From 1dcdd256f7c41b3e8528c8ca520623bdf26e1817 Mon Sep 17 00:00:00 2001 From: nagachika Date: Sun, 4 May 2014 15:45:33 +0000 Subject: merge revision(s) r45453,r45455,r45577: [Backport #9798] * ext/psych/lib/psych.rb: Merge psych-2.0.5. bump version to libyaml-0.1.6 for CVE-2014-2525. * ext/psych/yaml/config.h: ditto. * ext/psych/yaml/scanner.c: ditto. * ext/psych/yaml/yaml_private.h: ditto. * ext/psych/psych.gemspec: update gemspec for psych-2.0.5 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_1@45812 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- ChangeLog | 12 ++++++++++++ ext/psych/lib/psych.rb | 4 ++-- ext/psych/psych.gemspec | 6 +++--- ext/psych/yaml/config.h | 9 ++++----- ext/psych/yaml/scanner.c | 3 +++ ext/psych/yaml/yaml_private.h | 7 +++++-- version.h | 2 +- 7 files changed, 30 insertions(+), 13 deletions(-) diff --git a/ChangeLog b/ChangeLog index fc0d3674b5..3599ce7b6f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,15 @@ +Mon May 5 00:42:35 2014 SHIBATA Hiroshi + + * ext/psych/psych.gemspec: update gemspec for psych-2.0.5 + +Mon May 5 00:42:35 2014 SHIBATA Hiroshi + + * ext/psych/lib/psych.rb: Merge psych-2.0.5. bump version to + libyaml-0.1.6 for CVE-2014-2525. + * ext/psych/yaml/config.h: ditto. + * ext/psych/yaml/scanner.c: ditto. + * ext/psych/yaml/yaml_private.h: ditto. + Mon May 5 00:35:20 2014 Aaron Patterson * ext/psych/lib/psych/visitors/yaml_tree.rb: support dumping Encoding diff --git a/ext/psych/lib/psych.rb b/ext/psych/lib/psych.rb index 55d68dcd51..329514a930 100644 --- a/ext/psych/lib/psych.rb +++ b/ext/psych/lib/psych.rb @@ -21,7 +21,7 @@ require 'psych/class_loader' # # Psych is a YAML parser and emitter. # Psych leverages libyaml [Home page: http://pyyaml.org/wiki/LibYAML] -# or [Git repo: https://github.com/zerotao/libyaml] for its YAML parsing +# or [HG repo: https://bitbucket.org/xi/libyaml] for its YAML parsing # and emitting capabilities. In addition to wrapping libyaml, Psych also # knows how to serialize and de-serialize most Ruby objects to and from # the YAML format. @@ -217,7 +217,7 @@ require 'psych/class_loader' module Psych # The version is Psych you're using - VERSION = '2.0.4' + VERSION = '2.0.5' # The version of libyaml Psych is using LIBYAML_VERSION = Psych.libyaml_version.join '.' diff --git a/ext/psych/psych.gemspec b/ext/psych/psych.gemspec index 100b6ff737..6d53aef122 100644 --- a/ext/psych/psych.gemspec +++ b/ext/psych/psych.gemspec @@ -2,12 +2,12 @@ Gem::Specification.new do |s| s.name = "psych" - s.version = "2.0.3" + s.version = "2.0.5" s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version= s.require_paths = ["lib"] s.authors = ["Aaron Patterson"] - s.date = "2014-02-04" + s.date = "2014-03-27" s.description = "Psych is a YAML parser and emitter. Psych leverages libyaml[http://pyyaml.org/wiki/LibYAML]\nfor its YAML parsing and emitting capabilities. In addition to wrapping\nlibyaml, Psych also knows how to serialize and de-serialize most Ruby objects\nto and from the YAML format." s.email = ["aaron@tenderlovemaking.com"] s.extensions = ["ext/psych/extconf.rb"] @@ -17,7 +17,7 @@ Gem::Specification.new do |s| s.rdoc_options = ["--main", "README.rdoc"] s.required_ruby_version = Gem::Requirement.new(">= 1.9.2") s.rubyforge_project = "psych" - s.rubygems_version = "2.2.1" + s.rubygems_version = "2.2.2" s.summary = "Psych is a YAML parser and emitter" s.test_files = ["test/psych/handlers/test_recorder.rb", "test/psych/json/test_stream.rb", "test/psych/nodes/test_enumerable.rb", "test/psych/test_alias_and_anchor.rb", "test/psych/test_array.rb", "test/psych/test_boolean.rb", "test/psych/test_class.rb", "test/psych/test_coder.rb", "test/psych/test_date_time.rb", "test/psych/test_deprecated.rb", "test/psych/test_document.rb", "test/psych/test_emitter.rb", "test/psych/test_encoding.rb", "test/psych/test_engine_manager.rb", "test/psych/test_exception.rb", "test/psych/test_hash.rb", "test/psych/test_json_tree.rb", "test/psych/test_merge_keys.rb", "test/psych/test_nil.rb", "test/psych/test_null.rb", "test/psych/test_numeric.rb", "test/psych/test_object.rb", "test/psych/test_object_references.rb", "test/psych/test_omap.rb", "test/psych/test_parser.rb", "test/psych/test_psych.rb", "test/psych/test_safe_load.rb", "test/psych/test_scalar.rb", "test/psych/test_scalar_scanner.rb", "test/psych/test_serialize_subclasses.rb", "test/psych/test_set.rb", "test/psych/test_stream.rb", "test/psych/test_string.rb", "test/psych/test_struct.rb", "test/psych/test_symbol.rb", "test/psych/test_tainted.rb", "test/psych/test_to_yaml_properties.rb", "test/psych/test_tree_builder.rb", "test/psych/test_yaml.rb", "test/psych/test_yamldbm.rb", "test/psych/test_yamlstore.rb", "test/psych/visitors/test_depth_first.rb", "test/psych/visitors/test_emitter.rb", "test/psych/visitors/test_to_ruby.rb", "test/psych/visitors/test_yaml_tree.rb"] end diff --git a/ext/psych/yaml/config.h b/ext/psych/yaml/config.h index fb62651340..f54c27d339 100644 --- a/ext/psych/yaml/config.h +++ b/ext/psych/yaml/config.h @@ -1,11 +1,10 @@ - #define PACKAGE_NAME "yaml" #define PACKAGE_TARNAME "yaml" -#define PACKAGE_VERSION "0.1.5" -#define PACKAGE_STRING "yaml 0.1.5" +#define PACKAGE_VERSION "0.1.6" +#define PACKAGE_STRING "yaml 0.1.6" #define PACKAGE_BUGREPORT "http://pyyaml.org/newticket?component libyaml" #define PACKAGE_URL "" #define YAML_VERSION_MAJOR 0 #define YAML_VERSION_MINOR 1 -#define YAML_VERSION_PATCH 5 -#define YAML_VERSION_STRING "0.1.5" +#define YAML_VERSION_PATCH 6 +#define YAML_VERSION_STRING "0.1.6" diff --git a/ext/psych/yaml/scanner.c b/ext/psych/yaml/scanner.c index 34308d5d45..af05766f5c 100644 --- a/ext/psych/yaml/scanner.c +++ b/ext/psych/yaml/scanner.c @@ -2629,6 +2629,9 @@ yaml_parser_scan_tag_uri(yaml_parser_t *parser, int directive, /* Check if it is a URI-escape sequence. */ if (CHECK(parser->buffer, '%')) { + if (!STRING_EXTEND(parser, string)) + goto error; + if (!yaml_parser_scan_uri_escapes(parser, directive, start_mark, &string)) goto error; } diff --git a/ext/psych/yaml/yaml_private.h b/ext/psych/yaml/yaml_private.h index cd3d3a56c4..944499c94e 100644 --- a/ext/psych/yaml/yaml_private.h +++ b/ext/psych/yaml/yaml_private.h @@ -146,9 +146,12 @@ yaml_string_join( (string).start = (string).pointer = (string).end = 0) #define STRING_EXTEND(context,string) \ - (((string).pointer+5 < (string).end) \ + ((((string).pointer+5 < (string).end) \ || yaml_string_extend(&(string).start, \ - &(string).pointer, &(string).end)) + &(string).pointer, &(string).end)) ? \ + 1 : \ + ((context)->error = YAML_MEMORY_ERROR, \ + 0)) #define CLEAR(context,string) \ ((string).pointer = (string).start, \ diff --git a/version.h b/version.h index dcb7935f15..1506ab1693 100644 --- a/version.h +++ b/version.h @@ -1,6 +1,6 @@ #define RUBY_VERSION "2.1.2" #define RUBY_RELEASE_DATE "2014-05-05" -#define RUBY_PATCHLEVEL 85 +#define RUBY_PATCHLEVEL 86 #define RUBY_RELEASE_YEAR 2014 #define RUBY_RELEASE_MONTH 5 -- cgit v1.2.3