add spec file
This commit is contained in:
small_leek
parent
c7b75beec3
commit
4875c83cde
136
CVE-2017-5950.patch
Normal file
136
CVE-2017-5950.patch
Normal file
@ -0,0 +1,136 @@
|
||||
diff -Nur yaml-cpp-yaml-cpp-0.6.3-old/include/yaml-cpp/depthguard.h yaml-cpp-yaml-cpp-0.6.3/include/yaml-cpp/depthguard.h
|
||||
--- yaml-cpp-yaml-cpp-0.6.3-old/include/yaml-cpp/depthguard.h 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ yaml-cpp-yaml-cpp-0.6.3/include/yaml-cpp/depthguard.h 2020-01-10 03:20:38.801606850 -0500
|
||||
@@ -0,0 +1,74 @@
|
||||
+#ifndef DEPTH_GUARD_H_00000000000000000000000000000000000000000000000000000000
|
||||
+#define DEPTH_GUARD_H_00000000000000000000000000000000000000000000000000000000
|
||||
+
|
||||
+#if defined(_MSC_VER) || \
|
||||
+ (defined(__GNUC__) && (__GNUC__ == 3 && __GNUC_MINOR__ >= 4) || \
|
||||
+ (__GNUC__ >= 4)) // GCC supports "pragma once" correctly since 3.4
|
||||
+#pragma once
|
||||
+#endif
|
||||
+
|
||||
+#include "exceptions.h"
|
||||
+
|
||||
+namespace YAML {
|
||||
+
|
||||
+/**
|
||||
+ * @brief The DeepRecursion class
|
||||
+ * An exception class which is thrown by DepthGuard. Ideally it should be
|
||||
+ * a member of DepthGuard. However, DepthGuard is a templated class which means
|
||||
+ * that any catch points would then need to know the template parameters. It is
|
||||
+ * simpler for clients to not have to know at the catch point what was the
|
||||
+ * maximum depth.
|
||||
+ */
|
||||
+class DeepRecursion : public ParserException {
|
||||
+ int m_atDepth = 0;
|
||||
+public:
|
||||
+ // no custom dtor needed, but virtual dtor necessary to prevent slicing
|
||||
+ virtual ~DeepRecursion() = default;
|
||||
+
|
||||
+ // construct an exception explaining how deep you were
|
||||
+ DeepRecursion(int at_depth, const Mark& mark_, const std::string& msg_);
|
||||
+
|
||||
+ // query how deep you were when the exception was thrown
|
||||
+ int AtDepth() const;
|
||||
+};
|
||||
+
|
||||
+/**
|
||||
+ * @brief The DepthGuard class
|
||||
+ * DepthGuard takes a reference to an integer. It increments the integer upon
|
||||
+ * construction of DepthGuard and decrements the integer upon destruction.
|
||||
+ *
|
||||
+ * If the integer would be incremented past max_depth, then an exception is
|
||||
+ * thrown. This is ideally geared toward guarding against deep recursion.
|
||||
+ *
|
||||
+ * @param max_depth
|
||||
+ * compile-time configurable maximum depth.
|
||||
+ */
|
||||
+template <int max_depth = 2000>
|
||||
+class DepthGuard final /* final because non-virtual dtor */ {
|
||||
+ int & m_depth;
|
||||
+public:
|
||||
+ DepthGuard(int & depth_, const Mark& mark_, const std::string& msg_) : m_depth(depth_) {
|
||||
+ ++m_depth;
|
||||
+ if ( max_depth <= m_depth ) {
|
||||
+ throw DeepRecursion{m_depth, mark_, msg_};
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ // DepthGuard is neither copyable nor moveable.
