Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 531848 - dev-perl/YAML-LibYAML: Wrapped strings cause assert failure
Summary: dev-perl/YAML-LibYAML: Wrapped strings cause assert failure
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL: https://bitbucket.org/xi/libyaml/issu...
Whiteboard: ~3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-06 21:15 UTC by Agostino Sarubbo
Modified: 2015-06-03 21:04 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-12-06 21:15:57 UTC
From ${URL} :

Hi, I found an edge case in scanner that results in an assert() failing. The document is:
abc: 
   def: 'xxx
'  ghi: 'yyy'
And the issue is caused by that line-wrapped 'xxx'. The next entry needs to be aligned with the first otherwise it's just a normal parsing failure. Result:
[1] Parsing 'crashtest': lt-run-parser: scanner.c:1113: yaml_parser_save_simple_key: Assertion `parser->simple_key_allowed || !required' failed.

fixed in 0.53


@maintainer(s): since the package or the affected version has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.
Comment 1 Patrice Clement gentoo-dev 2015-06-03 20:14:06 UTC
+*YAML-LibYAML-0.590.0 (03 Jun 2015)
+
+  03 Jun 2015; Patrice Clement <monsieurp@gentoo.org>
+  +YAML-LibYAML-0.590.0.ebuild:
+  Version bump. Fix security bug 531848.
+
Comment 2 Patrice Clement gentoo-dev 2015-06-03 20:14:34 UTC
+  03 Jun 2015; Patrice Clement <monsieurp@gentoo.org>
+  -YAML-LibYAML-0.410.0.ebuild, -YAML-LibYAML-0.520.0.ebuild:
+  Remove vulnerable versions. Fix security bug 531848.
+
Comment 3 Kristian Fiskerstrand (RETIRED) gentoo-dev 2015-06-03 21:04:58 UTC
Thanks, closing noglsa