Backport fix for CVE-2020-10663 from 2.3.0 (bug 1827500)

rubygem-json-2.2.0-CVE-2020-10663-backport.patch

@@ -0,0 +1,40 @@
+From 36e9ed7fef6eb2d14becf6c52452e4ab16e4bf01 Mon Sep 17 00:00:00 2001
+From: nagachika <nagachika@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
+Date: Fri, 20 Mar 2020 08:12:05 +0000
+Subject: [PATCH] backport 80b5a0ff2a7709367178f29d4ebe1c54122b1c27 partially
+ as a securify fix for CVE-2020-10663. The patch was provided by Jeremy Evans.
+
+git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67856 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
+---
+ ext/json/parser/parser.c  | 2 +-
+ ext/json/parser/parser.rl | 2 +-
+ version.h                 | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/ext/json/parser/parser.c b/ext/json/parser/parser.c
+index b02aae8fb980..027fbcc26f9d 100644
+--- a/ext/json/parser/parser.c
++++ b/ext/json/parser/parser.c
+@@ -1835,7 +1835,7 @@ static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self)
+     } else {
+         json->max_nesting = 100;
+         json->allow_nan = 0;
+-        json->create_additions = 1;
++        json->create_additions = 0;
+         json->create_id = rb_funcall(mJSON, i_create_id, 0);
+         json->object_class = Qnil;
+         json->array_class = Qnil;
+diff --git a/ext/json/parser/parser.rl b/ext/json/parser/parser.rl
+index d4e7a60e9d1e..fb0bb515decb 100644
+--- a/ext/json/parser/parser.rl
++++ b/ext/json/parser/parser.rl
+@@ -730,7 +730,7 @@ static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self)
+     } else {
+         json->max_nesting = 100;
+         json->allow_nan = 0;
+-        json->create_additions = 1;
++        json->create_additions = 0;
+         json->create_id = rb_funcall(mJSON, i_create_id, 0);
+         json->object_class = Qnil;
+         json->array_class = Qnil;
+

rubygem-json.spec

@@ -2,7 +2,7 @@
 
 Name:           rubygem-%{gem_name}
 Version:        2.2.0
-Release:        201%{?dist}
+Release:        202%{?dist}
 
 Summary:        A JSON implementation in Ruby
 
@@ -10,6 +10,11 @@ Summary:        A JSON implementation in Ruby
 License:        Ruby or GPLv2
 URL:            http://json.rubyforge.org
 Source0:        http://gems.rubyforge.org/gems/%{gem_name}-%{version}.gem
+# https://hackerone.com/reports/706934
+# https://github.com/ruby/ruby/commit/36e9ed7fef6eb2d14becf6c52452e4ab16e4bf01
+# https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
+Patch1:         rubygem-json-2.2.0-CVE-2020-10663-backport.patch
+
 
 BuildRequires:  gcc
 BuildRequires:	ruby(release)
@@ -49,6 +54,12 @@ pushd tmpunpackdir
 gem unpack %{SOURCE0}
 cd %{gem_name}-%{version}
 
+(
+pushd ext/json/ext/
+%patch1 -p3
+popd
+)
+
 # Change cflags to honor Fedora compiler flags correctly
 find . -name extconf.rb | xargs sed -i -e 's|-O3|-O2|' -e 's|-O0|-O2|'
 
@@ -135,6 +146,9 @@ popd
 
 
 %changelog
+* Sat Apr 25 2020 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.2.0-202
+- Backport fix for CVE-2020-10663 from 2.3.0 (bug 1827500)
+
 * Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.0-201
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild