Switch to new package format

2026-06-13 20:01:58 +03:00
parent e9db58fd57
commit 4d60888883
8 changed files with 302 additions and 47 deletions
@@ -0,0 +1,19 @@
+name: yajl
+description: A fast streaming JSON parsing library in C
+version: 2.1.0
+revision: 2
+url: https://github.com/lloyd/yajl
+license: ISC
+maintainers:
+  - [email protected]
+architecture: any
+type: source
+depends:
+  - glibc
+make_depends:
+  - cmake
+downloads:
+  - url: https://github.com/lloyd/yajl/archive/refs/tags/${BPM_PKG_VERSION}.tar.gz
+    extract_to: ${BPM_SOURCE}
+    extract_strip_components: 1
+    checksum: 3fb73364a5a30efe615046d07e6db9d09fd2b41c763c5f7d3bfb121cd5c5ac5a
@@ -1,7 +0,0 @@
-name: yajl
-description: A fast streaming JSON parsing library in C
-version: 2.1.0
-url: https://github.com/lloyd/yajl
-license: ISC
-architecture: any
-type: source
@@ -0,0 +1,43 @@
+# This is the recipe.sh script. It is executed by BPM in a temporary directory when compiling a source package
+# BPM Expects the source code to be extracted into the automatically created 'source' directory which can be accessed using $BPM_SOURCE
+# BPM Expects the output files to be present in the automatically created 'output' directory which can be accessed using $BPM_OUTPUT
+
+# The prepare function is executed in the root of the temp directory
+# This function is used for putting downloaded files to the correct location or applying patches
+prepare() {
+  cd "$BPM_SOURCE"
+  # Fix CVEs
+  patch -Np1 -i "$BPM_WORKDIR"/yajl-2.1.0-CVE-2017-16516.patch
+  patch -Np1 -i "$BPM_WORKDIR"/yajl-2.1.0-CVE-2022-24795.patch
+  # Fix memory leak
+  patch -Np1 -i "$BPM_WORKDIR"/yajl-2.1.0-memory_leak.patch
+  # Allow building with cmake 4.0
+  patch -Np1 -i "$BPM_WORKDIR"/yajl-0009-Allow-cmake-4.0.patch
+}
+
+# The build function is executed in the source directory
+# This function is used to compile the source code
+build() {  
+  export CFLAGS="$CFLAGS -ffat-lto-objects"
+
+  cmake -B build \
+        -DCMAKE_BUILD_TYPE=None \
+        -DCMAKE_INSTALL_PREFIX=/usr \
+        -Wno-dev 
+  cmake --build build
+}
+
+# The check function is executed in the source directory
+# This function is used to run tests to verify the package has been compiled correctly
+check() {
+  ctest --test-dir build
+}
+
+# The package function is executed in the source directory
+# This function is used to move the compiled files into the output directory
+package() {
+  DESTDIR="$BPM_OUTPUT" cmake --install build
+
+  # Install package license
+  install -Dm644 "$BPM_SOURCE"/COPYING "$BPM_OUTPUT"/usr/share/licenses/yajl/COPYING
+}
@@ -0,0 +1,66 @@
+From 6fe59ca50dfd65bdb3d1c87a27245b2dd1a072f9 Mon Sep 17 00:00:00 2001
+From: Rudi Heitbaum <[email protected]>
+Date: Fri, 28 Mar 2025 09:31:40 +0000
+Subject: [PATCH] Allow build with CMake 4.0.0
+
+fixes deprecated cmake option and uses cmake 2.8.0 TARGET_FILE
+update cmake supported minimum versions to 2.8.0...3.10
+
+ref:
+- https://cmake.org/cmake/help/latest/policy/CMP0026.html
+
+CMake Error at .../CMakeLists.txt: (GET_TARGET_PROPERTY):
+  The LOCATION property may not be read from target "json_...".  Use the
+  target name directly with add_custom_command, or use the generator
+  expression $<TARGET_FILE>, as appropriate.
