Bug 209492 - devel/jansson: patch for CVE-2016-4425 (r414586) breaks jansson: now it fails to parse large flat json files
Summary: devel/jansson: patch for CVE-2016-4425 (r414586) breaks jansson: now it fails...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Vanilla I. Shu
URL:
Keywords: regression
Depends on:
Blocks:
 
Reported: 2016-05-14 03:53 UTC by Yuri Victorovich
Modified: 2016-05-20 02:46 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (vanilla)
junovitch: merge-quarterly+

Attachments
jansson-test.c (556 bytes, text/plain)
2016-05-14 16:33 UTC, Yuri Victorovich 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Yuri Victorovich freebsd_committer freebsd_triage 2016-05-14 03:53:48 UTC 
With CVE-2016-4425 patch json_loads now fails to parse such json:

{"x":{

"a":[
["aaaa1"],
["aaaa2"],
["aaaa3"],
...
few thousand items
...
]
}}

You limited "breadth", not "depth".
Comment 1 Jason Unovitch freebsd_committer freebsd_triage 2016-05-14 12:33:30 UTC 
Hi Yuri,
Thanks for the report.  The reference to this PR has been attached to the original upstream issue at https://github.com/akheron/jansson/issues/282.  Let's see what they want to do about this regression.
Comment 2 Jason Unovitch freebsd_committer freebsd_triage 2016-05-14 13:03:11 UTC 
Reported as https://github.com/akheron/jansson/issues/286 per their request.

Yuri, can you upload a copy of the test case either here or to the upstream issue?
Comment 3 Yuri Victorovich freebsd_committer freebsd_triage 2016-05-14 16:33:28 UTC 
Created attachment 170278 [details]
jansson-test.c

Please build the attached C testcase with this command:
> cc -o jansson-test -I /usr/local/include -L/usr/local/lib -ljansson jansson-test.c
Comment 4 commit-hook freebsd_committer freebsd_triage 2016-05-16 02:26:24 UTC 
A commit references this bug:

Author: vanilla
Date: Mon May 16 02:25:41 UTC 2016
New revision: 415303
URL: https://svnweb.freebsd.org/changeset/ports/415303

Log:
  Fix issue to parse large flat json files.

  PR:		209492
  Reported by:	yuri@rawbw.com

Changes:
  head/devel/jansson/Makefile
  head/devel/jansson/files/patch-CVE-2016-4425
Comment 5 Vanilla I. Shu freebsd_committer freebsd_triage 2016-05-16 02:26:58 UTC 
I think I missing some part of upstream,

after review whole patches,

It should be ok now, please try it again, thanks.
Comment 6 commit-hook freebsd_committer freebsd_triage 2016-05-20 01:39:11 UTC 
A commit references this bug:

Author: junovitch
Date: Fri May 20 01:39:07 UTC 2016
New revision: 415538
URL: https://svnweb.freebsd.org/changeset/ports/415538

Log:
  MFH: r415303

  Fix issue to parse large flat json files.

  PR:		209492
  Reported by:	yuri@rawbw.com

  Approved by:	ports-secteam (with hat)

Changes:
_U  branches/2016Q2/
  branches/2016Q2/devel/jansson/Makefile
  branches/2016Q2/devel/jansson/files/patch-CVE-2016-4425
Comment 7 Jason Unovitch freebsd_committer freebsd_triage 2016-05-20 01:40:09 UTC 
Set merge-quarterly+ appropriately. The original fix and fix for the regression it caused both should be in quarterly.
Comment 8 Yuri Victorovich freebsd_committer freebsd_triage 2016-05-20 02:46:49 UTC 
This works.

Thanks!