From c82e88dd00d1b0b7fcfb4e5628d99611388cef6f Mon Sep 17 00:00:00 2001 From: rawnix ports Date: Sat, 26 Sep 2026 18:19:05 +0000 Subject: sync 2026-09-26 18:19 UTC 1672 files changed, 151396 insertions(+) --- libs/yajl/.footprint | 16 +++++++ libs/yajl/.signature | 9 ++++ libs/yajl/MAKEPKG | 60 ++++++++++++++++++++++++++ libs/yajl/yajl-2.1.0-CVE-2017-16516.patch | 43 +++++++++++++++++++ libs/yajl/yajl-2.1.0-CVE-2022-24795.patch | 60 ++++++++++++++++++++++++++ libs/yajl/yajl-2.1.0-memory_leak.patch | 71 +++++++++++++++++++++++++++++++ 6 files changed, 259 insertions(+) create mode 100644 libs/yajl/.footprint create mode 100644 libs/yajl/.signature create mode 100644 libs/yajl/MAKEPKG create mode 100644 libs/yajl/yajl-2.1.0-CVE-2017-16516.patch create mode 100644 libs/yajl/yajl-2.1.0-CVE-2022-24795.patch create mode 100644 libs/yajl/yajl-2.1.0-memory_leak.patch (limited to 'libs/yajl') diff --git a/libs/yajl/.footprint b/libs/yajl/.footprint new file mode 100644 index 0000000..7d34f5f --- /dev/null +++ b/libs/yajl/.footprint @@ -0,0 +1,16 @@ +drwxr-xr-x root/root usr/ +drwxr-xr-x root/root usr/include/ +drwxr-xr-x root/root usr/include/yajl/ +-rw-r--r-- root/root usr/include/yajl/yajl_common.h +-rw-r--r-- root/root usr/include/yajl/yajl_gen.h +-rw-r--r-- root/root usr/include/yajl/yajl_parse.h +-rw-r--r-- root/root usr/include/yajl/yajl_tree.h +-rw-r--r-- root/root usr/include/yajl/yajl_version.h +drwxr-xr-x root/root usr/lib/ +-rwxr-xr-x root/root usr/lib/libyajl.so.2.1.0 +-rw-r--r-- root/root usr/lib/libyajl_s.a +lrwxrwxrwx root/root usr/lib/libyajl.so -> libyajl.so.2 +lrwxrwxrwx root/root usr/lib/libyajl.so.2 -> libyajl.so.2.1.0 +drwxr-xr-x root/root usr/share/ +drwxr-xr-x root/root usr/share/pkgconfig/ +-rw-r--r-- root/root usr/share/pkgconfig/yajl.pc diff --git a/libs/yajl/.signature b/libs/yajl/.signature new file mode 100644 index 0000000..7b3c02a --- /dev/null +++ b/libs/yajl/.signature @@ -0,0 +1,9 @@ +RWTZ9IduCSQ/mCUy2PD527uVJuDlCg5QHKnxciFkgIrqkglCqTMDVI1x0aUgDXyNN//Y+aLfykVrWuwFT9QqV5wisaZBDfzZ3Qg= + +SHA256 (MAKEPKG) = 32313d91f0832f17086256e3f912801a612cc5cf334b9b3546b56950679a604b +SHA256 (.footprint) = 623c66d05f4721c6c3097cf7f2ab0f40ca52c995a72c51475fa0a59d11ecc2dc +SHA256 (yajl-2.1.0.tar.gz) = 3fb73364a5a30efe615046d07e6db9d09fd2b41c763c5f7d3bfb121cd5c5ac5a +SHA256 (yajl-2.1.0-CVE-2017-16516.patch) = b5eb60178071e2df0088856939fabbd45864d836259b611260fc498a34154614 +SHA256 (yajl-2.1.0-CVE-2022-24795.patch) = a58f51871a9ebd80849c8bc7418df6f58d66f8fe701f5e11a6429fd0f32d9ecf +SHA256 (yajl-2.1.0-memory_leak.patch) = cd36f7f51520baac2bd8467d7bbb04f2c6e261968981a1e8c10ff4ed7a0aff69 +SHA256 (yajl#2.1.0-1.pkg.tar.gz) = 0b03cf6762f1f295684e254b2876f6a2eebd9347e634466958ba0ef24dee0a6f diff --git a/libs/yajl/MAKEPKG b/libs/yajl/MAKEPKG new file mode 100644 index 0000000..dbc5656 --- /dev/null +++ b/libs/yajl/MAKEPKG @@ -0,0 +1,60 @@ +#!/bin/mkpkg +# description: Yet Another JSON Library +# url: https://github.com/lloyd/yajl + +name=yajl +version=2.1.0 +release=1 +depends=() +makedeps=(cmake) +source=(https://github.com/lloyd/$name/archive/refs/tags/$version.tar.gz + $name-$version-CVE-2017-16516.patch + $name-$version-CVE-2022-24795.patch + $name-$version-memory_leak.patch) +renames=($name-$version.tar.gz) + +sha256sums=( + "3fb73364a5a30efe615046d07e6db9d09fd2b41c763c5f7d3bfb121cd5c5ac5a" + "b5eb60178071e2df0088856939fabbd45864d836259b611260fc498a34154614" + "a58f51871a9ebd80849c8bc7418df6f58d66f8fe701f5e11a6429fd0f32d9ecf" + "cd36f7f51520baac2bd8467d7bbb04f2c6e261968981a1e8c10ff4ed7a0aff69" +) + +patch() { + cd $name-$version + for p in "$SRC"/*.patch; do + [ -f "$p" ] && patch -p1 -i "$p" + done + + # remove broken subdirectories - only need the library + sed -i '/ADD_SUBDIRECTORY(test)/d; + /ADD_SUBDIRECTORY(reformatter)/d; + /ADD_SUBDIRECTORY(verify)/d; + /ADD_SUBDIRECTORY(example)/d; + /ADD_SUBDIRECTORY(perf)/d; + /ADD_CUSTOM_TARGET(test/,+2d; + /ADD_CUSTOM_TARGET(test-api/,+1d; + /INCLUDE(YAJLDoc.cmake)/d' CMakeLists.txt + + # fix minimum cmake version + sed -i 's/CMAKE_MINIMUM_REQUIRED(VERSION 2.6)/CMAKE_MINIMUM_REQUIRED(VERSION 3.5)/' CMakeLists.txt +} + +build() { + cmake -B build -S $name-$version \ + -DCMAKE_INSTALL_PREFIX=/usr \ + -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_POLICY_VERSION_MINIMUM=3.5 \ + -DCMAKE_POLICY_DEFAULT_CMP0026=OLD \ + -W no-dev + + cmake --build build + DESTDIR=$PKG cmake --install build +} + +signify() { + untrusted comment: public key + RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3 +} + +# vim: filetype=sh diff --git a/libs/yajl/yajl-2.1.0-CVE-2017-16516.patch b/libs/yajl/yajl-2.1.0-CVE-2017-16516.patch new file mode 100644 index 0000000..7d48816 --- /dev/null +++ b/libs/yajl/yajl-2.1.0-CVE-2017-16516.patch @@ -0,0 +1,43 @@ +From 0b5e73c4321de0ba1d495fdc0967054b2a77931c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Mon, 10 Jul 2023 13:36:10 +0100 +Subject: [PATCH 5/8] Fix for CVE-2017-16516 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Description: Fix for CVE-2017-16516 + Potential buffer overread: A JSON file can cause denial of service. +Origin: https://github.com/brianmario/yajl-ruby/commit/a8ca8f476655adaa187eedc60bdc770fff3c51ce +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040036 +Bug: https://github.com/lloyd/yajl/issues/248 + +Patch taken from Debian package source + +NB, Fedora code can't trigger the reported aborts since it passes the +-DNDEBUG flag, but pulling the fix for robustness in case a future +change enables the assert()s. + +Signed-off-by: Daniel P. Berrangé +--- + src/yajl_encode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/yajl_encode.c b/src/yajl_encode.c +index fd08258..0d97cc5 100644 +--- a/src/yajl_encode.c ++++ b/src/yajl_encode.c +@@ -139,8 +139,8 @@ void yajl_string_decode(yajl_buf buf, const unsigned char * str, + end+=3; + /* check if this is a surrogate */ + if ((codepoint & 0xFC00) == 0xD800) { +- end++; +- if (str[end] == '\\' && str[end + 1] == 'u') { ++ if (end + 2 < len && str[end + 1] == '\\' && str[end + 2] == 'u') { ++ end++; + unsigned int surrogate = 0; + hexToDigit(&surrogate, str + end + 2); + codepoint = +-- +2.41.0 + diff --git a/libs/yajl/yajl-2.1.0-CVE-2022-24795.patch b/libs/yajl/yajl-2.1.0-CVE-2022-24795.patch new file mode 100644 index 0000000..704e884 --- /dev/null +++ b/libs/yajl/yajl-2.1.0-CVE-2022-24795.patch @@ -0,0 +1,60 @@ +From 17de4d15687aa30c49660dc4b792b1fb4d38b569 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= +Date: Thu, 7 Apr 2022 17:29:54 +0200 +Subject: [PATCH 6/8] Fix CVE-2022-24795 + +There was an integer overflow in yajl_buf_ensure_available() leading +to allocating less memory than requested. Then data were written past +the allocated heap buffer in yajl_buf_append(), the only caller of +yajl_buf_ensure_available(). Another result of the overflow was an +infinite loop without a return from yajl_buf_ensure_available(). + +yajl-ruby project, which bundles yajl, fixed it + by checking for the +integer overflow, fortifying buffer allocations, and report the +failures to a caller. But