Blame SOURCES/libyaml-CVE-2013-6393-indent-and-flow-overflow-1-of-3.patch

cb67ac
# HG changeset patch
cb67ac
# User Kirill Simonov <xi@resolvent.net>
cb67ac
# Date 1391406104 21600
cb67ac
#      Sun Feb 02 23:41:44 2014 -0600
cb67ac
# Node ID f859ed1eb757a3562b98a28a8ce69274bfd4b3f2
cb67ac
# Parent  da9bc6f12781a583076c7b60d057df5d7b50f96f
cb67ac
Guard against overflows in indent and flow_level.
cb67ac
cb67ac
diff -r da9bc6f12781 -r f859ed1eb757 src/scanner.c
cb67ac
--- a/src/scanner.c	Sun Feb 02 20:54:05 2014 -0600
cb67ac
+++ b/src/scanner.c	Sun Feb 02 23:41:44 2014 -0600
cb67ac
@@ -615,11 +615,11 @@
cb67ac
  */
cb67ac
 
cb67ac
 static int
cb67ac
-yaml_parser_roll_indent(yaml_parser_t *parser, int column,
cb67ac
-        int number, yaml_token_type_t type, yaml_mark_t mark);
cb67ac
+yaml_parser_roll_indent(yaml_parser_t *parser, ptrdiff_t column,
cb67ac
+        ptrdiff_t number, yaml_token_type_t type, yaml_mark_t mark);
cb67ac
 
cb67ac
 static int
cb67ac
-yaml_parser_unroll_indent(yaml_parser_t *parser, int column);
cb67ac
+yaml_parser_unroll_indent(yaml_parser_t *parser, ptrdiff_t column);
cb67ac
 
cb67ac
 /*
cb67ac
  * Token fetchers.
cb67ac
@@ -1103,7 +1103,7 @@
cb67ac
      */
cb67ac
 
cb67ac
     int required = (!parser->flow_level
cb67ac
-            && parser->indent == (int)parser->mark.column);
cb67ac
+            && parser->indent == (ptrdiff_t)parser->mark.column);
cb67ac
 
cb67ac
     /*
cb67ac
      * A simple key is required only when it is the first token in the current
cb67ac
@@ -1176,6 +1176,9 @@
cb67ac
 
cb67ac
     /* Increase the flow level. */
cb67ac
 
cb67ac
+    if (parser->flow_level == INT_MAX)
cb67ac
+        return 0;
cb67ac
+
cb67ac
     parser->flow_level++;
cb67ac
 
cb67ac
     return 1;
cb67ac
@@ -1206,8 +1209,8 @@
cb67ac
  */
cb67ac
 
cb67ac
 static int
cb67ac
-yaml_parser_roll_indent(yaml_parser_t *parser, int column,
cb67ac
-        int number, yaml_token_type_t type, yaml_mark_t mark)
cb67ac
+yaml_parser_roll_indent(yaml_parser_t *parser, ptrdiff_t column,
cb67ac
+        ptrdiff_t number, yaml_token_type_t type, yaml_mark_t mark)
cb67ac
 {
cb67ac
     yaml_token_t token;
cb67ac
 
cb67ac
@@ -1226,6 +1229,9 @@
cb67ac
         if (!PUSH(parser, parser->indents, parser->indent))
cb67ac
             return 0;
cb67ac
 
cb67ac
+        if (column > INT_MAX)
cb67ac
+            return 0;
cb67ac
+
cb67ac
         parser->indent = column;
cb67ac
 
cb67ac
         /* Create a token and insert it into the queue. */
cb67ac
@@ -1254,7 +1260,7 @@
cb67ac
 
cb67ac
 
cb67ac
 static int
cb67ac
-yaml_parser_unroll_indent(yaml_parser_t *parser, int column)
cb67ac
+yaml_parser_unroll_indent(yaml_parser_t *parser, ptrdiff_t column)
cb67ac
 {
cb67ac
     yaml_token_t token;
cb67ac
 
cb67ac
diff -r da9bc6f12781 -r f859ed1eb757 src/yaml_private.h
cb67ac
--- a/src/yaml_private.h	Sun Feb 02 20:54:05 2014 -0600
cb67ac
+++ b/src/yaml_private.h	Sun Feb 02 23:41:44 2014 -0600
cb67ac
@@ -7,6 +7,7 @@
cb67ac
 
cb67ac
 #include <assert.h>
cb67ac
 #include <limits.h>
cb67ac
+#include <stddef.h>
cb67ac
 
cb67ac
 /*
cb67ac
  * Memory management.