|
||||
+ DepthGuard(const DepthGuard & copy_ctor) = delete;
|
||||
+ DepthGuard(DepthGuard && move_ctor) = delete;
|
||||
+ DepthGuard & operator=(const DepthGuard & copy_assign) = delete;
|
||||
+ DepthGuard & operator=(DepthGuard && move_assign) = delete;
|
||||
+
|
||||
+ ~DepthGuard() {
|
||||
+ --m_depth;
|
||||
+ }
|
||||
+
|
||||
+ int current_depth() const {
|
||||
+ return m_depth;
|
||||
+ }
|
||||
+};
|
||||
+
|
||||
+} // namespace YAML
|
||||
+
|
||||
+#endif // DEPTH_GUARD_H_00000000000000000000000000000000000000000000000000000000
|
||||
diff -Nur yaml-cpp-yaml-cpp-0.6.3-old/src/depthguard.cpp yaml-cpp-yaml-cpp-0.6.3/src/depthguard.cpp
|
||||
--- yaml-cpp-yaml-cpp-0.6.3-old/src/depthguard.cpp 1969-12-31 19:00:00.000000000 -0500
|
||||
+++ yaml-cpp-yaml-cpp-0.6.3/src/depthguard.cpp 2020-01-10 03:19:10.577606850 -0500
|
||||
@@ -0,0 +1,14 @@
|
||||
+#include "yaml-cpp/depthguard.h"
|
||||
+
|
||||
+namespace YAML {
|
||||
+
|
||||
+DeepRecursion::DeepRecursion(int at_depth, const Mark& mark_, const std::string& msg_)
|
||||
+ : ParserException(mark_, msg_),
|
||||
+ m_atDepth(at_depth) {
|
||||
+}
|
||||
+
|
||||
+int DeepRecursion::AtDepth() const {
|
||||
+ return m_atDepth;
|
||||
+}
|
||||
+
|
||||
+} // namespace YAML
|
||||
diff -Nur yaml-cpp-yaml-cpp-0.6.3-old/src/singledocparser.cpp yaml-cpp-yaml-cpp-0.6.3/src/singledocparser.cpp
|
||||
--- yaml-cpp-yaml-cpp-0.6.3-old/src/singledocparser.cpp 2020-01-10 01:52:03.261606850 -0500
|
||||
+++ yaml-cpp-yaml-cpp-0.6.3/src/singledocparser.cpp 2020-01-10 03:17:46.937606850 -0500
|
||||
@@ -7,6 +7,7 @@
|
||||
#include "singledocparser.h"
|
||||
#include "tag.h"
|
||||
#include "token.h"
|
||||
+#include "yaml-cpp/depthguard.h"
|
||||
#include "yaml-cpp/emitterstyle.h"
|
||||
#include "yaml-cpp/eventhandler.h"
|
||||
#include "yaml-cpp/exceptions.h" // IWYU pragma: keep
|
||||
@@ -47,6 +48,7 @@
|
||||
}
|
||||
|
||||
void SingleDocParser::HandleNode(EventHandler& eventHandler) {
|
||||
+ DepthGuard depthguard(depth, m_scanner.mark(), ErrorMsg::BAD_FILE);
|
||||
// an empty node *is* a possibility
|
||||
if (m_scanner.empty()) {
|
||||
eventHandler.OnNull(m_scanner.mark(), NullAnchor);
|
||||
diff -Nur yaml-cpp-yaml-cpp-0.6.3-old/src/singledocparser.h yaml-cpp-yaml-cpp-0.6.3/src/singledocparser.h
|
||||
--- yaml-cpp-yaml-cpp-0.6.3-old/src/singledocparser.h 2020-01-10 01:52:03.265606850 -0500
|
||||
+++ yaml-cpp-yaml-cpp-0.6.3/src/singledocparser.h 2020-01-10 03:24:37.617606850 -0500
|
||||
@@ -15,6 +15,8 @@
|
||||
|
||||
namespace YAML {
|
||||
class CollectionStack;
|
||||
+template <int> class DepthGuard; // depthguard.h
|
||||
+class DeepRecursion; // an exception which may be thrown from excessive call stack recursion, see depthguard.h
|
||||
class EventHandler;
|
||||
class Node;
|
||||
class Scanner;
|
||||
@@ -55,6 +57,8 @@
|
||||
anchor_t LookupAnchor(const Mark& mark, const std::string& name) const;
|
||||
|
||||
private:
|
||||
+ using DepthGuard = YAML::DepthGuard<2000>;
|
||||
+ int depth = 0;
|
||||
Scanner& m_scanner;
|
||||
const Directives& m_directives;
|
||||
std::unique_ptr<CollectionStack> m_pCollectionStack;
|
||||
BIN
yaml-cpp-0.6.3.tar.gz
Executable file
BIN
yaml-cpp-0.6.3.tar.gz
Executable file
Binary file not shown.
