|
|
@@ -0,0 +1,176 @@
|
|
|
+Description: CVE-2013-6393: yaml_parser-{un,}roll-indent: fix int overflow in column argument
|
|
|
+ This expands upon the original indent column overflow patch from
|
|
|
+ comment #12.
|
|
|
+ .
|
|
|
+ The default parser indention is represented as an indention of -1.
|
|
|
+ The original patch only modified the type of the column parameter to
|
|
|
+ the roll/unroll functions, changing it from int to size_t to guard
|
|
|
+ against integer overflow. However, there are code paths that call
|
|
|
+ yaml_parser_unroll_indent with a column of -1 in order to reset the
|
|
|
+ parser back to the initial indention. Since the column is now of
|
|
|
+ type size_t and thus unsigned, passing a column value of -1 caused
|
|
|
+ the column to underflow in this case.
|
|
|
+ .
|
|
|
+ This new patch modifies the roll/unroll functions to handle the -1
|
|
|
+ indent as a special case. In addition, it adds a new function,
|
|
|
+ yaml_parser_reset_indent. It is nearly an exact copy of
|
|
|
+ yaml_parser_unroll_indent, except it does not take a column
|
|
|
+ parameter. Instead it unrolls to a literal -1 indention, which does
|
|
|
+ not suffer from the underflow.
|
|
|
+ .
|
|
|
+ Code paths that previously called yaml_parser_unroll_indent with a
|
|
|
+ column of -1 are updated to call the new yaml_parser_reset_indent
|
|
|
+ function instead.
|
|
|
+ .
|
|
|
+ With this patch instead of the original:
|
|
|
+ .
|
|
|
+ - `make check` still passes
|
|
|
+ .
|
|
|
+ - The reproducer script completes successfully with exit code 0
|
|
|
+ .
|
|
|
+ - The issue raised by John Haxby has been corrected and exits with SUCCESS
|
|
|
+Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1033990
|
|
|
+Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1033990
|
|
|
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737076
|
|
|
+Last-Update: 2014-01-29
|
|
|
+---
|
|
|
+# HG changeset patch
|
|
|
+# User John Eckersberg <jeckersb@redhat.com>
|
|
|
+# Date 1390870108 18000
|
|
|
+# Mon Jan 27 19:48:28 2014 -0500
|
|
|
+# Node ID 7179aa474f31e73834adda26b77bfc25bfe5143d
|
|
|
+# Parent 3e6507fa0c26d20c09f8f468f2bd04aa2fd1b5b5
|
|
|
+yaml_parser-{un,}roll-indent: fix int overflow in column argument
|
|
|
+
|
|
|
+diff -r 3e6507fa0c26 -r 7179aa474f31 src/scanner.c
|
|
|
+--- a/src/scanner.c Mon Dec 24 03:51:32 2012 +0000
|
|
|
++++ b/src/scanner.c Mon Jan 27 19:48:28 2014 -0500
|
|
|
+@@ -615,11 +615,14 @@
|
|
|
+ */
|
|
|
+
|
|
|
+ static int
|
|
|
+-yaml_parser_roll_indent(yaml_parser_t *parser, int column,
|
|
|
++yaml_parser_roll_indent(yaml_parser_t *parser, size_t column,
|
|
|
+ int number, yaml_token_type_t type, yaml_mark_t mark);
|
|
|
+
|
|
|
+ static int
|
|
|
+-yaml_parser_unroll_indent(yaml_parser_t *parser, int column);
|
|
|
++yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column);
|
|
|
++
|
|
|
++static int
|
|
|
++yaml_parser_reset_indent(yaml_parser_t *parser);
|
|
|
+
|
|
|
+ /*
|
|
|
+ * Token fetchers.
