From 4d608888831481119c5a2900adc0db5a170e9e11 Mon Sep 17 00:00:00 2001 From: EnumDev Date: Sat, 13 Jun 2026 20:01:58 +0300 Subject: [PATCH] Switch to new package format --- info.yml | 19 ++++++ pkg.info | 7 -- recipe.sh | 43 ++++++++++++ source-files/yajl-0009-Allow-cmake-4.0.patch | 66 ++++++++++++++++++ source-files/yajl-2.1.0-CVE-2017-16516.patch | 43 ++++++++++++ source-files/yajl-2.1.0-CVE-2022-24795.patch | 60 +++++++++++++++++ source-files/yajl-2.1.0-memory_leak.patch | 71 ++++++++++++++++++++ source.sh | 40 ----------- 8 files changed, 302 insertions(+), 47 deletions(-) create mode 100644 info.yml delete mode 100644 pkg.info create mode 100644 recipe.sh create mode 100644 source-files/yajl-0009-Allow-cmake-4.0.patch create mode 100644 source-files/yajl-2.1.0-CVE-2017-16516.patch create mode 100644 source-files/yajl-2.1.0-CVE-2022-24795.patch create mode 100644 source-files/yajl-2.1.0-memory_leak.patch delete mode 100644 source.sh diff --git a/info.yml b/info.yml new file mode 100644 index 0000000..7725f6d --- /dev/null +++ b/info.yml @@ -0,0 +1,19 @@ +name: yajl +description: A fast streaming JSON parsing library in C +version: 2.1.0 +revision: 2 +url: https://github.com/lloyd/yajl +license: ISC +maintainers: + - enumdev@enumerated.dev +architecture: any +type: source +depends: + - glibc +make_depends: + - cmake +downloads: + - url: https://github.com/lloyd/yajl/archive/refs/tags/${BPM_PKG_VERSION}.tar.gz + extract_to: ${BPM_SOURCE} + extract_strip_components: 1 + checksum: 3fb73364a5a30efe615046d07e6db9d09fd2b41c763c5f7d3bfb121cd5c5ac5a diff --git a/pkg.info b/pkg.info deleted file mode 100644 index 89dcb06..0000000 --- a/pkg.info +++ /dev/null @@ -1,7 +0,0 @@ -name: yajl -description: A fast streaming JSON parsing library in C -version: 2.1.0 -url: https://github.com/lloyd/yajl -license: ISC -architecture: any -type: source diff --git a/recipe.sh b/recipe.sh new file mode 100644 index 0000000..0be601c --- /dev/null +++ b/recipe.sh @@ -0,0 +1,43 @@ +# This is the recipe.sh script. It is executed by BPM in a temporary directory when compiling a source package +# BPM Expects the source code to be extracted into the automatically created 'source' directory which can be accessed using $BPM_SOURCE +# BPM Expects the output files to be present in the automatically created 'output' directory which can be accessed using $BPM_OUTPUT + +# The prepare function is executed in the root of the temp directory +# This function is used for putting downloaded files to the correct location or applying patches +prepare() { + cd "$BPM_SOURCE" + # Fix CVEs + patch -Np1 -i "$BPM_WORKDIR"/yajl-2.1.0-CVE-2017-16516.patch + patch -Np1 -i "$BPM_WORKDIR"/yajl-2.1.0-CVE-2022-24795.patch + # Fix memory leak + patch -Np1 -i "$BPM_WORKDIR"/yajl-2.1.0-memory_leak.patch + # Allow building with cmake 4.0 + patch -Np1 -i "$BPM_WORKDIR"/yajl-0009-Allow-cmake-4.0.patch +} + +# The build function is executed in the source directory +# This function is used to compile the source code +build() { + export CFLAGS="$CFLAGS -ffat-lto-objects" + + cmake -B build \ + -DCMAKE_BUILD_TYPE=None \ + -DCMAKE_INSTALL_PREFIX=/usr \ + -Wno-dev + cmake --build build +} + +# The check function is executed in the source directory +# This function is used to run tests to verify the package has been compiled correctly +check() { + ctest --test-dir build +} + +# The package function is executed in the source directory +# This function is used to move the compiled files into