72
yaml-cpp.spec
Executable file
72
yaml-cpp.spec
Executable file
@ -0,0 +1,72 @@
|
||||
Name: yaml-cpp
|
||||
Version: 0.6.3
|
||||
Release: 1
|
||||
Summary: A YAML parser and emitter in C++.
|
||||
License: MIT
|
||||
URL: https://github.com/jbeder/yaml-cpp
|
||||
Source0: https://github.com/jbeder/yaml-cpp/archive/%{name}-%{version}.tar.gz
|
||||
Patch2: CVE-2017-5950.patch
|
||||
BuildRequires: cmake gcc gcc-c++
|
||||
|
||||
%description
|
||||
yaml-cpp is a YAML parser and emitter in C++ matching the YAML 1.2 spec.
|
||||
|
||||
%package devel
|
||||
Summary: Development files for yaml-cpp
|
||||
Requires: yaml-cpp = %{version}-%{release} boost-devel pkgconfig
|
||||
Provides: yaml-cpp-static = %{version}-%{release}
|
||||
Obsoletes: yaml-cpp-static < %{version}-%{release}
|
||||
|
||||
%description devel
|
||||
This package contains libraries and header files for developing applications that use yaml-cpp.
|
||||
|
||||
%prep
|
||||
%autosetup -n %{name}-%{name}-%{version} -p1
|
||||
|
||||
%build
|
||||
rm -rf build_*
|
||||
mkdir build_dynamic_lib
|
||||
mkdir build_static_lib
|
||||
cd build_dynamic_lib
|
||||
%cmake -DYAML_BUILD_SHARED_LIBS=ON -DYAML_CPP_BUILD_TESTS=OFF -DYAML_CPP_BUILD_TOOLS=OFF ../
|
||||
%make_build
|
||||
|
||||
cd ../build_static_lib
|
||||
%cmake -DYAML_BUILD_SHARED_LIBS=OFF -DYAML_CPP_BUILD_TESTS=OFF -DYAML_CPP_BUILD_TOOLS=OFF ../
|
||||
%make_build
|
||||
cd -
|
||||
|
||||
%install
|
||||
cd build_dynamic_lib
|
||||
%make_install
|
||||
mv %{buildroot}%{_libdir}/cmake/yaml-cpp %{buildroot}%{_libdir}/cmake/yaml-cpp-dynamic
|
||||
mv %{buildroot}%{_libdir}/pkgconfig/yaml-cpp.pc %{buildroot}%{_libdir}/pkgconfig/yaml-cpp-dynamic.pc
|
||||
|
||||
cd ../build_static_lib
|
||||
%make_install
|
||||
mv %{buildroot}%{_libdir}/cmake/yaml-cpp %{buildroot}%{_libdir}/cmake/yaml-cpp-static
|
||||
mv %{buildroot}%{_libdir}/pkgconfig/yaml-cpp.pc %{buildroot}%{_libdir}/pkgconfig/yaml-cpp-static.pc
|
||||
cd -
|
||||
|
||||
%post
|
||||
/sbin/ldconfig
|
||||
|
||||
%postun
|
||||
/sbin/ldconfig
|
||||
|
||||
%files
|
||||
%license LICENSE
|
||||
%doc README.md
|
||||
%{_libdir}/*.so.*
|
||||
|
||||
%files devel
|
||||
%{_libdir}/*.so
|
||||
%{_libdir}/*.a
|
||||
%{_includedir}/yaml-cpp/
|
||||
%{_libdir}/cmake/
|
||||
%{_libdir}/pkgconfig/
|
||||
|
||||
|
||||
%changelog
|
||||
* Mon Jan 6 2020 Senlin Xia<xiasenlin1@huawei.com> - 0.6.3-1
|
||||
- Package init
|
||||
Loading…
x
Reference in New Issue
Block a user