBOR v1.4

This release is the largest in a while. It fixes some small bugs in features that aren't used that often. It adds a few features and improves documentation and test. Backwards compatibility is retained. There's no reason not to upgrade to this version.

Feature Additions:

• Added QCBORDecode_GetArray() and QCBORDecode_GetMap() and related. These return the undecoded CBOR for an array or map.
• Added QCBORDecode_Tell() to report decode traversal cursor position.
• Add EndCheck() to tell if the decode traversal cursor is at the end of the input.
• Add QCBORDecode_AddSimple(). This is just for future-defined simple values. AddBool(), AddNULL() and AddUndef() have been supported for years.
• Added UsefulBuf_OffsetToPointer() and UsefulInputBuf_PointerToOffset().
• New compiler option QCBOR_DISABLE_NON_INTEGER_LABELS that reduces object code for protocols that use only integer map labels.
• Installation using CMake

Bug Fixes:

• CI correctly tests all the QCBOR_DISABLE_XXX configurations
• QCBORDecode_GetNthTagOfLast() works correctly for all spiffy decode functions
• QCBORDecode_GetItemInMapN() and QCBORDecode_GetItemInMapSZ() set the label and data types to QCBOR_TYPE_NONE when the decode is in error.
• QCBORDecode_GetXXXInX() traversal cursor bug fix. The bug occurred when mixing spiffy decode fetch by label with traversal using GetNext().
• Bug fixes for QCBOR_DECODE_MODE_MAP_AS_ARRAY mode so it works with indefinite-length strings and with QCBORDecode_EnterArray() and QCBORDecode_GetArray() (this mode is to decode unusual map labels and is not commonly used).
• QCBOR_Int64ToUInt16() was incorrectly named. The old incorrect name still works too.
• qcbor_err_to_str() is update date for all the recently added error codes.

Other:

• QCBORDecode_Private_ExpMantissa() refactoring. It will produce more accurate error codes.
• QCBORDecode_EnterBstrWrapped() produces better error code when attempted on allocated (e.g., indef length) strings.
• Size optimizations, particularly to reduce object code size for an encode minimal use case.
• Some refactoring of the decoder to reduce object code size and for code clarity and organization.
• Bring UsefulBuf test coverage to 100%.

QCBOR v1.3

This is a fully backwards compatible update that everyone should pick up. The majority of lines changed were only for documentation and code tidiness. Some small bugs are fixed and one feature addition.

• Floating-point conversion between half, single and double-precision for subnormal values and NaN payloads is completed. These are relatively obscure unused parts of IEEE754 floats.
• QCBOREncode_GetErrorState() can now be called after QCBOREncode_Finish() and it will always return the correct error.
• User-defined error codes are now supported. The error state can be set with the new function QCBORDecode_SetError().
• Fixed a rare condition where QCBORDecode_ VGetNext() would not set the Item.uDataType to QCBOR_TYPE_NONE on error.
• Function naming changed to better avoid name collision. This includes internal functions. This is to compensate for C not having name spaces like C++.
• Documentation correctly describes mixing of traversal cursor used by GetNext with fetch by label in entered maps
• Some increase in test coverage
• A bunch of "TODO:" items were addressed. Most result in no change to the code, just changes to documentation and test coverage.

QCBOR v1.2

This release addresses static analyzer warnings about INT64_MIN for decoding big floats and decimal fractions and addresses warnings for adding empty data/string items. In practice, the issues underlying these warnings are not known to cause any problems. Both gcc and clang produce correct code without these fixes. Test coverage for this in previous versions of QCBOR also indicated no problems.

There are no API changes in this release. It is compatible with previous releases.

Picking up this fix is recommended as the implementation is clearly more correct C code.

This release also substantially improves building with CMake.

QCBOR 1.1

QCBOR 1.1 is some small feature additions and some small bug fixes.

The bug fixes are primarily for decoding malformed input. There are
no security issues (no buffer overruns), though in one case an infinite loop occurs.

There are no compatibility issues relative to QCBOR 1.0. The only
API change is the addition of QCBOREncode_OpenBytes and related. The QCBOR_1_1 is #define'd to indicate the version is 1.1.

It is recommended that all users of QCBOR pick up this release.
It is a simple upgrade.

Features

• Add QCBOREncode_OpenBytes()
• Improved documentation for disabling parts of QCBOR
• Improved examples

Fixes

• Better naming of #defines for standard tag numbers
• All floating point tests are now properly disabled when all floating point is disabled.
• Bad input (e.g., not well formed maps) would result in an infinite loop for some spiffy decode API use.
• Fix compiler warnings with Microsoft compiler
• Calling QCBOREncode_CloseArray() and related incorrectly (multiple times) could put QCBOR in an undefined state.
• Zero-length indefinite-length string chunks are now correctly ignored rather than causing an error.

v1.0

QCBOR 1.0

This is the start of making formal releases of QCBOR.

This 1.0 release is stable with no known issues. It is suitable for commercial deployment.

Changes in the last year have been small feature additions, improved documentation and portability improvements. The last major change was the addition of spiffy decode in late 2020.

QCBOR has been stable and of commercial quality for over three years.

QCBOR is maintained by Laurence Lundblade [email protected]