Re: libyaml / YAML-LibYAML DoS

[John Haxby <john.haxby () oracle com>]

On 28/11/14 05:57, Jonathan Gray wrote:
> libyaml and the perl YAML-LibYAML (aka YAML-XS) module based
> on the same code have an "impossible" assert that can be
> triggered with the following yaml.  This is a reduced testcase
> of a crash found with the afl fuzzer.
>
>       a: " 
> "     b: true
>
> In other words a crash/denial of service with untrusted yaml input.
> The libyaml author was contacted on the 21st and 27th of November.
> No response has been received but the issue has independently been
> reported publically since:
> https://bitbucket.org/xi/libyaml/issue/10/wrapped-strings-cause-assert-failure
>
> [1] Parsing 'test.yaml': assertion "parser->simple_key_allowed || !required" failed: file "scanner.c", line 1113, 
> function "yaml_parser_save_simple_key"
>
> assert(parser->simple_key_allowed || !required);    /* Impossible. */

For what it's worth PyYAML 3.10 and 3.11 have exactly the same assertion:

> > > import yaml
> > > yaml.load("""
... abc:
...     def: 'xxx
... '   ghi: 'yyy'
... """)
Traceback (most recent call last):

[...]

    assert self.allow_simple_key or not required
AssertionError

jch