+
+Signed-off-by: Rudi Heitbaum <[email protected]>
+---
+ CMakeLists.txt             | 2 +-
+ reformatter/CMakeLists.txt | 4 +---
+ verify/CMakeLists.txt      | 4 +---
+ 3 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 471eee13..deba3a40 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -12,7 +12,7 @@
+ # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ 
+-CMAKE_MINIMUM_REQUIRED(VERSION 2.6)
+CMAKE_MINIMUM_REQUIRED(VERSION 2.8.0...3.10)
+ 
+ PROJECT(YetAnotherJSONParser C)
+ 
+diff --git a/reformatter/CMakeLists.txt b/reformatter/CMakeLists.txt
+index 52a9bee8..267d02e2 100644
+--- a/reformatter/CMakeLists.txt
+++ b/reformatter/CMakeLists.txt
+@@ -35,9 +35,7 @@ IF (NOT WIN32)
+ ENDIF (NOT WIN32)
+ 
+ # copy the binary into the output directory
+-GET_TARGET_PROPERTY(binPath json_reformat LOCATION)
+-
+ ADD_CUSTOM_COMMAND(TARGET json_reformat POST_BUILD
+-    COMMAND ${CMAKE_COMMAND} -E copy_if_different ${binPath} ${binDir})
+    COMMAND ${CMAKE_COMMAND} -E copy_if_different $<TARGET_FILE:json_reformat> ${binDir})
+ 
+ INSTALL(TARGETS json_reformat RUNTIME DESTINATION bin)
+diff --git a/verify/CMakeLists.txt b/verify/CMakeLists.txt
+index 967fca16..2f390082 100644
+--- a/verify/CMakeLists.txt
+++ b/verify/CMakeLists.txt
+@@ -29,9 +29,7 @@ ADD_EXECUTABLE(json_verify ${SRCS})
+ TARGET_LINK_LIBRARIES(json_verify yajl)
+ 
+ # copy in the binary
+-GET_TARGET_PROPERTY(binPath json_verify LOCATION)
+-
+ ADD_CUSTOM_COMMAND(TARGET json_verify POST_BUILD
+-    COMMAND ${CMAKE_COMMAND} -E copy_if_different ${binPath} ${binDir})
+    COMMAND ${CMAKE_COMMAND} -E copy_if_different $<TARGET_FILE:json_verify> ${binDir})
+ 
+ INSTALL(TARGETS json_verify RUNTIME DESTINATION bin)
@@ -0,0 +1,43 @@
+From 0b5e73c4321de0ba1d495fdc0967054b2a77931c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <[email protected]>
+Date: Mon, 10 Jul 2023 13:36:10 +0100
+Subject: [PATCH 5/8] Fix for CVE-2017-16516
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Description: Fix for CVE-2017-16516
+ Potential buffer overread: A JSON file can cause denial of service.
+Origin: https://github.com/brianmario/yajl-ruby/commit/a8ca8f476655adaa187eedc60bdc770fff3c51ce
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040036
+Bug: https://github.com/lloyd/yajl/issues/248
+
+Patch taken from Debian package source
+
+NB, Fedora code can't trigger the reported aborts since it passes the
+-DNDEBUG flag, but pulling the fix for robustness in case a future
+change enables the assert()s.
+
+Signed-off-by: Daniel P. Berrangé <[email protected]>
+---
+ src/yajl_encode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/yajl_encode.c b/src/yajl_encode.c
+index fd08258..0d97cc5 100644
+--- a/src/yajl_encode.c
+++ b/src/yajl_encode.c
+@@ -139,8 +139,8 @@ void yajl_string_decode(yajl_buf buf, const unsigned char * str,
+                     end+=3;
+                     /* check if this is a surrogate */
+                     if ((codepoint & 0xFC00) == 0xD800) {
+-                        end++;
+-                        if (str[end] == '\\' && str[end + 1] == 'u') {
+                        if (end + 2 < len && str[end + 1] == '\\' && str[end + 2] == 'u') {
+                            end++;
+                             unsigned int surrogate = 0;
+                             hexToDigit(&surrogate, str + end + 2);
+                             codepoint =
+-- 
+2.41.0
+
@@ -0,0 +1,60 @@
+From 17de4d15687aa30c49660dc4b792b1fb4d38b569 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <[email protected]>
+Date: Thu, 7 Apr 2022 17:29:54 +0200
+Subject: [PATCH 6/8] Fix CVE-2022-24795
+
+There was an integer overflow in yajl_buf_ensure_available() leading
+to allocating less memory than requested. Then data were written past
+the allocated heap buffer in yajl_buf_append(), the only caller of
+yajl_buf_ensure_available(). Another result of the overflow was an
+infinite loop without a return from yajl_buf_ensure_available().
+
+yajl-ruby project, which bundles yajl, fixed it
+<https://github.com/brianmario/yajl-ruby/pull/211> by checking for the
+integer overflow, fortifying buffer allocations, and report the
+failures to a caller. But then the caller yajl_buf_append() skips
+a memory write if yajl_buf_ensure_available() failed leading to a data
+corruption.
+
+A yajl fork mainter recommended calling memory allocation callbacks with
+the large memory request and let them to handle it. But that has the
+problem that it's not possible pass the overely large size to the
+callbacks.
+
+This patch catches the integer overflow and terminates the process
+with abort().
