File CVE-2014-2525.patch of Package perl-YAML-LibYAML.398
diff -Naur a/LibYAML/scanner.c b/LibYAML/scanner.c
--- a/LibYAML/scanner.c 2014-03-19 13:11:22.817162337 +0100
+++ b/LibYAML/scanner.c 2014-03-19 13:11:35.733162531 +0100
@@ -2619,6 +2619,9 @@
/* Check if it is a URI-escape sequence. */
if (CHECK(parser->buffer, '%')) {
+ if (!STRING_EXTEND(parser, string))
+ goto error;
+
if (!yaml_parser_scan_uri_escapes(parser,
directive, start_mark, &string)) goto error;
}
diff -Naur a/LibYAML/yaml_private.h b/LibYAML/yaml_private.h
--- a/LibYAML/yaml_private.h 2014-03-19 13:11:22.816162337 +0100
+++ b/LibYAML/yaml_private.h 2014-03-19 13:11:35.734162531 +0100
@@ -132,9 +132,12 @@
(string).start = (string).pointer = (string).end = 0)
#define STRING_EXTEND(context,string) \
- (((string).pointer+5 < (string).end) \
+ ((((string).pointer+5 < (string).end) \
|| yaml_string_extend(&(string).start, \
- &(string).pointer, &(string).end))
+ &(string).pointer, &(string).end)) ? \
+ 1 : \
+ ((context)->error = YAML_MEMORY_ERROR, \
+ 0))
#define CLEAR(context,string) \
((string).pointer = (string).start, \