From 6a11bc03d8c62a0e2042fa9338227e866f4a695c Mon Sep 17 00:00:00 2001 From: John Eckersberg Date: Wed, 29 Jan 2014 12:21:05 -0500 Subject: [PATCH 1/2] Add patches for CVE-2013-6393 (bz1033990) --- ...-2013-6393-indent-column-overflow-v2.patch | 140 ++++++++++++++++++ libyaml-CVE-2013-6393-node-id-hardening.patch | 25 ++++ libyaml-CVE-2013-6393-string-overflow.patch | 20 +++ libyaml.spec | 14 +- 4 files changed, 197 insertions(+), 2 deletions(-) create mode 100644 libyaml-CVE-2013-6393-indent-column-overflow-v2.patch create mode 100644 libyaml-CVE-2013-6393-node-id-hardening.patch create mode 100644 libyaml-CVE-2013-6393-string-overflow.patch diff --git a/libyaml-CVE-2013-6393-indent-column-overflow-v2.patch b/libyaml-CVE-2013-6393-indent-column-overflow-v2.patch new file mode 100644 index 0000000..a62c9d1 --- /dev/null +++ b/libyaml-CVE-2013-6393-indent-column-overflow-v2.patch @@ -0,0 +1,140 @@ +# HG changeset patch +# User John Eckersberg +# Date 1390870108 18000 +# Mon Jan 27 19:48:28 2014 -0500 +# Node ID 7179aa474f31e73834adda26b77bfc25bfe5143d +# Parent 3e6507fa0c26d20c09f8f468f2bd04aa2fd1b5b5 +yaml_parser-{un,}roll-indent: fix int overflow in column argument + +diff -r 3e6507fa0c26 -r 7179aa474f31 src/scanner.c +--- a/src/scanner.c Mon Dec 24 03:51:32 2012 +0000 ++++ b/src/scanner.c Mon Jan 27 19:48:28 2014 -0500 +@@ -615,11 +615,14 @@ + */ + + static int +-yaml_parser_roll_indent(yaml_parser_t *parser, int column, ++yaml_parser_roll_indent(yaml_parser_t *parser, size_t column, + int number, yaml_token_type_t type, yaml_mark_t mark); + + static int +-yaml_parser_unroll_indent(yaml_parser_t *parser, int column); ++yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column); ++ ++static int ++yaml_parser_reset_indent(yaml_parser_t *parser); + + /* + * Token fetchers. +@@ -1206,7 +1209,7 @@ + */ + + static int +-yaml_parser_roll_indent(yaml_parser_t *parser, int column, ++yaml_parser_roll_indent(yaml_parser_t *parser, size_t column, + int number, yaml_token_type_t type, yaml_mark_t mark) + { + yaml_token_t token; +@@ -1216,7 +1219,7 @@ + if (parser->flow_level) + return 1; + +- if (parser->indent < column) ++ if (parser->indent == -1 || parser->indent < column) + { + /* + * Push the current indentation level to the stack and set the new +@@ -1254,7 +1257,7 @@ + + + static int +-yaml_parser_unroll_indent(yaml_parser_t *parser, int column) ++yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column) + { + yaml_token_t token; + +@@ -1263,6 +1266,15 @@ + if (parser->flow_level) + return 1; + ++ /* ++ * column is unsigned and parser->indent is signed, so if ++ * parser->indent is less than zero the conditional in the while ++ * loop below is incorrect. Guard against that. ++ */ ++ ++ if (parser->indent < 0) ++ return 1; ++ + /* Loop through the intendation levels in the stack. */ + + while (parser->indent > column) +@@ -1283,6 +1295,41 @@ + } + + /* ++ * Pop indentation levels from the indents stack until the current ++ * level resets to -1. For each intendation level, append the ++ * BLOCK-END token. ++ */ ++ ++static int ++yaml_parser_reset_indent(yaml_parser_t *parser) ++{ ++ yaml_token_t token; ++ ++ /* In the flow context, do nothing. */ ++ ++ if (parser->flow_level) ++ return 1; ++ ++ /* Loop through the intendation levels in the stack. */ ++ ++ while (parser->indent > -1) ++ { ++ /* Create a token and append it to