Re: libyaml / YAML-LibYAML DoS

[Ingy dot Net <ingy () ingy net>]

I have fixed this by commenting out the assert. This makes the parser fail
as it should.

I've pushed the patch to the git-hub mirror of libyaml:
https://github.com/yaml/libyaml

I've added a test to https://metacpan.org/release/YAML-LibYAML and released
version 0.53.

Ingy

PS Here is the Perl minimum test case, with the patched behavior:

 $ perl -MYAML::XS -e 'Load qq! x: "\n"x!'
YAML::XS::Load Error: The problem:

    did not find expected key

was found at document: 1, line: 2, column: 2
while parsing a block mapping at line: 1, column: 2


On Fri, Nov 28, 2014 at 7:45 AM, Ingy dot Net <ingy () ingy net> wrote:

> Taking a look at this now. Please let me know if you've already found a
> patch.
>
> Ingy
>
> On Fri, Nov 28, 2014 at 2:20 AM, John Haxby <john.haxby () oracle com> wrote:
>
> > On 28/11/14 05:57, Jonathan Gray wrote:
> > > libyaml and the perl YAML-LibYAML (aka YAML-XS) module based
> > > on the same code have an "impossible" assert that can be
> > > triggered with the following yaml.  This is a reduced testcase
> > > of a crash found with the afl fuzzer.
> > >
> > >       a: "
> > > "     b: true
> > >
> > > In other words a crash/denial of service with untrusted yaml input.
> > > The libyaml author was contacted on the 21st and 27th of November.
> > > No response has been received but the issue has independently been
> > > reported publically since:
> > https://bitbucket.org/xi/libyaml/issue/10/wrapped-strings-cause-assert-failure
> > > [1] Parsing 'test.yaml': assertion "parser->simple_key_allowed ||
> > !required" failed: file "scanner.c", line 1113, function
> > "yaml_parser_save_simple_key"
> > > assert(parser->simple_key_allowed || !required);    /* Impossible. */
> >
> > For what it's worth PyYAML 3.10 and 3.11 have exactly the same assertion:
> >
> > > > > import yaml
> > > > > yaml.load("""
> > ... abc:
> > ...     def: 'xxx
> > ... '   ghi: 'yyy'
> > ... """)
> > Traceback (most recent call last):
> >
> > [...]
> >
> >     assert self.allow_simple_key or not required
> > AssertionError
> >
> > jch