Bug 209492 - devel/jansson: patch for CVE-2016-4425 (r414586) breaks jansson: now it fails to parse large flat json files
Summary: devel/jansson: patch for CVE-2016-4425 (r414586) breaks jansson: now it fails...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Vanilla I. Shu
URL:
Keywords: regression
Depends on:
Blocks:
 
Reported: 2016-05-14 03:53 UTC by Yuri Victorovich
Modified: 2016-05-20 02:46 UTC (History)
1 user (show)

See Also:
bugzilla: maintainer-feedback? (vanilla)
junovitch: merge-quarterly+


Attachments
jansson-test.c (556 bytes, text/plain)
2016-05-14 16:33 UTC, Yuri Victorovich
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Yuri Victorovich freebsd_committer 2016-05-14 03:53:48 UTC
With CVE-2016-4425 patch json_loads now fails to parse such json:

{"x":{

"a":[
["aaaa1"],
["aaaa2"],
["aaaa3"],
...
few thousand items
...
]
}}

You limited "breadth", not "depth".
Comment 1 Jason Unovitch freebsd_committer 2016-05-14 12:33:30 UTC
Hi Yuri,
Thanks for the report.  The reference to this PR has been attached to the original upstream issue at https://github.com/akheron/jansson/issues/282.  Let's see what they want to do about this regression.
Comment 2 Jason Unovitch freebsd_committer 2016-05-14 13:03:11 UTC
Reported as https://github.com/akheron/jansson/issues/286 per their request.

Yuri, can you upload a copy of the test case either here or to the upstream issue?
Comment 3 Yuri Victorovich freebsd_committer 2016-05-14 16:33:28 UTC
Created attachment 170278 [details]
jansson-test.c

Please build the attached C testcase with this command:
> cc -o jansson-test -I /usr/local/include -L/usr/local/lib -ljansson jansson-test.c
Comment 4 commit-hook freebsd_committer 2016-05-16 02:26:24 UTC
A commit references this bug:

Author: vanilla
Date: Mon May 16 02:25:41 UTC 2016
New revision: 415303
URL: https://svnweb.freebsd.org/changeset/ports/415303

Log:
  Fix issue to parse large flat json files.

  PR:		209492
  Reported by:	yuri@rawbw.com

Changes:
  head/devel/jansson/Makefile
  head/devel/jansson/files/patch-CVE-2016-4425
Comment 5 Vanilla I. Shu freebsd_committer 2016-05-16 02:26:58 UTC
I think I missing some part of upstream,

after review whole patches,

It should be ok now, please try it again, thanks.
Comment 6 commit-hook freebsd_committer 2016-05-20 01:39:11 UTC
A commit references this bug:

Author: junovitch
Date: Fri May 20 01:39:07 UTC 2016
New revision: 415538
URL: https://svnweb.freebsd.org/changeset/ports/415538

Log:
  MFH: r415303

  Fix issue to parse large flat json files.

  PR:		209492
  Reported by:	yuri@rawbw.com

  Approved by:	ports-secteam (with hat)

Changes:
_U  branches/2016Q2/
  branches/2016Q2/devel/jansson/Makefile
  branches/2016Q2/devel/jansson/files/patch-CVE-2016-4425
Comment 7 Jason Unovitch freebsd_committer 2016-05-20 01:40:09 UTC
Set merge-quarterly+ appropriately. The original fix and fix for the regression it caused both should be in quarterly.
Comment 8 Yuri Victorovich freebsd_committer 2016-05-20 02:46:49 UTC
This works.

Thanks!