then the caller yajl_buf_append() skips +a memory write if yajl_buf_ensure_available() failed leading to a data +corruption. + +A yajl fork mainter recommended calling memory allocation callbacks with +the large memory request and let them to handle it. But that has the +problem that it's not possible pass the overely large size to the +callbacks. + +This patch catches the integer overflow and terminates the process +with abort(). + +https://github.com/lloyd/yajl/issues/239 +https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm +(cherry picked from commit 23cea2d7677e396efed78bbf1bf153961fab6bad + in https://github.com/ppisar/yajl) +--- + src/yajl_buf.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/src/yajl_buf.c b/src/yajl_buf.c +index 1aeafde..55c11ad 100644 +--- a/src/yajl_buf.c ++++ b/src/yajl_buf.c +@@ -45,7 +45,17 @@ void yajl_buf_ensure_available(yajl_buf buf, size_t want) + + need = buf->len; + +- while (want >= (need - buf->used)) need <<= 1; ++ if (((buf->used > want) ? buf->used : want) > (size_t)(buf->used + want)) { ++ /* We cannot allocate more memory than SIZE_MAX. */ ++ abort(); ++ } ++ while (want >= (need - buf->used)) { ++ if (need >= (size_t)((size_t)(-1)<<1)>>1) { ++ /* need would overflow. */ ++ abort(); ++ } ++ need <<= 1; ++ } + + if (need != buf->len) { + buf->data = (unsigned char *) YA_REALLOC(buf->alloc, buf->data, need); +-- +2.41.0 + diff --git a/libs/yajl/yajl-2.1.0-memory_leak.patch b/libs/yajl/yajl-2.1.0-memory_leak.patch new file mode 100644 index 0000000..aa0bd0e --- /dev/null +++ b/libs/yajl/yajl-2.1.0-memory_leak.patch @@ -0,0 +1,71 @@ +From c4304a2c04a1b392eb1464a9da892a9e0dff7683 Mon Sep 17 00:00:00 2001 +From: wujing +Date: Thu, 14 Feb 2019 03:12:30 +0800 +Subject: [PATCH 7/8] yajl: fix memory leak problem + +reason: fix memory leak problem +(cherry picked from commit 3d65cb0c6db4d433e5e42ee7d91d8a04e21337cf + in https://github.com/openEuler-BaseService) + +Fixes: https://github.com/lloyd/yajl/issues/250 (CVE-2023-33460) +--- + src/yajl_tree.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/yajl_tree.c b/src/yajl_tree.c +index 3d357a3..4b3cf2b 100644 +--- a/src/yajl_tree.c ++++ b/src/yajl_tree.c +@@ -143,7 +143,7 @@ static yajl_val context_pop(context_t *ctx) + ctx->stack = stack->next; + + v = stack->value; +- ++ free (stack->key); + free (stack); + + return (v); +@@ -444,6 +444,10 @@ yajl_val yajl_tree_parse (const char *input, + snprintf(error_buffer, error_buffer_size, "%s", internal_err_str); + YA_FREE(&(handle->alloc), internal_err_str); + } ++ while(ctx.stack != NULL) { ++ yajl_val v = context_pop(&ctx); ++ yajl_tree_free(v); ++ } + yajl_free (handle); + return NULL; + } +-- +2.41.0 + +From 9cb871049261eeda844b8943d15580763a0ac3d3 Mon Sep 17 00:00:00 2001 +From: "zhang.jiujiu" <282627424@qq.com> +Date: Tue, 7 Dec 2021 22:37:02 +0800 +Subject: [PATCH 8/8] fix memory leaks + +(cherry picked from commit 23a122eddaa28165a6c219000adcc31ff9a8a698 + in https://github.com/openEuler-BaseService) + +Fixes: https://github.com/lloyd/yajl/issues/250 (CVE-2023-33460) +--- + src/yajl_tree.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/yajl_tree.c b/src/yajl_tree.c +index 4b3cf2b..56c7012 100644 +--- a/src/yajl_tree.c ++++ b/src/yajl_tree.c +@@ -449,6 +449,9 @@ yajl_val yajl_tree_parse (const char *input, + yajl_tree_free(v); + } + yajl_free (handle); ++ //If the requested memory is not released in time, it will cause memory leakage ++ if(ctx.root) ++ yajl_tree_free(ctx.root); + return NULL; + } + +-- +2.41.0 + -- cgit v1.3.1