cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security fix for CVE-2016-4425

Browse Source
This commit is contained in:
jasper 2016-06-28 12:48:30 +00:00
parent b5a9921d52
commit ad16d7f305
3 changed files with 77 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
devel/jansson/patches/patch-cmake_jansson_config_h_cmake Normal file
View File

@ -0,0 +1,17 @@
$OpenBSD: patch-cmake_jansson_config_h_cmake,v 1.1 2016/06/28 12:48:30 jasper Exp $
Security fix for CVE-2016-4425
https://github.com/akheron/jansson/issues/282
--- cmake/jansson_config.h.cmake.orig Thu Oct 2 06:59:26 2014
+++ cmake/jansson_config.h.cmake Tue Jun 28 14:43:32 2016
@@ -60,5 +60,9 @@
#define JSON_HAVE_LOCALECONV @JSON_HAVE_LOCALECONV@
+/* Maximum recursion depth for parsing JSON input.
+ This limits the depth of e.g. array-within-array constructions. */
+#define JSON_PARSER_MAX_DEPTH 2048
+
#endif

16
devel/jansson/patches/patch-src_jansson_config_h_in Normal file
View File

@ -0,0 +1,16 @@
$OpenBSD: patch-src_jansson_config_h_in,v 1.1 2016/06/28 12:48:30 jasper Exp $
Security fix for CVE-2016-4425
https://github.com/akheron/jansson/issues/282
--- src/jansson_config.h.in.orig Thu Oct 2 06:59:26 2014
+++ src/jansson_config.h.in Tue Jun 28 14:43:32 2016
@@ -36,4 +36,8 @@
otherwise to 0. */
#define JSON_HAVE_LOCALECONV @json_have_localeconv@
+/* Maximum recursion depth for parsing JSON input.
+ This limits the depth of e.g. array-within-array constructions. */
+#define JSON_PARSER_MAX_DEPTH 2048
+
#endif

44
devel/jansson/patches/patch-src_load_c Normal file
View File

@ -0,0 +1,44 @@
$OpenBSD: patch-src_load_c,v 1.1 2016/06/28 12:48:30 jasper Exp $
Security fix for CVE-2016-4425
https://github.com/akheron/jansson/issues/282
--- src/load.c.orig Thu Oct 2 06:59:26 2014
+++ src/load.c Tue Jun 28 14:44:09 2016
@@ -61,6 +61,7 @@ typedef struct {
typedef struct {
stream_t stream;
strbuffer_t saved_text;
+ size_t depth;
int token;
union {
struct {
@@ -800,6 +801,12 @@ static json_t *parse_value(lex_t *lex, size_t flags, j
json_t *json;
double value;
+ lex->depth++;
+ if(lex->depth > JSON_PARSER_MAX_DEPTH) {
+ error_set(error, lex, "maximum parsing depth reached");
+ return NULL;
+ }
+
switch(lex->token) {
case TOKEN_STRING: {
const char *value = lex->value.string.val;
@@ -870,12 +877,15 @@ static json_t *parse_value(lex_t *lex, size_t flags, j
if(!json)
return NULL;
+ lex->depth--;
return json;
}
static json_t *parse_json(lex_t *lex, size_t flags, json_error_t *error)
{
json_t *result;
+
+ lex->depth = 0;
lex_scan(lex, error);
if(!(flags & JSON_DECODE_ANY)) {