the output directory +package() { + DESTDIR="$BPM_OUTPUT" cmake --install build + + # Install package license + install -Dm644 "$BPM_SOURCE"/COPYING "$BPM_OUTPUT"/usr/share/licenses/yajl/COPYING +} diff --git a/source-files/yajl-0009-Allow-cmake-4.0.patch b/source-files/yajl-0009-Allow-cmake-4.0.patch new file mode 100644 index 0000000..e447252 --- /dev/null +++ b/source-files/yajl-0009-Allow-cmake-4.0.patch @@ -0,0 +1,66 @@ +From 6fe59ca50dfd65bdb3d1c87a27245b2dd1a072f9 Mon Sep 17 00:00:00 2001 +From: Rudi Heitbaum +Date: Fri, 28 Mar 2025 09:31:40 +0000 +Subject: [PATCH] Allow build with CMake 4.0.0 + +fixes deprecated cmake option and uses cmake 2.8.0 TARGET_FILE +update cmake supported minimum versions to 2.8.0...3.10 + +ref: +- https://cmake.org/cmake/help/latest/policy/CMP0026.html + +CMake Error at .../CMakeLists.txt: (GET_TARGET_PROPERTY): + The LOCATION property may not be read from target "json_...". Use the + target name directly with add_custom_command, or use the generator + expression $, as appropriate. + +Signed-off-by: Rudi Heitbaum +--- + CMakeLists.txt | 2 +- + reformatter/CMakeLists.txt | 4 +--- + verify/CMakeLists.txt | 4 +--- + 3 files changed, 3 insertions(+), 7 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 471eee13..deba3a40 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -12,7 +12,7 @@ + # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + +-CMAKE_MINIMUM_REQUIRED(VERSION 2.6) ++CMAKE_MINIMUM_REQUIRED(VERSION 2.8.0...3.10) + + PROJECT(YetAnotherJSONParser C) + +diff --git a/reformatter/CMakeLists.txt b/reformatter/CMakeLists.txt +index 52a9bee8..267d02e2 100644 +--- a/reformatter/CMakeLists.txt ++++ b/reformatter/CMakeLists.txt +@@ -35,9 +35,7 @@ IF (NOT WIN32) + ENDIF (NOT WIN32) + + # copy the binary into the output directory +-GET_TARGET_PROPERTY(binPath json_reformat LOCATION) +- + ADD_CUSTOM_COMMAND(TARGET json_reformat POST_BUILD +- COMMAND ${CMAKE_COMMAND} -E copy_if_different ${binPath} ${binDir}) ++ COMMAND ${CMAKE_COMMAND} -E copy_if_different $ ${binDir}) + + INSTALL(TARGETS json_reformat RUNTIME DESTINATION bin) +diff --git a/verify/CMakeLists.txt b/verify/CMakeLists.txt +index 967fca16..2f390082 100644 +--- a/verify/CMakeLists.txt ++++ b/verify/CMakeLists.txt +@@ -29,9 +29,7 @@ ADD_EXECUTABLE(json_verify ${SRCS}) + TARGET_LINK_LIBRARIES(json_verify yajl) + + # copy in the binary +-GET_TARGET_PROPERTY(binPath json_verify LOCATION) +- + ADD_CUSTOM_COMMAND(TARGET json_verify POST_BUILD +- COMMAND ${CMAKE_COMMAND} -E copy_if_different ${binPath} ${binDir}) ++ COMMAND ${CMAKE_COMMAND} -E copy_if_different $ ${binDir}) + + INSTALL(TARGETS json_verify RUNTIME DESTINATION bin) diff --git a/source-files/yajl-2.1.0-CVE-2017-16516.patch b/source-files/yajl-2.1.0-CVE-2017-16516.patch new file mode 100644 index 0000000..7d48816 --- /dev/null +++ b/source-files/yajl-2.1.0-CVE-2017-16516.patch @@ -0,0 +1,43 @@ +From 0b5e73c4321de0ba1d495fdc0967054b2a77931c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Mon, 10 Jul 2023 13:36:10 +0100 +Subject: [PATCH 5/8] Fix for CVE-2017-16516 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Description: Fix for CVE-2017-16516 + Potential buffer overread: A JSON file can cause denial of service. +Origin: https://github.com/brianmario/yajl-ruby/commit/a8ca8f476655adaa187eedc60bdc770fff3c51ce +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040036 +Bug: https://github.com/lloyd/yajl/issues/248 + +Patch taken from Debian package source + +NB, Fedora code can't trigger the reported aborts since it passes the +-DNDEBUG flag, but pulling the fix for robustness in case a future +change enables the assert()s. + +Signed-off-by: Daniel P. Berrangé +--- + src/yajl_encode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/yajl_encode.c b/src/yajl_encode.c +index fd08258..0d97cc5 100644 +--- a/src/yajl_encode.c ++++ b/src/yajl_encode.c +@@ -139,8 +139,8 @@ void yajl_string_decode(yajl_buf buf, const unsigned char * str, + end+=3; + /* check if this is a surrogate */ + if ((codepoint & 0xFC00) == 0xD800) { +- end++; +- if (str[end] == '\\' && str[end + 1] == 'u') { ++ if (end + 2 < len && str[end + 1] == '\\' && str[end + 2] == 'u') { ++ end++; + unsigned int surrogate = 0; + hexToDigit(&surrogate, str + end + 2); + codepoint = +-- +2.41.0 + diff --git a/source-files/yajl-2.1.0-CVE-2022-24795.patch b/source-files/yajl-2.1.0-CVE-2022-24795.patch new file mode 100644 index 0000000..704e884 --- /dev/null +++ b/source-files/yajl-2.1.0-CVE-2022-24795.patch @@ -0,0 +1,60 @@ +From 17de4d15687aa30c49660dc4b792b1fb4d38b569 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= +Date: Thu, 7 Apr 2022 17:29:54 +0200 +Subject: [PATCH 6/8] Fix CVE-2022-24795 + +There was an integer overflow in yajl_buf_ensure_available() leading +to allocating less memory than requested. Then data were written past +the allocated heap buffer in yajl_buf_append(), the only caller of +yajl_buf_ensure_available(). Another result of the overflow was an +infinite loop without a return from yajl_buf_ensure_available(). + +yajl-ruby project, which bundles yajl, fixed it + by checking for the +integer overflow, fortifying buffer allocations, and report the +failures to a caller. But then the caller yajl_buf_append() skips +a memory write if yajl_buf_ensure_available() failed leading to a data +corruption. + +A yajl fork mainter recommended calling memory allocation callbacks with +the large memory request and let them to handle it. But that has the +problem that it's not possible pass the overely large size to the +callbacks. + +This patch catches the integer overflow and terminates the process +with abort(). + +https://github.com/lloyd/yajl/issues/239 +https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm +(cherry picked from commit 23cea2d7677e396efed78bbf1bf153961fab6bad + in https://github.com/ppisar/yajl) +--- + src/yajl_buf.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/src/yajl_buf.c b/src/yajl_buf.c +index 1aeafde..55c11ad 100644 +--- a/src/yajl_buf.c ++++ b/src/yajl_buf.c +@@ -45,7 +45,17 @@ void yajl_buf_ensure_available(yajl_buf buf, size_t want) + + need = buf->len; + +- while (want >= (need - buf->used)) need <<= 1; ++ if (((buf->used > want) ? buf->used : want) > (size_t)(buf->used + want)) { ++ /* We cannot allocate more memory than SIZE_MAX. */ ++ abort(); ++ } ++ while (want >= (need - buf->used)) { ++ if (need >= (size_t)((size_t)(-1)<<1)>>1) { ++ /* need would overflow. */ ++ abort(); ++ } ++ need <<= 1; ++ } + + if (need != buf->len) { + buf->data = (unsigned char *) YA_REALLOC(buf->alloc, buf->data, need); +-- +2.41.0 + diff --git a/source-files/yajl-2.1.0-memory_leak.patch b/source-files/yajl-2.1.0-memory_leak.patch new file mode 100644 index 0000000..aa0bd0e --- /dev/null +++ b/source-files/yajl-2.1.0-memory_leak.patch @@ -0,0 +1,71 @@ +From c4304a2c04a1b392eb1464a9da892a9e0dff7683 Mon Sep 17 00:00:00 2001 +From: wujing +Date: Thu, 14 Feb 2019 03:12:30 +0800 +Subject: [PATCH 7/8] yajl: fix memory leak problem + +reason: fix memory leak problem +(cherry picked from commit 3d65cb0c6db4d433e5e42ee7d91d8a04e21337cf + in https://github.com/openEuler-BaseService) + +Fixes: https://github.com/lloyd/yajl/issues/250 (CVE-2023-33460) +--- + src/yajl_tree.