Add patch for CVE-2014-9130 (bug 1204829)

PyYAML-CVE-2014-9130.patch

@@ -0,0 +1,35 @@
+# HG changeset patch
+# User Kirill Simonov <xi@resolvent.net>
+# Date 1417197216 21600
+# Node ID ddf211a41bb231c365fece5599b7e484e6dc33fc
+# Parent  263dff6f9664ccdc532283ba5c7b282c0e436a7b
+Removed invalid simple key assertion.
+
+diff --git a/lib/yaml/scanner.py b/lib/yaml/scanner.py
+--- a/lib/yaml/scanner.py
++++ b/lib/yaml/scanner.py
+@@ -297,10 +297,6 @@
+         # Check if a simple key is required at the current position.
+         required = not self.flow_level and self.indent == self.column
+ 
+-        # A simple key is required only if it is the first token in the current
+-        # line. Therefore it is always allowed.
+-        assert self.allow_simple_key or not required
+-
+         # The next token might be a simple key. Let's save it's number and
+         # position.
+         if self.allow_simple_key:
+diff --git a/lib3/yaml/scanner.py b/lib3/yaml/scanner.py
+--- a/lib3/yaml/scanner.py
++++ b/lib3/yaml/scanner.py
+@@ -297,10 +297,6 @@
+         # Check if a simple key is required at the current position.
+         required = not self.flow_level and self.indent == self.column
+ 
+-        # A simple key is required only if it is the first token in the current
+-        # line. Therefore it is always allowed.
+-        assert self.allow_simple_key or not required
+-
+         # The next token might be a simple key. Let's save it's number and
+         # position.
+         if self.allow_simple_key:

PyYAML.spec

@@ -6,21 +6,30 @@
 
 Name:           PyYAML
 Version:        3.10
-Release:        9%{?dist}
+Release:        11%{?dist}
 Summary:        YAML parser and emitter for Python
 
 Group:          Development/Libraries
 License:        MIT
 URL:            http://pyyaml.org/
 Source0:        http://pyyaml.org/download/pyyaml/%{name}-%{version}.tar.gz
-BuildRoot:      %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
 BuildRequires:  python-devel, python-setuptools, libyaml-devel
+BuildRequires:  Cython
+BuildRequires:  libyaml-devel
 Provides:       python-yaml = %{version}-%{release}
 Provides:       python-yaml%{?_isa} = %{version}-%{release}
 %if 0%{?with_python3}
 BuildRequires: python3-devel
 BuildRequires: python3-setuptools
+BuildRequires: python3-Cython
 %endif
+# debian patch, upstream ticket http://pyyaml.org/ticket/247 and
+# https://bitbucket.org/xi/pyyaml/issue/35/test-fails-on-be-s390-x-ppc64
+Patch0: debian-big-endian-fix.patch
+
+# CVE-2014-9130 assert failure when processing wrapped strings
+# https://bugzilla.redhat.com/show_bug.cgi?id=1204829
+Patch1: PyYAML-CVE-2014-9130.patch
 
 %description
 YAML is a data serialization format designed for human readability and
@@ -57,26 +66,32 @@ configuration files to object serialization and persistance.
 
 %prep
 %setup -q -n %{name}-%{version}
+%patch0 -p1 -b .be
 chmod a-x examples/yaml-highlight/yaml_hl.py
 
-%if 0%{?with_python3}
-rm -rf %{py3dir}
-cp -a . %{py3dir}
-%endif
+%patch1 -p1
+
+# remove pre-generated file
+rm -rf ext/_yaml.c
 
 
 %build
-CFLAGS="${RPM_OPT_FLAGS}" %{__python} setup.py --with-libyaml build
+# regenerate ext/_yaml.c
+CFLAGS="${RPM_OPT_FLAGS}" %{__python} setup.py --with-libyaml build_ext
 
 %if 0%{?with_python3}
+rm -rf %{py3dir}
+# ext/_yaml.c is needed
+cp -a . %{py3dir}
 pushd %{py3dir}
 CFLAGS="${RPM_OPT_FLAGS}" %{__python3} setup.py --with-libyaml build
 popd
 %endif
 
