svn commit: r342216 - in head/textproc/libyaml: . files
Josh Paetzel
jpaetzel at FreeBSD.org
Sat Feb 1 22:39:01 UTC 2014
Author: jpaetzel
Date: Sat Feb 1 22:39:00 2014
New Revision: 342216
URL: http://svnweb.freebsd.org/changeset/ports/342216
QAT: https://qat.redports.org/buildarchive/r342216/
Log:
Patches that address CVE-2013-6393
Added:
head/textproc/libyaml/files/patch-src-api.c (contents, props changed)
head/textproc/libyaml/files/patch-src-scanner.c (contents, props changed)
Modified:
head/textproc/libyaml/Makefile
Modified: head/textproc/libyaml/Makefile
==============================================================================
--- head/textproc/libyaml/Makefile Sat Feb 1 22:26:42 2014 (r342215)
+++ head/textproc/libyaml/Makefile Sat Feb 1 22:39:00 2014 (r342216)
@@ -3,7 +3,7 @@
PORTNAME= libyaml
PORTVERSION= 0.1.4
-PORTREVISION= 2
+PORTREVISION= 3
CATEGORIES= textproc
MASTER_SITES= http://pyyaml.org/download/libyaml/
DISTNAME= yaml-${PORTVERSION}
Added: head/textproc/libyaml/files/patch-src-api.c
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/textproc/libyaml/files/patch-src-api.c Sat Feb 1 22:39:00 2014 (r342216)
@@ -0,0 +1,26 @@
+# HG changeset patch
+# User Florian Weimer <fweimer at redhat.com>
+# Date 1389274355 -3600
+# Thu Jan 09 14:32:35 2014 +0100
+# Node ID 034d7a91581ac930e5958683f1a06f41e96d24a2
+# Parent a54d7af707f25dc298a7be60fd152001d2b3035b
+yaml_stack_extend: guard against integer overflow
+
+diff --git a/src/api.c b/src/api.c
+--- src/api.c
++++ src/api.c
+@@ -117,7 +117,12 @@
+ YAML_DECLARE(int)
+ yaml_stack_extend(void **start, void **top, void **end)
+ {
+- void *new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2);
++ void *new_start;
++
++ if ((char *)*end - (char *)*start >= INT_MAX / 2)
++ return 0;
++
++ new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2);
+
+ if (!new_start) return 0;
+
+
Added: head/textproc/libyaml/files/patch-src-scanner.c
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/textproc/libyaml/files/patch-src-scanner.c Sat Feb 1 22:39:00 2014 (r342216)
@@ -0,0 +1,141 @@
+# HG changeset patch
+# User John Eckersberg <jeckersb at redhat.com>
+# Date 1390870108 18000
+# Mon Jan 27 19:48:28 2014 -0500
+# Node ID 7179aa474f31e73834adda26b77bfc25bfe5143d
+# Parent 3e6507fa0c26d20c09f8f468f2bd04aa2fd1b5b5
+yaml_parser-{un,}roll-indent: fix int overflow in column argument
+
+diff -r 3e6507fa0c26 -r 7179aa474f31 src/scanner.c
+--- src/scanner.c Mon Dec 24 03:51:32 2012 +0000
++++ src/scanner.c Mon Jan 27 19:48:28 2014 -0500
+@@ -615,11 +615,14 @@
+ */
+
+ static int
+-yaml_parser_roll_indent(yaml_parser_t *parser, int column,
++yaml_parser_roll_indent(yaml_parser_t *parser, size_t column,
+ int number, yaml_token_type_t type, yaml_mark_t mark);
+
+ static int
+-yaml_parser_unroll_indent(yaml_parser_t *parser, int column);
++yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column);
++
++static int
++yaml_parser_reset_indent(yaml_parser_t *parser);
+
+ /*
+ * Token fetchers.
+@@ -1206,7 +1209,7 @@
+ */
+
+ static int
+-yaml_parser_roll_indent(yaml_parser_t *parser, int column,
++yaml_parser_roll_indent(yaml_parser_t *parser, size_t column,
+ int number, yaml_token_type_t type, yaml_mark_t mark)
+ {
+ yaml_token_t token;
+@@ -1216,7 +1219,7 @@
+ if (parser->flow_level)
+ return 1;
+
+- if (parser->indent < column)
++ if (parser->indent == -1 || parser->indent < column)
+ {
+ /*
+ * Push the current indentation level to the stack and set the new
+@@ -1254,7 +1257,7 @@
+
+
+ static int
+-yaml_parser_unroll_indent(yaml_parser_t *parser, int column)
++yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column)
+ {
+ yaml_token_t token;
+
+@@ -1263,6 +1266,15 @@
+ if (parser->flow_level)
+ return 1;
+
++ /*
++ * column is unsigned and parser->indent is signed, so if
++ * parser->indent is less than zero the conditional in the while
++ * loop below is incorrect. Guard against that.
++ */
++
++ if (parser->indent < 0)
++ return 1;
++
+ /* Loop through the intendation levels in the stack. */
+
+ while (parser->indent > column)
+@@ -1283,6 +1295,41 @@
+ }
+
+ /*
++ * Pop indentation levels from the indents stack until the current
++ * level resets to -1. For each intendation level, append the
++ * BLOCK-END token.
++ */
++
++static int
++yaml_parser_reset_indent(yaml_parser_t *parser)
++{
++ yaml_token_t token;
++
++ /* In the flow context, do nothing. */
++
++ if (parser->flow_level)
++ return 1;
++
++ /* Loop through the intendation levels in the stack. */
++
++ while (parser->indent > -1)
++ {
++ /* Create a token and append it to the queue. */
++
++ TOKEN_INIT(token, YAML_BLOCK_END_TOKEN, parser->mark, parser->mark);
++
++ if (!ENQUEUE(parser, parser->tokens, token))
++ return 0;
++
++ /* Pop the indentation level. */
++
++ parser->indent = POP(parser, parser->indents);
++ }
++
++ return 1;
++}
++
++/*
+ * Initialize the scanner and produce the STREAM-START token.
+ */
+
+@@ -1338,7 +1385,7 @@
+
+ /* Reset the indentation level. */
+
+- if (!yaml_parser_unroll_indent(parser, -1))
++ if (!yaml_parser_reset_indent(parser))
+ return 0;
+
+ /* Reset simple keys. */
+@@ -1369,7 +1416,7 @@
+
+ /* Reset the indentation level. */
+
+- if (!yaml_parser_unroll_indent(parser, -1))
++ if (!yaml_parser_reset_indent(parser))
+ return 0;
+
+ /* Reset simple keys. */
+@@ -1407,7 +1454,7 @@
+
+ /* Reset the indentation level. */
+
+- if (!yaml_parser_unroll_indent(parser, -1))
++ if (!yaml_parser_reset_indent(parser))
+ return 0;
+
+ /* Reset simple keys. */
+
More information about the svn-ports-all
mailing list