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/yajl_tree.c b/src/yajl_tree.c +index 3d357a3..4b3cf2b 100644 +--- a/src/yajl_tree.c ++++ b/src/yajl_tree.c +@@ -143,7 +143,7 @@ static yajl_val context_pop(context_t *ctx) + ctx->stack = stack->next; + + v = stack->value; +- ++ free (stack->key); + free (stack); + + return (v); +@@ -444,6 +444,10 @@ yajl_val yajl_tree_parse (const char *input, + snprintf(error_buffer, error_buffer_size, "%s", internal_err_str); + YA_FREE(&(handle->alloc), internal_err_str); + } ++ while(ctx.stack != NULL) { ++ yajl_val v = context_pop(&ctx); ++ yajl_tree_free(v); ++ } + yajl_free (handle); + return NULL; + } +-- +2.41.0 + +From 9cb871049261eeda844b8943d15580763a0ac3d3 Mon Sep 17 00:00:00 2001 +From: "zhang.jiujiu" <282627424@qq.com> +Date: Tue, 7 Dec 2021 22:37:02 +0800 +Subject: [PATCH 8/8] fix memory leaks + +(cherry picked from commit 23a122eddaa28165a6c219000adcc31ff9a8a698 + in https://github.com/openEuler-BaseService) + +Fixes: https://github.com/lloyd/yajl/issues/250 (CVE-2023-33460) +--- + src/yajl_tree.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/src/yajl_tree.c b/src/yajl_tree.c +index 4b3cf2b..56c7012 100644 +--- a/src/yajl_tree.c ++++ b/src/yajl_tree.c +@@ -449,6 +449,9 @@ yajl_val yajl_tree_parse (const char *input, + yajl_tree_free(v); + } + yajl_free (handle); ++ //If the requested memory is not released in time, it will cause memory leakage ++ if(ctx.root) ++ yajl_tree_free(ctx.root); + return NULL; + } + +-- +2.41.0 + diff --git a/source.sh b/source.sh deleted file mode 100644 index 401261f..0000000 --- a/source.sh +++ /dev/null @@ -1,40 +0,0 @@ -# This is the source.sh script. It is executed by BPM in a temporary directory when compiling a source package -# BPM Expects the source code to be extracted into the automatically created 'source' directory which can be accessed using $BPM_SOURCE -# BPM Expects the output files to be present in the automatically created 'output' directory which can be accessed using $BPM_OUTPUT - -DOWNLOAD="https://github.com/lloyd/yajl/archive/refs/tags/${BPM_PKG_VERSION}.tar.gz" -FILENAME="${DOWNLOAD##*/}" - -# The prepare function is executed in the root of the temp directory -# This function is used for downloading files and putting them into the correct location -prepare() { - wget "$DOWNLOAD" - tar -xvf "$FILENAME" --strip-components=1 -C "$BPM_SOURCE" -} - -# The build function is executed in the source directory -# This function is used to compile the source code -build() { - mkdir build - cd build - - export CFLAGS+=" -ffat-lto-objects" - cmake -DCMAKE_BUILD_TYPE=None -DCMAKE_INSTALL_PREFIX=/usr -Wno-dev .. - make -} - -# The check function is executed in the source directory -# This function is used to run tests to verify the package has been compiled correctly -check() { - cd build - make test -} - -# The package function is executed in the source directory -# This function is used to move the compiled files into the output directory -package() { - cd build - make DESTDIR="$BPM_OUTPUT" install - install -Dm644 ../COPYING "$BPM_OUTPUT"/usr/share/licenses/yajl/COPYING - install -Dm644 ../{ChangeLog,README,TODO} -t "$BPM_OUTPUT"/usr/share/doc/yajl/ -}