Update release notes for 5.0.3 release

Allows a buffer overflow in PVUnionArray::serialize().
(cherry picked from commit 14b0e409f2)

README.md

@@ -1,7 +1,8 @@
 pvaDataCPP
 ==========
 
-pvDataCPP is a set of data types and utilities that form part of the EPICS V4 project.
+pvDataCPP is a set of data types and utilities that form part of the EPICS V4 
+project.
 
 
 Further Info

documentation/RELEASE_NOTES.html

@@ -1,6 +1,16 @@
-<h1>Release 5.0</h1>
+<h1>Release 5.0.3</h1>
 
-<p>The main changes since release 4.0 are:</p>
+<p>The only change since release 5.0.2 is:</p>
+
+<h2>Fixed buffer overflow in PVUnion::serialize() (issue #20)</h2>
+
+<p>A PVUnion whose stored value was null was serialized without checking 
+whether the buffer had sufficient capacity. This has been fixed by calling
+ensureBuffer().</p>
+
+<h1>Release 5.0.2</h1>
+
+<p>The main changes since release 4.0.3 are:</p>
 
 <ul>
 <li>Deprecated getXXXField() methods have been removed from PVStructure</li>
@@ -133,7 +143,7 @@ pvData had issues due to PVStructure::DEFAULT_ID being used before being initial
 This has been changed so the it returns a null pvStructure
 and provides an error.</p>
 
-<h1>Release 4.0</h1>
+<h1>Release 4.0.3</h1>
 
 <p>The main changes since release 3.0.2 are:</p>
 

documentation/RELEASE_NOTES.md

@@ -1,7 +1,20 @@
-Release 5.0
-===========
+Release 5.0.3
+=============
 
-The main changes since release 4.0 are:
+The only change since release 5.0.2 is:
+
+Fixed buffer overflow in PVUnion::serialize() (issue #20)
+---------------------------------------------------------
+
+A PVUnion whose stored value was null was serialized without checking 
+whether the buffer had sufficient capacity. This has been fixed by calling
+ensureBuffer().
+
+
+Release 5.0.2
+=============
+
+The main changes since release 4.0.3 are:
 
 * Deprecated getXXXField() methods have been removed from PVStructure
 * Convert copy methods and equals operators (re)moved
@@ -15,7 +28,7 @@ The main changes since release 4.0 are:
 
 
 Deprecated getXXXField methods have been removed from PVStructure
--------------------------------------------------------------------
+-----------------------------------------------------------------
 
 The following methods have been removed from PVStructure
 
@@ -141,8 +154,8 @@ This has been changed so the it returns a null pvStructure
 and provides an error.
 
 
-Release 4.0
-===========
+Release 4.0.3
+=============
 
 The main changes since release 3.0.2 are:
 

src/factory/PVUnion.cpp

@@ -145,10 +145,10 @@ void PVUnion::serialize(ByteBuffer *pbuffer, SerializableControl *pflusher) cons
     if (variant)
     {
         // write introspection data
-        if (value.get() == 0)
+        if (value.get() == 0) {
+            pflusher->ensureBuffer(1);
             pbuffer->put((int8)-1);
-        else
-        {
+        }else {
             pflusher->cachedSerialize(value->getField(), pbuffer);
             value->serialize(pbuffer, pflusher);
         }