Add patch for CVE-2014-9130 (bug 1204829)

This reverts commit 62723716a3.

.gitignore

@@ -1,2 +1 @@
 PyYAML-3.09.tar.gz
-/PyYAML-3.10.tar.gz

PyYAML-CVE-2014-9130.patch

@@ -0,0 +1,35 @@
+# HG changeset patch
+# User Kirill Simonov <xi@resolvent.net>
+# Date 1417197216 21600
+# Node ID ddf211a41bb231c365fece5599b7e484e6dc33fc
+# Parent  263dff6f9664ccdc532283ba5c7b282c0e436a7b
+Removed invalid simple key assertion.
+
+diff --git a/lib/yaml/scanner.py b/lib/yaml/scanner.py
+--- a/lib/yaml/scanner.py
++++ b/lib/yaml/scanner.py
+@@ -297,10 +297,6 @@
+         # Check if a simple key is required at the current position.
+         required = not self.flow_level and self.indent == self.column
+ 
+-        # A simple key is required only if it is the first token in the current
+-        # line. Therefore it is always allowed.
+-        assert self.allow_simple_key or not required
+-
+         # The next token might be a simple key. Let's save it's number and
+         # position.
+         if self.allow_simple_key:
+diff --git a/lib3/yaml/scanner.py b/lib3/yaml/scanner.py
+--- a/lib3/yaml/scanner.py
++++ b/lib3/yaml/scanner.py
+@@ -297,10 +297,6 @@
+         # Check if a simple key is required at the current position.
+         required = not self.flow_level and self.indent == self.column
+ 
+-        # A simple key is required only if it is the first token in the current
+-        # line. Therefore it is always allowed.
+-        assert self.allow_simple_key or not required
+-
+         # The next token might be a simple key. Let's save it's number and
+         # position.
+         if self.allow_simple_key:

PyYAML.spec

@@ -5,8 +5,8 @@
 %endif
 
 Name:           PyYAML
-Version:        3.10
-Release:        3%{?dist}
+Version:        3.09
+Release:        11%{?dist}
 Summary:        YAML parser and emitter for Python
 
 Group:          Development/Libraries
@@ -22,6 +22,10 @@ BuildRequires: python3-devel
 BuildRequires: python3-setuptools
 %endif
 
+# CVE-2014-9130 assert failure when processing wrapped strings
+# https://bugzilla.redhat.com/show_bug.cgi?id=1204829
+Patch1: PyYAML-CVE-2014-9130.patch
+
 %description
 YAML is a data serialization format designed for human readability and
 interaction with scripting languages.  PyYAML is a YAML parser and
@@ -64,6 +68,8 @@ rm -rf %{py3dir}
 cp -a . %{py3dir}
 %endif
 
+%patch1 -p1
+
 
 %build
 CFLAGS="${RPM_OPT_FLAGS}" %{__python} setup.py --with-libyaml build
@@ -86,6 +92,16 @@ popd
 %endif
 
 
+%check
+%{__python} setup.py test
+
+%if 0%{?with_python3}
+pushd %{py3dir}
+%{__python3} setup.py test
+popd
+%endif
+
+
 %clean
 rm -rf %{buildroot}
 
@@ -104,14 +120,14 @@ rm -rf %{buildroot}
 
 
 %changelog
-* Fri Apr 27 2012 John Eckersberg <jeckersb@redhat.com> - 3.10-3
+* Mon Mar 23 2015 John Eckersberg <eck@redhat.com> - 3.09-11
+- Add patch for CVE-2014-9130 (bug 1204829)
+
+* Mon Feb  3 2014 John Eckersberg <jeckersb@redhat.com> - 3.09-10
 - Add Provides for python-yaml (BZ#740390)
 
-* Thu Jan 12 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.10-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
-
-* Thu Jun 23 2011 John Eckersberg <jeckersb@redhat.com> - 3.10-1
-- New upstream release 3.10
+* Mon Feb  3 2014 John Eckersberg <jeckersb@redhat.com> - 3.09-9
+- Add check section and run test suite
 
 * Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 3.09-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

sources

@@ -1,2 +1 @@
 f219af2361e87fdc5e85e95b84c11d87  PyYAML-3.09.tar.gz
-74c94a383886519e9e7b3dd1ee540247  PyYAML-3.10.tar.gz