Blame SOURCES/libyaml-CVE-2014-2525-URL-buffer-overflow.patch

cb67ac
diff -r d7cb9c2731c0 configure.ac
cb67ac
--- a/configure.ac	Mon Feb 03 23:42:24 2014 -0600
cb67ac
+++ b/configure.ac	Fri Mar 14 17:52:43 2014 -0500
cb67ac
@@ -19,7 +19,7 @@
cb67ac
 #           YAML_AGE = 0
cb67ac
 m4_define([YAML_RELEASE], 0)
cb67ac
 m4_define([YAML_CURRENT], 2)
cb67ac
-m4_define([YAML_REVISION], 2)
cb67ac
+m4_define([YAML_REVISION], 4)
cb67ac
 m4_define([YAML_AGE], 0)
cb67ac
 
cb67ac
 # Initialize autoconf & automake.
cb67ac
diff -r d7cb9c2731c0 src/scanner.c
cb67ac
--- a/src/scanner.c	Mon Feb 03 23:42:24 2014 -0600
cb67ac
+++ b/src/scanner.c	Fri Mar 14 17:52:43 2014 -0500
cb67ac
@@ -2629,6 +2629,9 @@
cb67ac
         /* Check if it is a URI-escape sequence. */
cb67ac
 
cb67ac
         if (CHECK(parser->buffer, '%')) {
cb67ac
+            if (!STRING_EXTEND(parser, string))
cb67ac
+                goto error;
cb67ac
+
cb67ac
             if (!yaml_parser_scan_uri_escapes(parser,
cb67ac
                         directive, start_mark, &string)) goto error;
cb67ac
         }
cb67ac
diff -r d7cb9c2731c0 src/yaml_private.h
cb67ac
--- a/src/yaml_private.h	Mon Feb 03 23:42:24 2014 -0600
cb67ac
+++ b/src/yaml_private.h	Fri Mar 14 17:52:43 2014 -0500
cb67ac
@@ -143,9 +143,12 @@
cb67ac
      (string).start = (string).pointer = (string).end = 0)
cb67ac
 
cb67ac
 #define STRING_EXTEND(context,string)                                           \
cb67ac
-    (((string).pointer+5 < (string).end)                                        \
cb67ac
+    ((((string).pointer+5 < (string).end)                                       \
cb67ac
         || yaml_string_extend(&(string).start,                                  \
cb67ac
-            &(string).pointer, &(string).end))
cb67ac
+            &(string).pointer, &(string).end)) ?                                \
cb67ac
+         1 :                                                                    \
cb67ac
+        ((context)->error = YAML_MEMORY_ERROR,                                  \
cb67ac
+         0))
cb67ac
 
cb67ac
 #define CLEAR(context,string)                                                   \
cb67ac
     ((string).pointer = (string).start,                                         \
cb67ac
diff -r d7cb9c2731c0 win32/config.h