+
+https://github.com/lloyd/yajl/issues/239
+https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
+(cherry picked from commit 23cea2d7677e396efed78bbf1bf153961fab6bad
+ in https://github.com/ppisar/yajl)
+---
+ src/yajl_buf.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/src/yajl_buf.c b/src/yajl_buf.c
+index 1aeafde..55c11ad 100644
+--- a/src/yajl_buf.c
+++ b/src/yajl_buf.c
+@@ -45,7 +45,17 @@ void yajl_buf_ensure_available(yajl_buf buf, size_t want)
+ 
+     need = buf->len;
+ 
+-    while (want >= (need - buf->used)) need <<= 1;
+    if (((buf->used > want) ? buf->used : want) > (size_t)(buf->used + want)) {
+        /* We cannot allocate more memory than SIZE_MAX. */
+        abort();
+    }
+    while (want >= (need - buf->used)) {
+        if (need >= (size_t)((size_t)(-1)<<1)>>1) {
+            /* need would overflow. */
+            abort();
+        }
+        need <<= 1;
+    }
+ 
+     if (need != buf->len) {
+         buf->data = (unsigned char *) YA_REALLOC(buf->alloc, buf->data, need);
+-- 
+2.41.0
+
@@ -0,0 +1,71 @@
+From c4304a2c04a1b392eb1464a9da892a9e0dff7683 Mon Sep 17 00:00:00 2001
+From: wujing <[email protected]>
+Date: Thu, 14 Feb 2019 03:12:30 +0800
+Subject: [PATCH 7/8] yajl: fix memory leak problem
+
+reason: fix memory leak problem
+(cherry picked from commit 3d65cb0c6db4d433e5e42ee7d91d8a04e21337cf
+ in https://github.com/openEuler-BaseService)
+
+Fixes: https://github.com/lloyd/yajl/issues/250  (CVE-2023-33460)
+---
+ src/yajl_tree.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/yajl_tree.c b/src/yajl_tree.c
+index 3d357a3..4b3cf2b 100644
+--- a/src/yajl_tree.c
+++ b/src/yajl_tree.c
+@@ -143,7 +143,7 @@ static yajl_val context_pop(context_t *ctx)
+     ctx->stack = stack->next;
+ 
+     v = stack->value;
+-
+    free (stack->key);
+     free (stack);
+ 
+     return (v);
+@@ -444,6 +444,10 @@ yajl_val yajl_tree_parse (const char *input,
+              snprintf(error_buffer, error_buffer_size, "%s", internal_err_str);
+              YA_FREE(&(handle->alloc), internal_err_str);
+         }
+        while(ctx.stack != NULL) {
+             yajl_val v = context_pop(&ctx);
+             yajl_tree_free(v);
+        }
+         yajl_free (handle);
+         return NULL;
+     }
+-- 
+2.41.0
+
+From 9cb871049261eeda844b8943d15580763a0ac3d3 Mon Sep 17 00:00:00 2001
+From: "zhang.jiujiu" <[email protected]>
+Date: Tue, 7 Dec 2021 22:37:02 +0800
+Subject: [PATCH 8/8] fix memory leaks
+
+(cherry picked from commit 23a122eddaa28165a6c219000adcc31ff9a8a698
+ in https://github.com/openEuler-BaseService)
+
+Fixes: https://github.com/lloyd/yajl/issues/250  (CVE-2023-33460)
+---
+ src/yajl_tree.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/yajl_tree.c b/src/yajl_tree.c
+index 4b3cf2b..56c7012 100644
+--- a/src/yajl_tree.c
+++ b/src/yajl_tree.c
+@@ -449,6 +449,9 @@ yajl_val yajl_tree_parse (const char *input,
+              yajl_tree_free(v);
+         }
+         yajl_free (handle);
+	//If the requested memory is not released in time, it will cause memory leakage
+	if(ctx.root)
+	     yajl_tree_free(ctx.root);
+         return NULL;
+     }
+ 
+-- 
+2.41.0
+
@@ -1,40 +0,0 @@
-# This is the source.sh script. It is executed by BPM in a temporary directory when compiling a source package
-# BPM Expects the source code to be extracted into the automatically created 'source' directory which can be accessed using $BPM_SOURCE
-# BPM Expects the output files to be present in the automatically created 'output' directory which can be accessed using $BPM_OUTPUT
-
-DOWNLOAD="https://github.com/lloyd/yajl/archive/refs/tags/${BPM_PKG_VERSION}.tar.gz"
-FILENAME="${DOWNLOAD##*/}"
-
-# The prepare function is executed in the root of the temp directory
-# This function is used for downloading files and putting them into the correct location
-prepare() {
-  wget "$DOWNLOAD"
-  tar -xvf "$FILENAME" --strip-components=1 -C "$BPM_SOURCE"
-}
-
-# The build function is executed in the source directory
-# This function is used to compile the source code
-build() {
-  mkdir build
-  cd build
-  
-  export CFLAGS+=" -ffat-lto-objects"
-  cmake -DCMAKE_BUILD_TYPE=None -DCMAKE_INSTALL_PREFIX=/usr -Wno-dev ..
-  make
-}
-
-# The check function is executed in the source directory
-# This function is used to run tests to verify the package has been compiled correctly
-check() {
-  cd build
-  make test
-}
-
-# The package function is executed in the source directory
-# This function is used to move the compiled files into the output directory
-package() {
-  cd build
-  make DESTDIR="$BPM_OUTPUT" install
-  install -Dm644 ../COPYING "$BPM_OUTPUT"/usr/share/licenses/yajl/COPYING
-  install -Dm644 ../{ChangeLog,README,TODO} -t "$BPM_OUTPUT"/usr/share/doc/yajl/
-}