Date: Fri, 20 May 2016 01:39:07 +0000 (UTC) From: Jason Unovitch <junovitch@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r415538 - in branches/2016Q2/devel/jansson: . files Message-ID: <201605200139.u4K1d7Ha092203@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: junovitch Date: Fri May 20 01:39:07 2016 New Revision: 415538 URL: https://svnweb.freebsd.org/changeset/ports/415538 Log: MFH: r415303 Fix issue to parse large flat json files. PR: 209492 Reported by: yuri@rawbw.com Approved by: ports-secteam (with hat) Modified: branches/2016Q2/devel/jansson/Makefile branches/2016Q2/devel/jansson/files/patch-CVE-2016-4425 Directory Properties: branches/2016Q2/ (props changed) Modified: branches/2016Q2/devel/jansson/Makefile ============================================================================== --- branches/2016Q2/devel/jansson/Makefile Fri May 20 01:23:56 2016 (r415537) +++ branches/2016Q2/devel/jansson/Makefile Fri May 20 01:39:07 2016 (r415538) @@ -3,7 +3,7 @@ PORTNAME= jansson PORTVERSION= 2.7 -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= devel MASTER_SITES= http://www.digip.org/jansson/releases/ Modified: branches/2016Q2/devel/jansson/files/patch-CVE-2016-4425 ============================================================================== --- branches/2016Q2/devel/jansson/files/patch-CVE-2016-4425 Fri May 20 01:23:56 2016 (r415537) +++ branches/2016Q2/devel/jansson/files/patch-CVE-2016-4425 Fri May 20 01:39:07 2016 (r415538) @@ -1,16 +1,16 @@ ---- src/jansson_config.h.in.orig 2016-05-04 11:43:48.386196000 +0800 -+++ src/jansson_config.h.in 2016-05-04 11:44:21.204996000 +0800 +--- src/jansson_config.h.in.orig 2016-05-16 10:22:34.333432000 +0800 ++++ src/jansson_config.h.in 2016-05-16 10:23:18.042096000 +0800 @@ -36,4 +36,8 @@ otherwise to 0. */ #define JSON_HAVE_LOCALECONV @json_have_localeconv@ +/* Maximum recursion depth for parsing JSON input. -+ * This limits the depth of e.g. array-within-array constructions. */ ++ This limits the depth of e.g. array-within-array constructions. */ +#define JSON_PARSER_MAX_DEPTH 2048 + #endif ---- src/load.c.orig 2016-05-04 11:44:34.356957000 +0800 -+++ src/load.c 2016-05-04 11:46:44.547307000 +0800 +--- src/load.c.orig 2014-10-02 12:59:26.000000000 +0800 ++++ src/load.c 2016-05-16 10:21:41.006239000 +0800 @@ -61,6 +61,7 @@ typedef struct { typedef struct { stream_t stream; @@ -32,7 +32,15 @@ switch(lex->token) { case TOKEN_STRING: { const char *value = lex->value.string.val; -@@ -877,6 +884,8 @@ static json_t *parse_json(lex_t *lex, si +@@ -870,6 +877,7 @@ static json_t *parse_value(lex_t *lex, s + if(!json) + return NULL; + ++ lex->depth--; + return json; + } + +@@ -877,6 +885,8 @@ static json_t *parse_json(lex_t *lex, si { json_t *result;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605200139.u4K1d7Ha092203>