diff --git a/PyYAML-CVE-2014-9130.patch b/PyYAML-CVE-2014-9130.patch new file mode 100644 index 0000000..c47a9b5 --- /dev/null +++ b/PyYAML-CVE-2014-9130.patch @@ -0,0 +1,35 @@ +# HG changeset patch +# User Kirill Simonov +# Date 1417197216 21600 +# Node ID ddf211a41bb231c365fece5599b7e484e6dc33fc +# Parent 263dff6f9664ccdc532283ba5c7b282c0e436a7b +Removed invalid simple key assertion. + +diff --git a/lib/yaml/scanner.py b/lib/yaml/scanner.py +--- a/lib/yaml/scanner.py ++++ b/lib/yaml/scanner.py +@@ -297,10 +297,6 @@ + # Check if a simple key is required at the current position. + required = not self.flow_level and self.indent == self.column + +- # A simple key is required only if it is the first token in the current +- # line. Therefore it is always allowed. +- assert self.allow_simple_key or not required +- + # The next token might be a simple key. Let's save it's number and + # position. + if self.allow_simple_key: +diff --git a/lib3/yaml/scanner.py b/lib3/yaml/scanner.py +--- a/lib3/yaml/scanner.py ++++ b/lib3/yaml/scanner.py +@@ -297,10 +297,6 @@ + # Check if a simple key is required at the current position. + required = not self.flow_level and self.indent == self.column + +- # A simple key is required only if it is the first token in the current +- # line. Therefore it is always allowed. +- assert self.allow_simple_key or not required +- + # The next token might be a simple key. Let's save it's number and + # position. + if self.allow_simple_key: diff --git a/PyYAML.spec b/PyYAML.spec index e3bec64..d21fa34 100644 --- a/PyYAML.spec +++ b/PyYAML.spec @@ -6,21 +6,30 @@ Name: PyYAML Version: 3.10 -Release: 9%{?dist} +Release: 11%{?dist} Summary: YAML parser and emitter for Python Group: Development/Libraries License: MIT URL: http://pyyaml.org/ Source0: http://pyyaml.org/download/pyyaml/%{name}-%{version}.tar.gz -BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX) BuildRequires: python-devel, python-setuptools, libyaml-devel +BuildRequires: Cython +BuildRequires: libyaml-devel Provides: python-yaml = %{version}-%{release} Provides: python-yaml%{?_isa} = %{version}-%{release} %if 0%{?with_python3} BuildRequires: python3-devel BuildRequires: python3-setuptools +BuildRequires: python3-Cython %endif +# debian patch, upstream ticket http://pyyaml.org/ticket/247 and +# https://bitbucket.org/xi/pyyaml/issue/35/test-fails-on-be-s390-x-ppc64 +Patch0: debian-big-endian-fix.patch + +# CVE-2014-9130 assert failure when processing wrapped strings +# https://bugzilla.redhat.com/show_bug.cgi?id=1204829 +Patch1: PyYAML-CVE-2014-9130.patch %description YAML is a data serialization format designed for human readability and @@ -57,26 +66,32 @@ configuration files to object serialization and persistance. %prep %setup -q -n %{name}-%{version} +%patch0 -p1 -b .be chmod a-x examples/yaml-highlight/yaml_hl.py -%if 0%{?with_python3} -rm -rf %{py3dir} -cp -a . %{py3dir} -%endif +%patch1 -p1 + +# remove pre-generated file +rm -rf ext/_yaml.c %build -CFLAGS="${RPM_OPT_FLAGS}" %{__python} setup.py --with-libyaml build +# regenerate ext/_yaml.c +CFLAGS="${RPM_OPT_FLAGS}" %{__python} setup.py --with-libyaml build_ext %if 0%{?with_python3} +rm -rf %{py3dir} +# ext/_yaml.c is needed +cp -a . %{py3dir} pushd %{py3dir} CFLAGS="${RPM_OPT_FLAGS}" %{__python3} setup.py --with-libyaml build popd %endif +CFLAGS="${RPM_OPT_FLAGS}" %{__python} setup.py --with-libyaml build + %install -rm -rf %{buildroot} %{__python} setup.py install -O1 --skip-build --root %{buildroot} %if 0%{?with_python3} @@ -96,24 +111,25 @@ popd %endif -%clean -rm -rf %{buildroot} - - %files -%defattr(644,root,root,755) %doc CHANGES LICENSE PKG-INFO README examples %{python_sitearch}/* %if 0%{?with_python3} %files -n python3-PyYAML -%defattr(644,root,root,755) %doc CHANGES LICENSE PKG-INFO README examples %{python3_sitearch}/* %endif %changelog +* Mon Mar 23 2015 John Eckersberg - 3.10-11 +- Add patch for CVE-2014-9130 (bug 1204829) + +* Mon Sep 15 2014 Jakub Čajka - 3.10-10 +- fixed typecast issues using debian patch(int->size_t)(BZ#1140189) +- spec file cleanup + * Thu Aug 8 2013 John Eckersberg - 3.10-9 - Add check section and run test suite diff --git a/debian-big-endian-fix.patch b/debian-big-endian-fix.patch new file mode 100644 index 0000000..7991005 --- /dev/null +++ b/debian-big-endian-fix.patch @@ -0,0 +1,73 @@ +pyyaml FTBFS on the s390x buildd. It seems this is due to using int +where the libyaml API uses size_t. I tested the attached patch in +zelenka.d.o's sid chroot, and at least the python2 build/test worked (it +failed with the same error as the buildd pre-patching). +Patch by Julien Cristau +Add to the pyyaml package by Scott Kitterman +http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=676536 + +Index: pyyaml-3.10/ext/_yaml.pxd +=================================================================== +--- pyyaml-3.10.orig/ext/_yaml.pxd 2011-05-29 23:31:01.000000000 -0400 ++++ pyyaml-3.10/ext/_yaml.pxd 2012-06-08 16:33:54.309407701 -0400 +@@ -86,15 +86,15 @@ + YAML_MAPPING_END_EVENT + + ctypedef int yaml_read_handler_t(void *data, char *buffer, +- int size, int *size_read) except 0 ++ size_t size, size_t *size_read) except 0 + + ctypedef int yaml_write_handler_t(void *data, char *buffer, +- int size) except 0 ++ size_t size) except 0 + + ctypedef struct yaml_mark_t: +- int index +- int line +- int column ++ size_t index ++ size_t line ++ size_t column + ctypedef struct yaml_version_directive_t: + int major + int minor +@@ -113,7 +113,7 @@ + char *suffix + ctypedef struct _yaml_token_scalar_data_t: + char *value +- int length ++ size_t length + yaml_scalar_style_t style + ctypedef struct _yaml_token_version_directive_data_t: + int major +@@ -152,7 +152,7 @@ + char *anchor + char *tag + char *value +- int length ++ size_t length + int plain_implicit + int quoted_implicit + yaml_scalar_style_t style +Index: pyyaml-3.10/ext/_yaml.pyx +=================================================================== +--- pyyaml-3.10.orig/ext/_yaml.pyx 2011-05-29 23:31:01.000000000 -0400 ++++ pyyaml-3.10/ext/_yaml.pyx 2012-06-08 16:33:54.313409701 -0400 +@@ -905,7 +905,7 @@ + raise error + return 1 + +-cdef int input_handler(void *data, char *buffer, int size, int *read) except 0: ++cdef int input_handler(void *data, char *buffer, size_t size, size_t *read) except 0: + cdef CParser parser + parser = data + if parser.stream_cache is None: +@@ -1515,7 +1515,7 @@ + self.ascend_resolver() + return 1 + +-cdef int output_handler(void *data, char *buffer, int size) except 0: ++cdef int output_handler(void *data, char *buffer, size_t size) except 0: + cdef CEmitter emitter + emitter = data + if emitter.dump_unicode == 0: