Fix unbounded recursion CVEs
authorSimon Quigley <tsimonq2@debian.org>
Wed, 13 May 2020 17:26:42 +0000 (18:26 +0100)
committerGianfranco Costamagna <locutusofborg@debian.org>
Wed, 13 May 2020 17:26:42 +0000 (18:26 +0100)
commit1971899b888796334e6327709dd440eb84c36d62
treed5c248138dd17a4e65a9cfd6a0e45087152bc563
parent69b129efa1474f5a342d3badaa1c4e7c2bac083a
Fix unbounded recursion CVEs

Origin: https://github.com/jbeder/yaml-cpp/pull/807
Forwarded: yes
Bug: https://github.com/jbeder/yaml-cpp/issues/459
Bug: https://github.com/jbeder/yaml-cpp/issues/655
Bug: https://github.com/jbeder/yaml-cpp/issues/654
Bug: https://github.com/jbeder/yaml-cpp/issues/660

This cherry-picks the (so-far-unmerged) upstream pull request.
The final 5 commits of that PR are not included; they only add tests
to a file not present in the 0.6.2 (or 0.6.3) release.

From d540476e31b080aa1f903ad20ec0426dd3838be7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Antoine=20Beaupr=C3=A9?= <anarcat@debian.org>
Date: Tue, 25 Apr 2017 20:10:20 -0400
Subject: [PATCH 1/9] fix stack overflow in HandleNode() (CVE-2017-5950)

simply set a hardcoded recursion limit to 2000 (inspired by Python's)
to avoid infinitely recursing into arbitrary data structures

assert() the depth. unsure if this is the right approach, but given
that HandleNode() is "void", I am not sure how else to return an
error. the problem with this approach of course is that it will still
crash the caller, unless they have proper exception handling in place.

Closes: #459
Gbp-Pq: Name fix-unbounded-recursion-depth.patch
include/yaml-cpp/depthguard.h [new file with mode: 0644]
src/depthguard.cpp [new file with mode: 0644]
src/singledocparser.cpp
src/singledocparser.h