+CFLAGS="${RPM_OPT_FLAGS}" %{__python} setup.py --with-libyaml build
+
 
 %install
-rm -rf %{buildroot}
 %{__python} setup.py install -O1 --skip-build --root %{buildroot}
 
 %if 0%{?with_python3}
@@ -96,24 +111,25 @@ popd
 %endif
 
 
-%clean
-rm -rf %{buildroot}
-
-
 %files
-%defattr(644,root,root,755)
 %doc CHANGES LICENSE PKG-INFO README examples
 %{python_sitearch}/*
 
 %if 0%{?with_python3}
 %files -n python3-PyYAML
-%defattr(644,root,root,755)
 %doc CHANGES LICENSE PKG-INFO README examples
 %{python3_sitearch}/*
 %endif
 
 
 %changelog
+* Mon Mar 23 2015 John Eckersberg <eck@redhat.com> - 3.10-11
+- Add patch for CVE-2014-9130 (bug 1204829)
+
+* Mon Sep 15 2014 Jakub Čajka <jcajka@redhat.com> - 3.10-10
+- fixed typecast issues using debian patch(int->size_t)(BZ#1140189)
+- spec file cleanup
+
 * Thu Aug  8 2013 John Eckersberg <jeckersb@redhat.com> - 3.10-9
 - Add check section and run test suite
 

debian-big-endian-fix.patch

@@ -0,0 +1,73 @@
+pyyaml FTBFS on the s390x buildd.  It seems this is due to using int
+where the libyaml API uses size_t.  I tested the attached patch in
+zelenka.d.o's sid chroot, and at least the python2 build/test worked (it
+failed with the same error as the buildd pre-patching).
+Patch by Julien Cristau <jcristau@debian.org>
+Add to the pyyaml package by Scott Kitterman <scott@kitterman.com>
+http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=676536
+
+Index: pyyaml-3.10/ext/_yaml.pxd
+===================================================================
+--- pyyaml-3.10.orig/ext/_yaml.pxd	2011-05-29 23:31:01.000000000 -0400
++++ pyyaml-3.10/ext/_yaml.pxd	2012-06-08 16:33:54.309407701 -0400
+@@ -86,15 +86,15 @@
+         YAML_MAPPING_END_EVENT
+ 
+     ctypedef int yaml_read_handler_t(void *data, char *buffer,
+-            int size, int *size_read) except 0
++            size_t size, size_t *size_read) except 0
+ 
+     ctypedef int yaml_write_handler_t(void *data, char *buffer,
+-            int size) except 0
++            size_t size) except 0
+ 
+     ctypedef struct yaml_mark_t:
+-        int index
+-        int line
+-        int column
++        size_t index
++        size_t line
++        size_t column
+     ctypedef struct yaml_version_directive_t:
+         int major
+         int minor
+@@ -113,7 +113,7 @@
+         char *suffix
+     ctypedef struct _yaml_token_scalar_data_t:
+         char *value
+-        int length
++        size_t length
+         yaml_scalar_style_t style
+     ctypedef struct _yaml_token_version_directive_data_t:
+         int major
+@@ -152,7 +152,7 @@
+         char *anchor
+         char *tag
+         char *value
+-        int length
++        size_t length
+         int plain_implicit
+         int quoted_implicit
+         yaml_scalar_style_t style
+Index: pyyaml-3.10/ext/_yaml.pyx
+===================================================================
+--- pyyaml-3.10.orig/ext/_yaml.pyx	2011-05-29 23:31:01.000000000 -0400
++++ pyyaml-3.10/ext/_yaml.pyx	2012-06-08 16:33:54.313409701 -0400
+@@ -905,7 +905,7 @@
+                 raise error
+         return 1
+ 
+-cdef int input_handler(void *data, char *buffer, int size, int *read) except 0:
++cdef int input_handler(void *data, char *buffer, size_t size, size_t *read) except 0:
+     cdef CParser parser
+     parser = <CParser>data
+     if parser.stream_cache is None:
+@@ -1515,7 +1515,7 @@
+             self.ascend_resolver()
+         return 1
+ 
+-cdef int output_handler(void *data, char *buffer, int size) except 0:
++cdef int output_handler(void *data, char *buffer, size_t size) except 0:
+     cdef CEmitter emitter
+     emitter = <CEmitter>data
+     if emitter.dump_unicode == 0: