[PATCH] merge revision(s) 36e9ed7fef6eb2d14becf6c52452e4ab16e4bf01: [Backport #16698]

        backport 80b5a0ff2a7709367178f29d4ebe1c54122b1c27 partially as a
         securify fix for CVE-2020-10663. The patch was provided by Jeremy Evans.

        git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67856 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67869 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Author: Utkarsh Gupta <utkarsh@debian.org>

Gbp-Pq: Name CVE-2020-10663.patch

diff --git a/ext/json/parser/parser.c b/ext/json/parser/parser.c
index 773605cf7c8b367e5ada0c4521c4bfee51ef3827..3e1a2bb9547538dc2fb88619efbf9ced9e5e4dee 100644 (file)
--- a/ext/json/parser/parser.c
+++ b/ext/json/parser/parser.c
@@ -1739,7 +1739,7 @@ static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self)
     } else {
         json->max_nesting = 100;
         json->allow_nan = 0;
-        json->create_additions = 1;
+        json->create_additions = 0;
         json->create_id = rb_funcall(mJSON, i_create_id, 0);
         json->object_class = Qnil;
         json->array_class = Qnil;

diff --git a/ext/json/parser/parser.rl b/ext/json/parser/parser.rl
index 2fa0caee7a6855b9982dc11c631755e899981deb..1d8a9674001e617e2d7b2a8209fc332408b31f11 100644 (file)
--- a/ext/json/parser/parser.rl
+++ b/ext/json/parser/parser.rl
@@ -723,7 +723,7 @@ static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self)
     } else {
         json->max_nesting = 100;
         json->allow_nan = 0;
-        json->create_additions = 1;
+        json->create_additions = 0;
         json->create_id = rb_funcall(mJSON, i_create_id, 0);
         json->object_class = Qnil;
         json->array_class = Qnil;