Re: libyaml / YAML-LibYAML DoS

[Ingy dot Net <ingy () ingy net>]

Taking a look at this now. Please let me know if you've already found a
patch.

Ingy

On Fri, Nov 28, 2014 at 2:20 AM, John Haxby <john.haxby () oracle com> wrote:

> On 28/11/14 05:57, Jonathan Gray wrote:
> > libyaml and the perl YAML-LibYAML (aka YAML-XS) module based
> > on the same code have an "impossible" assert that can be
> > triggered with the following yaml.  This is a reduced testcase
> > of a crash found with the afl fuzzer.
> >
> >       a: "
> > "     b: true
> >
> > In other words a crash/denial of service with untrusted yaml input.
> > The libyaml author was contacted on the 21st and 27th of November.
> > No response has been received but the issue has independently been
> > reported publically since:
> https://bitbucket.org/xi/libyaml/issue/10/wrapped-strings-cause-assert-failure
> > [1] Parsing 'test.yaml': assertion "parser->simple_key_allowed ||
> !required" failed: file "scanner.c", line 1113, function
> "yaml_parser_save_simple_key"
> > assert(parser->simple_key_allowed || !required);    /* Impossible. */
>
> For what it's worth PyYAML 3.10 and 3.11 have exactly the same assertion:
>
> > > > import yaml
> > > > yaml.load("""
> ... abc:
> ...     def: 'xxx
> ... '   ghi: 'yyy'
> ... """)
> Traceback (most recent call last):
>
> [...]
>
>     assert self.allow_simple_key or not required
> AssertionError
>
> jch