Releases · github/cmark-gfm

Improved fixes for polynomial time complexity issues per GHSA-66g8-4hjf-77xh (#323, #324)
Added fuzzing target for bracketed patterns (#318)
Fixed bug in list numbering introduced in 763587e (#322) which caused list numbers to increment by 2
Fixed strict prototype clang warning (#310)
Fixed regression test (#312)
Added additional output formats to quadratic fuzzer (#327)
Fixed buffer overflow in fuzzing harness (#326)

Note: these changes may lead to minor changes in expected output on plaintext rendering of list items. Notably, blank lines may no longer delineate the start of a list when rendering to plaintext due to changes in how the tight list status is calculated.

Assets 2

31 Mar 17:57

anticomputer

0.29.0.gfm.10

dcf6b38

0.29.0.gfm.10

Changes since last release (0.29.0.gfm.9...0.29.0.gfm.10):

Fixed polynomial time complexity issue per
GHSA-r8vr-c48j-fcc5
Fixed polynomial time complexity issues per
GHSA-66g8-4hjf-77xh

Note: these changes remove redundant bold tag nesting which may result
in existing rendering tests failing, e.g. rendering ____bold____ to html
will no longer yield bold.

Assets 2

31 Jan 16:15

phillmv

0.29.0.gfm.9

c32ef78

0.29.0.gfm.9

Changes since last release (0.29.0.gfm.8...0.29.0.gfm.9):

Code was tidied:

Use of a private header was cleaned up #248
Man page was update #255
Warnings for -Wstrict-prototypes were cleaned up #285
We avoid header duplication #289

New functionality:

We now store positioning info for url_match #201
We now expose cmark_parent_footnote_def for non-C renderers #254
Footnote aria-label text now reference the specific footnote backref, and we include a data-footnote-backref-idx attribute so the label can be internationalized in a downstream filter #307

Assets 2

25 Jan 20:04

anticomputer

0.29.0.gfm.8

eb32891

0.29.0.gfm.8

Changes since last release (0.29.0.gfm.7...0.29.0.gfm.8):

We restored backwards compatibility by deprecating the cmark_init_standard_node_flags() requirement, which is now a noop (#305)
We added a quadratic complexity fuzzing target (#304)

Assets 2

23 Jan 21:50

anticomputer

0.29.0.gfm.7

57d5e09

0.29.0.gfm.7

Changes since last release (0.29.0.gfm.6...0.29.0.gfm.7):

Fixed CVE-2023-22486, a polynomial time complexity issue in cmark-gfm which may lead to unbounded resource exhaustion and subsequent denial of service.
Fixed CVE-2023-22485, in which a crafted markdown document could trigger an out-of-bounds read in the validate_protocol function.
Fixed CVE-2023-22484, a polynomial time complexity issue in cmark-gfm which may lead to unbounded resource exhaustion and subsequent denial of service.
Fixed CVE-2023-22483, several polynomial time complexity issues in cmark-gfm which may lead to unbounded resource exhaustion and subsequent denial of service.
We removed an unneeded .DS_Store file (#291)
We added a test for domains with underscores and fix roundtrip behavior (#292)
We now use an up-to-date clang-format (#294)
We made a variety of implicit integer truncations explicit by moving to size_t as our standard size integer type (#302)
We introduced a new flag mechanism that is used in cmark node state management, which requires clients call the cmark_init_standard_node_flags function at program startup (420c20a)