CVS commit: [pkgsrc-2018Q1] pkgsrc/devel/jq

["S.P.Zeidler" <spz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   spz
Date:           Sun Jun 17 12:43:56 UTC 2018

Modified Files:
        pkgsrc/devel/jq [pkgsrc-2018Q1]: Makefile distinfo
Added Files:
        pkgsrc/devel/jq/patches [pkgsrc-2018Q1]: patch-src_jv__print.c

Log Message:
Pullup ticket #5766 - requested by bsiegert
devel/jq: security patch

Revisions pulled up:
- devel/jq/Makefile                                             1.15
- devel/jq/distinfo                                             1.9
- devel/jq/patches/patch-src_jv__print.c                        1.1

-------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   ginsbach
   Date:           Wed May 30 16:03:48 UTC 2018

   Modified Files:
           pkgsrc/devel/jq: Makefile distinfo
   Added Files:
           pkgsrc/devel/jq/patches: patch-src_jv__print.c

   Log Message:
   CVE-2016-4074 denial-of-service (via upstream)

   Fix present in jq-1.6rc1 (https://github.com/stedolan/jq/commit/83e2cf6).
   The fix prevents 'infinite' recursion preventing stack exhaustion.

   To generate a diff of this commit:
   cvs rdiff -u -r1.14 -r1.15 pkgsrc/devel/jq/Makefile
   cvs rdiff -u -r1.8 -r1.9 pkgsrc/devel/jq/distinfo
   cvs rdiff -u -r0 -r1.1 pkgsrc/devel/jq/patches/patch-src_jv__print.c


To generate a diff of this commit:
cvs rdiff -u -r1.14 -r1.14.2.1 pkgsrc/devel/jq/Makefile
cvs rdiff -u -r1.8 -r1.8.2.1 pkgsrc/devel/jq/distinfo
cvs rdiff -u -r0 -r1.1.2.2 pkgsrc/devel/jq/patches/patch-src_jv__print.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/jq/Makefile
diff -u pkgsrc/devel/jq/Makefile:1.14 pkgsrc/devel/jq/Makefile:1.14.2.1
--- pkgsrc/devel/jq/Makefile:1.14       Thu Mar 22 08:14:52 2018
+++ pkgsrc/devel/jq/Makefile    Sun Jun 17 12:43:56 2018
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.14 2018/03/22 08:14:52 adam Exp $
+# $NetBSD: Makefile,v 1.14.2.1 2018/06/17 12:43:56 spz Exp $
 
 DISTNAME=      jq-1.5
-PKGREVISION=   3
+PKGREVISION=   4
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=stedolan/}
 

Index: pkgsrc/devel/jq/distinfo
diff -u pkgsrc/devel/jq/distinfo:1.8 pkgsrc/devel/jq/distinfo:1.8.2.1
--- pkgsrc/devel/jq/distinfo:1.8        Mon Jan 15 08:51:55 2018
+++ pkgsrc/devel/jq/distinfo    Sun Jun 17 12:43:56 2018
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.8 2018/01/15 08:51:55 adam Exp $
+$NetBSD: distinfo,v 1.8.2.1 2018/06/17 12:43:56 spz Exp $
 
 SHA1 (jq-1.5.tar.gz) = 664638b560d9e734178e8cafb21d98817af5b5f3
 RMD160 (jq-1.5.tar.gz) = 33ac77ac93e0539f6d66d29cd717013cdab8cf61
@@ -6,3 +6,4 @@ SHA512 (jq-1.5.tar.gz) = 3f9049321e8430b
 Size (jq-1.5.tar.gz) = 1118086 bytes
 SHA1 (patch-Makefile.in) = 446be0fa3517fb6fc1e2f5761d1f8fb28339c79c
 SHA1 (patch-src_jv__parse.c) = efca86e70daf27291a01bf538487b745b7bd600c
+SHA1 (patch-src_jv__print.c) = 4d53dc1a1f0bb1cc827dd1adb62ecef2b7393970

Added files:

Index: pkgsrc/devel/jq/patches/patch-src_jv__print.c
diff -u /dev/null pkgsrc/devel/jq/patches/patch-src_jv__print.c:1.1.2.2
--- /dev/null   Sun Jun 17 12:43:56 2018
+++ pkgsrc/devel/jq/patches/patch-src_jv__print.c       Sun Jun 17 12:43:56 2018
@@ -0,0 +1,41 @@
+$NetBSD: patch-src_jv__print.c,v 1.1.2.2 2018/06/17 12:43:56 spz Exp $
+
+CVE-2016-4074
+
+From 83e2cf607f3599d208b6b3129092fa7deb2e5292 Mon Sep 17 00:00:00 2001
+From: W-Mark Kubacki <wmark%hurrikane.de@localhost>
+Date: Fri, 19 Aug 2016 19:50:39 +0200
+Subject: [PATCH] Skip printing what's below a MAX_PRINT_DEPTH
+
+This addresses #1136, and mitigates a stack exhaustion when printing
+a very deeply nested term.
+---
+ src/jv_print.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/src/jv_print.c b/src/jv_print.c
+index 5f4f234b..ce4a59af 100644
+--- jv_print.c
++++ jv_print.c
+@@ -13,6 +13,10 @@
+ #include "jv_dtoa.h"
+ #include "jv_unicode.h"
+ 
++#ifndef MAX_PRINT_DEPTH
++#define MAX_PRINT_DEPTH (256)
++#endif
++
+ #define ESC "\033"
+ #define COL(c) (ESC "[" c "m")
+ #define COLRESET (ESC "[0m")
+@@ -150,7 +154,9 @@ static void jv_dump_term(struct dtoa_context* C, jv x, int flags, int indent, FI
+       }
+     }
+   }
+-  switch (jv_get_kind(x)) {
++  if (indent > MAX_PRINT_DEPTH) {
++    put_str("<skipped: too deep>", F, S, flags & JV_PRINT_ISATTY);
++  } else switch (jv_get_kind(x)) {
+   default:
+   case JV_KIND_INVALID:
+     if (flags & JV_PRINT_INVALID) {