diff options
author | Baptiste Daroussin <bapt@FreeBSD.org> | 2014-02-03 08:00:45 +0000 |
---|---|---|
committer | Baptiste Daroussin <bapt@FreeBSD.org> | 2014-02-03 08:00:45 +0000 |
commit | 5c7ba42d2e90bdd94bb55c80d0787e998fad44f9 (patch) | |
tree | 5d4be90b0b95a267e30acf55fc6cce2862b2199b | |
parent | 02a50482f806730d8afb6c2c0cc60e3c661b1ea4 (diff) | |
download | src-vendor/libyaml.tar.gz src-vendor/libyaml.zip |
Apply patch for CVE-2013-6393 [1] to fix heap-based buffer overflow whenvendor/libyaml
parsing YAML tags.
Also apply a patch for hardenning the guards againt the issue
The only user in base in yaml is pkg(7) which uses the library a way that it is not affected
Submitted by: delphij
Obtained from: https://bugzilla.redhat.com/show_bug.cgi?id=1033990
Security: CVE-2013-6393
Notes
Notes:
svn path=/vendor/libyaml/dist/; revision=261429
-rw-r--r-- | src/api.c | 7 | ||||
-rw-r--r-- | src/scanner.c | 63 |
2 files changed, 61 insertions, 9 deletions
diff --git a/src/api.c b/src/api.c index 0c4732e1520d..68bc2d8e9b0b 100644 --- a/src/api.c +++ b/src/api.c @@ -117,7 +117,12 @@ yaml_string_join( YAML_DECLARE(int) yaml_stack_extend(void **start, void **top, void **end) { - void *new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2); + void *new_start; + + if ((char *)*end - (char *)*start >= INT_MAX / 2) + return 0; + + new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2); if (!new_start) return 0; diff --git a/src/scanner.c b/src/scanner.c index a2e861926476..1aaadc40a004 100644 --- a/src/scanner.c +++ b/src/scanner.c @@ -615,11 +615,14 @@ yaml_parser_decrease_flow_level(yaml_parser_t *parser); */ static int -yaml_parser_roll_indent(yaml_parser_t *parser, int column, +yaml_parser_roll_indent(yaml_parser_t *parser, size_t column, int number, yaml_token_type_t type, yaml_mark_t mark); static int -yaml_parser_unroll_indent(yaml_parser_t *parser, int column); +yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column); + +static int +yaml_parser_reset_indent(yaml_parser_t *parser); /* * Token fetchers. @@ -1206,7 +1209,7 @@ yaml_parser_decrease_flow_level(yaml_parser_t *parser) */ static int -yaml_parser_roll_indent(yaml_parser_t *parser, int column, +yaml_parser_roll_indent(yaml_parser_t *parser, size_t column, int number, yaml_token_type_t type, yaml_mark_t mark) { yaml_token_t token; @@ -1216,7 +1219,7 @@ yaml_parser_roll_indent(yaml_parser_t *parser, int column, if (parser->flow_level) return 1; - if (parser->indent < column) + if (parser->indent == -1 || parser->indent < column) { /* * Push the current indentation level to the stack and set the new @@ -1254,7 +1257,7 @@ yaml_parser_roll_indent(yaml_parser_t *parser, int column, static int -yaml_parser_unroll_indent(yaml_parser_t *parser, int column) +yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column) { yaml_token_t token; @@ -1263,6 +1266,15 @@ yaml_parser_unroll_indent(yaml_parser_t *parser, int column) if (parser->flow_level) return 1; + /* + * column is unsigned and parser->indent is signed, so if + * parser->indent is less than zero the conditional in the while + * loop below is incorrect. Guard against that. + */ + + if (parser->indent < 0) + return 1; + /* Loop through the intendation levels in the stack. */ while (parser->indent > column) @@ -1283,6 +1295,41 @@ yaml_parser_unroll_indent(yaml_parser_t *parser, int column) } /* + * Pop indentation levels from the indents stack until the current + * level resets to -1. For each intendation level, append the + * BLOCK-END token. + */ + +static int +yaml_parser_reset_indent(yaml_parser_t *parser) +{ + yaml_token_t token; + + /* In the flow context, do nothing. */ + + if (parser->flow_level) + return 1; + + /* Loop through the intendation levels in the stack. */ + + while (parser->indent > -1) + { + /* Create a token and append it to the queue. */ + + TOKEN_INIT(token, YAML_BLOCK_END_TOKEN, parser->mark, parser->mark); + + if (!ENQUEUE(parser, parser->tokens, token)) + return 0; + + /* Pop the indentation level. */ + + parser->indent = POP(parser, parser->indents); + } + + return 1; +} + +/* * Initialize the scanner and produce the STREAM-START token. */ @@ -1338,7 +1385,7 @@ yaml_parser_fetch_stream_end(yaml_parser_t *parser) /* Reset the indentation level. */ - if (!yaml_parser_unroll_indent(parser, -1)) + if (!yaml_parser_reset_indent(parser)) return 0; /* Reset simple keys. */ @@ -1369,7 +1416,7 @@ yaml_parser_fetch_directive(yaml_parser_t *parser) /* Reset the indentation level. */ - if (!yaml_parser_unroll_indent(parser, -1)) + if (!yaml_parser_reset_indent(parser)) return 0; /* Reset simple keys. */ @@ -1407,7 +1454,7 @@ yaml_parser_fetch_document_indicator(yaml_parser_t *parser, /* Reset the indentation level. */ - if (!yaml_parser_unroll_indent(parser, -1)) + if (!yaml_parser_reset_indent(parser)) return 0; /* Reset simple keys. */ |