|
|
|
+@@ -1206,7 +1209,7 @@
|
|
|
+ */
|
|
|
+
|
|
|
+ static int
|
|
|
+-yaml_parser_roll_indent(yaml_parser_t *parser, int column,
|
|
|
++yaml_parser_roll_indent(yaml_parser_t *parser, size_t column,
|
|
|
+ int number, yaml_token_type_t type, yaml_mark_t mark)
|
|
|
+ {
|
|
|
+ yaml_token_t token;
|
|
|
+@@ -1216,7 +1219,7 @@
|
|
|
+ if (parser->flow_level)
|
|
|
+ return 1;
|
|
|
+
|
|
|
+- if (parser->indent < column)
|
|
|
++ if (parser->indent == -1 || parser->indent < column)
|
|
|
+ {
|
|
|
+ /*
|
|
|
+ * Push the current indentation level to the stack and set the new
|
|
|
+@@ -1254,7 +1257,7 @@
|
|
|
+
|
|
|
+
|
|
|
+ static int
|
|
|
+-yaml_parser_unroll_indent(yaml_parser_t *parser, int column)
|
|
|
++yaml_parser_unroll_indent(yaml_parser_t *parser, size_t column)
|
|
|
+ {
|
|
|
+ yaml_token_t token;
|
|
|
+
|
|
|
+@@ -1263,6 +1266,15 @@
|
|
|
+ if (parser->flow_level)
|
|
|
+ return 1;
|
|
|
+
|
|
|
++ /*
|
|
|
++ * column is unsigned and parser->indent is signed, so if
|
|
|
++ * parser->indent is less than zero the conditional in the while
|
|
|
++ * loop below is incorrect. Guard against that.
|
|
|
++ */
|
|
|
++
|
|
|
++ if (parser->indent < 0)
|
|
|
++ return 1;
|
|
|
++
|
|
|
+ /* Loop through the intendation levels in the stack. */
|
|
|
+
|
|
|
+ while (parser->indent > column)
|
|
|
+@@ -1283,6 +1295,41 @@
|
|
|
+ }
|
|
|
+
|
|
|
+ /*
|
|
|
++ * Pop indentation levels from the indents stack until the current
|
|
|
++ * level resets to -1. For each intendation level, append the
|
|
|
++ * BLOCK-END token.
|
|
|
++ */
|
|
|
++
|
|
|
++static int
|
|
|
++yaml_parser_reset_indent(yaml_parser_t *parser)
|
|
|
++{
|
|
|
++ yaml_token_t token;
|
|
|
++
|
|
|
++ /* In the flow context, do nothing. */
|
|
|
++
|
|
|
++ if (parser->flow_level)
|
|
|
++ return 1;
|
|
|
++
|
|
|
++ /* Loop through the intendation levels in the stack. */
|
|
|
++
|
|
|
++ while (parser->indent > -1)
|
|
|
++ {
|
|
|
++ /* Create a token and append it to the queue. */
|
|
|
++
|
|
|
++ TOKEN_INIT(token, YAML_BLOCK_END_TOKEN, parser->mark, parser->mark);
|
|
|
++
|
|
|
++ if (!ENQUEUE(parser, parser->tokens, token))
|
|
|
++ return 0;
|
|
|
++
|
|
|
++ /* Pop the indentation level. */
|
|
|
++
|
|
|
++ parser->indent = POP(parser, parser->indents);
|
|
|
++ }
|
|
|
++
|
|
|
++ return 1;
|
|
|
++}
|
|
|
++
|
|
|
++/*
|
|
|
+ * Initialize the scanner and produce the STREAM-START token.
|
|
|
+ */
|
|
|
+
|
|
|
+@@ -1338,7 +1385,7 @@
|
|
|
+
|
|
|
+ /* Reset the indentation level. */
|
|
|
+
|
|
|
+- if (!yaml_parser_unroll_indent(parser, -1))
|
|
|
++ if (!yaml_parser_reset_indent(parser))
|
|
|
+ return 0;
|
|
|
+
|
|
|
+ /* Reset simple keys. */
|
|
|
+@@ -1369,7 +1416,7 @@
|
|
|
+
|
|
|
+ /* Reset the indentation level. */
|
|
|
+
|
|
|
+- if (!yaml_parser_unroll_indent(parser, -1))
|
|
|
++ if (!yaml_parser_reset_indent(parser))
|
|
|
+ return 0;
|
|
|
+
|
|
|
+ /* Reset simple keys. */
|
|
|
+@@ -1407,7 +1454,7 @@
|
|
|
+
|
|
|
+ /* Reset the indentation level. */
|
|
|
+
|
|
|
+- if (!yaml_parser_unroll_indent(parser, -1))
|
|
|
++ if (!yaml_parser_reset_indent(parser))
|
|
|
+ return 0;
|
|
|
+
|
|
|
+ /* Reset simple keys. */
|
Gustavo Zacarias