the queue. */ ++ ++ TOKEN_INIT(token, YAML_BLOCK_END_TOKEN, parser->mark, parser->mark); ++ ++ if (!ENQUEUE(parser, parser->tokens, token)) ++ return 0; ++ ++ /* Pop the indentation level. */ ++ ++ parser->indent = POP(parser, parser->indents); ++ } ++ ++ return 1; ++} ++ ++/* + * Initialize the scanner and produce the STREAM-START token. + */ + +@@ -1338,7 +1385,7 @@ + + /* Reset the indentation level. */ + +- if (!yaml_parser_unroll_indent(parser, -1)) ++ if (!yaml_parser_reset_indent(parser)) + return 0; + + /* Reset simple keys. */ +@@ -1369,7 +1416,7 @@ + + /* Reset the indentation level. */ + +- if (!yaml_parser_unroll_indent(parser, -1)) ++ if (!yaml_parser_reset_indent(parser)) + return 0; + + /* Reset simple keys. */ +@@ -1407,7 +1454,7 @@ + + /* Reset the indentation level. */ + +- if (!yaml_parser_unroll_indent(parser, -1)) ++ if (!yaml_parser_reset_indent(parser)) + return 0; + + /* Reset simple keys. */ diff --git a/libyaml-CVE-2013-6393-node-id-hardening.patch b/libyaml-CVE-2013-6393-node-id-hardening.patch new file mode 100644 index 0000000..364264b --- /dev/null +++ b/libyaml-CVE-2013-6393-node-id-hardening.patch @@ -0,0 +1,25 @@ +# HG changeset patch +# User Florian Weimer +# Date 1389274355 -3600 +# Thu Jan 09 14:32:35 2014 +0100 +# Node ID 034d7a91581ac930e5958683f1a06f41e96d24a2 +# Parent a54d7af707f25dc298a7be60fd152001d2b3035b +yaml_stack_extend: guard against integer overflow + +diff --git a/src/api.c b/src/api.c +--- a/src/api.c ++++ b/src/api.c +@@ -117,7 +117,12 @@ + YAML_DECLARE(int) + yaml_stack_extend(void **start, void **top, void **end) + { +- void *new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2); ++ void *new_start; ++ ++ if ((char *)*end - (char *)*start >= INT_MAX / 2) ++ return 0; ++ ++ new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2); + + if (!new_start) return 0; + diff --git a/libyaml-CVE-2013-6393-string-overflow.patch b/libyaml-CVE-2013-6393-string-overflow.patch new file mode 100644 index 0000000..df63474 --- /dev/null +++ b/libyaml-CVE-2013-6393-string-overflow.patch @@ -0,0 +1,20 @@ +# HG changeset patch +# User Florian Weimer +# Date 1389273500 -3600 +# Thu Jan 09 14:18:20 2014 +0100 +# Node ID a54d7af707f25dc298a7be60fd152001d2b3035b +# Parent 3e6507fa0c26d20c09f8f468f2bd04aa2fd1b5b5 +yaml_parser_scan_tag_uri: fix int overflow leading to buffer overflow + +diff --git a/src/scanner.c b/src/scanner.c +--- a/src/scanner.c ++++ b/src/scanner.c +@@ -2574,7 +2574,7 @@ + + /* Resize the string to include the head. */ + +- while (string.end - string.start <= (int)length) { ++ while ((size_t)(string.end - string.start) <= length) { + if (!yaml_string_extend(&string.start, &string.pointer, &string.end)) { + parser->error = YAML_MEMORY_ERROR; + goto error; diff --git a/libyaml.spec b/libyaml.spec index 9bcc6cf..40a84ee 100644 --- a/libyaml.spec +++ b/libyaml.spec @@ -4,7 +4,7 @@ Name: libyaml Version: 0.1.3 -Release: 3%{?dist} +Release: 4%{?dist} Summary: YAML 1.1 parser and emitter written in C Group: System Environment/Libraries @@ -13,6 +13,11 @@ URL: http://pyyaml.org/ Source0: http://pyyaml.org/download/libyaml/%{tarballname}-%{version}.tar.gz BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +# CVE-2013-6393 +# https://bugzilla.redhat.com/show_bug.cgi?id=1033990 +Patch0: libyaml-CVE-2013-6393-string-overflow.patch +Patch1: libyaml-CVE-2013-6393-node-id-hardening.patch +Patch2: libyaml-CVE-2013-6393-indent-column-overflow-v2.patch %description YAML is a data serialization format designed for human readability and @@ -33,7 +38,9 @@ developing applications that use LibYAML. %prep %setup -q -n %{tarballname}-%{version} - +%patch0 -p1 +%patch1 -p1 +%patch2 -p1 %build %configure @@ -74,6 +81,9 @@ rm -rf %{buildroot} %changelog +* Wed Jan 29 2014 John Eckersberg - 0.1.3-4 +- Add patches for CVE-2013-6393 (bz1033990) + * Tue Feb 08 2011 Fedora Release Engineering - 0.1.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild From 0539a4ccd5919830c0b542d6b6b5a51c3db577f4 Mon Sep 17 00:00:00 2001 From: John Eckersberg Date: Mon, 1 Dec 2014 13:46:06 -0500 Subject: [PATCH 2/2] Added to base RHEL in RHEL-6.6 --- .gitignore | 4 - dead.package | 1 + ...-2013-6393-indent-column-overflow-v2.patch | 140 ------------------ libyaml-CVE-2013-6393-node-id-hardening.patch | 25 ---- libyaml-CVE-2013-6393-string-overflow.patch | 20 --- libyaml.spec | 110 -------------- sources | 1 - 7 files changed, 1 insertion(+), 300 deletions(-) delete mode 100644 .gitignore create mode 100644 dead.package delete mode 100644 libyaml-CVE-2013-6393-indent-column-overflow-v2.patch delete mode 100644 libyaml-CVE-2013-6393-node-id-hardening.patch delete mode 100644 libyaml-CVE-2013-6393-string-overflow.patch delete mode 100644 libyaml.spec delete mode 100644 sources diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 750a2d6..0000000 --- a/.gitignore +++ /dev/null @@ -1,4 +0,0 @@ -yaml-0.1.3.tar.gz -/yaml-0.1.4.tar.gz -/yaml-0.1.5.tar.gz -/yaml-0.1.6.tar.gz diff --git a/dead.package b/dead.package new file mode 100644 index 0000000..a1bdff0 --- /dev/null +++ b/dead.package @@ -0,0 +1 @@ +Added to base RHEL in RHEL-6.6 diff --git a/libyaml-CVE-2013-6393-indent-column-overflow-v2.patch b/libyaml-CVE-2013-6393-indent-column-overflow-v2.patch deleted file mode 100644 index a62c9d1..0000000 --- a/libyaml-CVE-2013-6393-indent-column-overflow-v2.patch +++ /dev/null @@ -1,140 +0,0 @@ -# HG changeset patch -# User John Eckersberg -# Date 1390870108 18000 -# Mon Jan 27 19:48:28 2014 -0500 -# Node ID 7179aa474f31e73834adda26b77bfc25bfe5143d -# Parent 3e6507fa0c26d20c09f8f468f2bd04aa2fd1b5b5 -yaml_parser-{un,}roll-indent: fix int overflow in column argument - -diff -r 3e6507fa0c26 -r 7179aa474f31 src/scanner.c ---- a/src/scanner.c Mon Dec 24 03:51:32 2012 +0000 -+++ b/src/scanner.c Mon Jan 27 19:48:28 2014 -0500 -@@ -615,11 +615,14 @@ - */ - - static int --yaml_parser_roll_indent(yaml_parser_t *parser, int column, -+yaml_parser_roll_indent(yaml_parser_t *parser, size_t column, - int number, yaml_token_type_t type, yaml_mark_t mark); - - static int --yaml_parser_unroll_indent(yaml_parser_t *parser, int column); -+yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column); -+ -+static int -+yaml_parser_reset_indent(yaml_parser_t *parser); - - /* - * Token fetchers. -@@ -1206,7 +1209,7 @@ - */ - - static int --yaml_parser_roll_indent(yaml_parser_t *parser, int column, -+yaml_parser_roll_indent(yaml_parser_t *parser, size_t column, - int number, yaml_token_type_t type, yaml_mark_t mark) - { - yaml_token_t token; -@@ -1216,7 +1219,7 @@ - if (parser->flow_level) - return 1; - -- if (parser->indent < column) -+ if (parser->indent == -1 || parser->indent < column) - { - /* - * Push the current indentation level to the stack and set the new -@@ -1254,7 +1257,7 @@ - - - static int --yaml_parser_unroll_indent(yaml_parser_t *parser, int column) -+yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column) - { - yaml_token_t token; - -@@ -1263,6 +1266,15 @@ - if (parser->flow_level) - return 1; - -+ /* -+ * column is unsigned and parser->indent is signed, so if -+ * parser->indent is less than zero the conditional in the while -+ * loop below is incorrect. Guard against that. -+ */ -+ -+ if (parser->indent < 0) -+ return 1; -+ - /* Loop through the intendation levels in the stack. */ - - while (parser->indent > column) -@@ -1283,6 +1295,41 @@ - } - - /* -+ * Pop indentation levels from the indents stack until the current -+ * level resets to -1. For each intendation level, append the -+ * BLOCK-END token. -+ */ -+ -+static int -+yaml_parser_reset_indent(yaml_parser_t *parser) -+{ -+ yaml_token_t token; -+ -+ /* In the flow context, do nothing. */ -+ -+ if (parser->flow_level) -+ return 1; -+ -+ /* Loop through the intendation levels in the stack. */ -+ -+ while (parser->indent > -1) -+ { -+ /* Create a token and append it to the queue. */ -+ -+ TOKEN_INIT(token, YAML_BLOCK_END_TOKEN, parser->mark, parser->mark); -+ -+ if (!ENQUEUE(parser, parser->tokens, token)) -+ return 0; -+ -+ /* Pop the indentation level. */ -+ -+ parser->indent = POP(parser, parser->indents); -+ } -+ -+ return 1; -+} -+ -+/* - * Initialize the scanner and produce the STREAM-START token. - */ - -@@ -1338,7 +1385,7 @@ - - /* Reset the indentation level. */ - -- if (!yaml_parser_unroll_indent(parser, -1)) -+ if (!yaml_parser_reset_indent(parser)) - return 0; - - /* Reset simple keys. */ -@@ -1369,7 +1416,7 @@ - - /* Reset the indentation level. */ - -- if (!yaml_parser_unroll_indent(parser, -1)) -+ if (!yaml_parser_reset_indent(parser)) - return 0; - - /* Reset simple keys. */ -@@ -1407,7 +1454,7 @@ - - /* Reset the indentation level. */ - -- if (!yaml_parser_unroll_indent(parser, -1)) -+ if (!yaml_parser_reset_indent(parser)) - return 0; - - /* Reset simple keys. */ diff --git a/libyaml-CVE-2013-6393-node-id-hardening.patch b/libyaml-CVE-2013-6393-node-id-hardening.patch deleted file mode 100644 index 364264b..0000000 --- a/libyaml-CVE-2013-6393-node-id-hardening.patch +++ /dev/null @@ -1,25 +0,0 @@ -# HG changeset patch -# User Florian Weimer -# Date 1389274355 -3600 -# Thu Jan 09 14:32:35 2014 +0100 -# Node ID 034d7a91581ac930e5958683f1a06f41e96d24a2 -# Parent a54d7af707f25dc298a7be60fd152001d2b3035b -yaml_stack_extend: guard against integer overflow - -diff --git a/src/api.c b/src/api.c ---- a/src/api.c -+++ b/src/api.c -@@ -117,7 +117,12 @@ - YAML_DECLARE(int) - yaml_stack_extend(void **start, void **top, void **end) - { -- void *new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2); -+ void *new_start; -+ -+ if ((char *)*end - (char *)*start >= INT_MAX / 2) -+ return 0; -+ -+ new_start = yaml_realloc(*start, ((char *)*end - (char *)*start)*2); - - if (!new_start) return 0; - diff --git a/libyaml-CVE-2013-6393-string-overflow.patch b/libyaml-CVE-2013-6393-string-overflow.patch deleted file mode 100644 index df63474..0000000 --- a/libyaml-CVE-2013-6393-string-overflow.patch +++ /dev/null @@ -1,20 +0,0 @@ -# HG changeset patch -# User Florian Weimer -# Date 1389273500 -3600 -# Thu Jan 09 14:18:20 2014 +0100 -# Node ID a54d7af707f25dc298a7be60fd152001d2b3035b -# Parent 3e6507fa0c26d20c09f8f468f2bd04aa2fd1b5b5 -yaml_parser_scan_tag_uri: fix int overflow leading to buffer overflow - -diff --git a/src/scanner.c b/src/scanner.c ---- a/src/scanner.c -+++ b/src/scanner.c -@@ -2574,7 +2574,7 @@ - - /* Resize the string to include the head. */ - -- while (string.end - string.start <= (int)length) { -+ while ((size_t)(string.end - string.start) <= length) { - if (!yaml_string_extend(&string.start, &string.pointer, &string.end)) { - parser->error = YAML_MEMORY_ERROR; - goto error; diff --git a/libyaml.spec b/libyaml.spec deleted file mode 100644 index b03ae61..0000000 --- a/libyaml.spec +++ /dev/null @@ -1,110 +0,0 @@ -%define tarballname yaml - -#====================================================================# - -Name: libyaml -Version: 0.1.6 -Release: 1%{?dist} -Summary: YAML 1.1 parser and emitter written in C - -Group: System Environment/Libraries -License: MIT -URL: http://pyyaml.org/ -Source0: http://pyyaml.org/download/libyaml/%{tarballname}-%{version}.tar.gz -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) - -%description -YAML is a data serialization format designed for human readability and -interaction with scripting languages. LibYAML is a YAML parser and -emitter written in C. - - -%package devel -Summary: Development files for LibYAML applications -Group: Development/Libraries -Requires: libyaml = %{version}-%{release}, pkgconfig - - -%description devel -The %{name}-devel package contains libraries and header files for -developing applications that use LibYAML. - - -%prep -%setup -q -n %{tarballname}-%{version} - -%build -%configure -make %{?_smp_mflags} - - -%install -rm -rf %{buildroot} -make DESTDIR=%{buildroot} INSTALL="install -p" install -rm -f %{buildroot}%{_libdir}/*.{la,a} - - -%check -make check - - -%clean -rm -rf %{buildroot} - - -%post -p /sbin/ldconfig - - -%postun -p /sbin/ldconfig - - -%files -%defattr(-,root,root,-) -%doc LICENSE README -%{_libdir}/%{name}*.so.* - - -%files devel -%defattr(-,root,root,-) -%doc doc/html -%{_libdir}/%{name}*.so -%{_libdir}/pkgconfig/yaml-0.1.pc -%{_includedir}/yaml.h - - -%changelog -* Wed Mar 26 2014 John Eckersberg - 0.1.6-1 -- New upstream release 0.1.6 (bz1081492) -- Fixes CVE-2014-2525 (bz1078083) - -* Tue Feb 4 2014 John Eckersberg - 0.1.5-1 -- New upstream release 0.1.5 (bz1061087) -- Removed patches for CVE-2013-6393; they are included in 0.1.5 - upstream - -* Wed Jan 29 2014 John Eckersberg - 0.1.3-4 -- Add patches for CVE-2013-6393 (bz1033990) - -* Tue Feb 08 2011 Fedora Release Engineering - 0.1.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Fri Oct 02 2009 John Eckersberg - 0.1.3-1 -- New upstream release 0.1.3 - -* Sat Jul 25 2009 Fedora Release Engineering - 0.1.2-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild - -* Wed Jul 22 2009 John Eckersberg - 0.1.2-4 -- Minor tweaks to spec file -- Enable %%check section -- Thanks Gareth Armstrong - -* Tue Mar 3 2009 John Eckersberg - 0.1.2-3 -- Remove static libraries - -* Thu Feb 26 2009 John Eckersberg - 0.1.2-2 -- Remove README and LICENSE from docs on -devel package -- Remove -static package and merge contents into the -devel package - -* Wed Feb 25 2009 John Eckersberg - 0.1.2-1 -- Initial packaging for Fedora diff --git a/sources b/sources deleted file mode 100644 index 3a0df4a..0000000 --- a/sources +++ /dev/null @@ -1 +0,0 @@ -5fe00cda18ca5daeb43762b80c38e06e yaml-0.1.6.tar.gz