aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBaptiste Daroussin <bapt@FreeBSD.org>2014-02-03 08:00:45 +0000
committerBaptiste Daroussin <bapt@FreeBSD.org>2014-02-03 08:00:45 +0000
commit5c7ba42d2e90bdd94bb55c80d0787e998fad44f9 (patch)
tree5d4be90b0b95a267e30acf55fc6cce2862b2199b
parent02a50482f806730d8afb6c2c0cc60e3c661b1ea4 (diff)
downloadsrc-vendor/libyaml.tar.gz
src-vendor/libyaml.zip
Apply patch for CVE-2013-6393 [1] to fix heap-based buffer overflow whenvendor/libyaml
parsing YAML tags. Also apply a patch for hardenning the guards againt the issue The only user in base in yaml is pkg(7) which uses the library a way that it is not affected Submitted by: delphij Obtained from: https://bugzilla.redhat.com/show_bug.cgi?id=1033990 Security: CVE-2013-6393
Notes
Notes: svn path=/vendor/libyaml/dist/; revision=261429
-rw-r--r--src/api.c7
-rw-r--r--src/scanner.c63
2 files changed, 61 insertions, 9 deletions
diff --git a/src/api.c b/src/api.c
index 0c4732e1520d..68bc2d8e9b0b 100644
--- a/src/api.c
+++ b/src/api.c
@@ -117,7 +117,12 @@ yaml_string_join(
YAML_DECLARE(int)
yaml_stack_extend(void **start, void **top, void **end)
{
- void *new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2);
+ void *new_start;
+
+ if ((char *)*end - (char *)*start >= INT_MAX / 2)
+ return 0;
+
+ new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2);
if (!new_start) return 0;
diff --git a/src/scanner.c b/src/scanner.c
index a2e861926476..1aaadc40a004 100644
--- a/src/scanner.c
+++ b/src/scanner.c
@@ -615,11 +615,14 @@ yaml_parser_decrease_flow_level(yaml_parser_t *parser);
*/
static int
-yaml_parser_roll_indent(yaml_parser_t *parser, int column,
+yaml_parser_roll_indent(yaml_parser_t *parser, size_t column,
int number, yaml_token_type_t type, yaml_mark_t mark);
static int
-yaml_parser_unroll_indent(yaml_parser_t *parser, int column);
+yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column);
+
+static int
+yaml_parser_reset_indent(yaml_parser_t *parser);
/*
* Token fetchers.
@@ -1206,7 +1209,7 @@ yaml_parser_decrease_flow_level(yaml_parser_t *parser)
*/
static int
-yaml_parser_roll_indent(yaml_parser_t *parser, int column,
+yaml_parser_roll_indent(yaml_parser_t *parser, size_t column,
int number, yaml_token_type_t type, yaml_mark_t mark)
{
yaml_token_t token;
@@ -1216,7 +1219,7 @@ yaml_parser_roll_indent(yaml_parser_t *parser, int column,
if (parser->flow_level)
return 1;
- if (parser->indent < column)
+ if (parser->indent == -1 || parser->indent < column)
{
/*
* Push the current indentation level to the stack and set the new
@@ -1254,7 +1257,7 @@ yaml_parser_roll_indent(yaml_parser_t *parser, int column,
static int
-yaml_parser_unroll_indent(yaml_parser_t *parser, int column)
+yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column)
{
yaml_token_t token;
@@ -1263,6 +1266,15 @@ yaml_parser_unroll_indent(yaml_parser_t *parser, int column)
if (parser->flow_level)
return 1;
+ /*
+ * column is unsigned and parser->indent is signed, so if
+ * parser->indent is less than zero the conditional in the while
+ * loop below is incorrect. Guard against that.
+ */
+
+ if (parser->indent < 0)
+ return 1;
+
/* Loop through the intendation levels in the stack. */
while (parser->indent > column)
@@ -1283,6 +1295,41 @@ yaml_parser_unroll_indent(yaml_parser_t *parser, int column)
}
/*
+ * Pop indentation levels from the indents stack until the current
+ * level resets to -1. For each intendation level, append the
+ * BLOCK-END token.
+ */
+
+static int
+yaml_parser_reset_indent(yaml_parser_t *parser)
+{
+ yaml_token_t token;
+
+ /* In the flow context, do nothing. */
+
+ if (parser->flow_level)
+ return 1;
+
+ /* Loop through the intendation levels in the stack. */
+
+ while (parser->indent > -1)
+ {
+ /* Create a token and append it to the queue. */
+
+ TOKEN_INIT(token, YAML_BLOCK_END_TOKEN, parser->mark, parser->mark);
+
+ if (!ENQUEUE(parser, parser->tokens, token))
+ return 0;
+
+ /* Pop the indentation level. */
+
+ parser->indent = POP(parser, parser->indents);
+ }
+
+ return 1;
+}
+
+/*
* Initialize the scanner and produce the STREAM-START token.
*/
@@ -1338,7 +1385,7 @@ yaml_parser_fetch_stream_end(yaml_parser_t *parser)
/* Reset the indentation level. */
- if (!yaml_parser_unroll_indent(parser, -1))
+ if (!yaml_parser_reset_indent(parser))
return 0;
/* Reset simple keys. */
@@ -1369,7 +1416,7 @@ yaml_parser_fetch_directive(yaml_parser_t *parser)
/* Reset the indentation level. */
- if (!yaml_parser_unroll_indent(parser, -1))
+ if (!yaml_parser_reset_indent(parser))
return 0;
/* Reset simple keys. */
@@ -1407,7 +1454,7 @@ yaml_parser_fetch_document_indicator(yaml_parser_t *parser,
/* Reset the indentation level. */
- if (!yaml_parser_unroll_indent(parser, -1))
+ if (!yaml_parser_reset_indent(parser))
return 0;
/* Reset simple keys. */