[packages/yajl] Rel 4; security fixes

[arekm]

commit d039ce01a2876feb5b7f421685a9d4d2650209c0
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Fri Aug 28 08:35:34 2026 +0200

    Rel 4; security fixes

 yajl-CVE-2017-16516.patch | 22 ++++++++++++++++++++++
 yajl-CVE-2022-24795.patch | 30 ++++++++++++++++++++++++++++++
 yajl-CVE-2023-33460.patch | 36 ++++++++++++++++++++++++++++++++++++
 yajl.spec                 | 17 +++++++++++------
 4 files changed, 99 insertions(+), 6 deletions(-)
---
diff --git a/yajl.spec b/yajl.spec
index 2def4a2..bc3f948 100644
--- a/yajl.spec
+++ b/yajl.spec
@@ -6,13 +6,16 @@ Summary:	Yet Another JSON Library
 Summary(pl.UTF-8):	Yet Another JSON Library - jeszcze jedna biblioteka JSON
 Name:		yajl
 Version:	2.1.0
-Release:	3
-License:	BSD
+Release:	4
+License:	ISC
 Group:		Libraries
-Source0:	https://github.com/lloyd/yajl/archive/%{version}/%{name}-%{version}.tar.gz
+Source0:	https://github.com/lloyd/yajl/archive/refs/tags/%{version}.tar.gz?/%{name}-%{version}.tar.gz
 # Source0-md5:	6887e0ed7479d2549761a4d284d3ecb0
 Patch0:		%{name}-pc.patch
-URL:		http://lloyd.github.io/yajl/
+Patch1:		%{name}-CVE-2017-16516.patch
+Patch2:		%{name}-CVE-2022-24795.patch
+Patch3:		%{name}-CVE-2023-33460.patch
+URL:		https://lloyd.github.io/yajl/
 BuildRequires:	cmake >= 2.6
 BuildRoot:	%{tmpdir}/%{name}-%{version}-root-%(id -u -n)
 
@@ -51,6 +54,9 @@ Statyczna biblioteka YAJL.
 %prep
 %setup -q
 %patch -P0 -p1
+%patch -P1 -p1
+%patch -P2 -p1
+%patch -P3 -p1
 
 %if "%{pld_release}" == "ac"
 #cc1: error: unrecognized option `-Wextra'
@@ -63,8 +69,7 @@ Statyczna biblioteka YAJL.
 install -d build
 cd build
 
-%cmake .. \
-	-DLIB_INSTALL_DIR=%{_libdir}
+%cmake ..
 
 %{__make}
 %{?with_tests:%{__make} test}
diff --git a/yajl-CVE-2017-16516.patch b/yajl-CVE-2017-16516.patch
new file mode 100644
index 0000000..30b790b
--- /dev/null
+++ b/yajl-CVE-2017-16516.patch
@@ -0,0 +1,22 @@
+Description: Fix for CVE-2017-16516
+ Potential buffer overread: A JSON file can cause denial of service.
+Origin: https://github.com/brianmario/yajl-ruby/commit/a8ca8f476655adaa187eedc60bdc770fff3c51ce
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040036
+Bug: https://github.com/lloyd/yajl/issues/248
+---
+ src/yajl_encode.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/src/yajl_encode.c
++++ b/src/yajl_encode.c
+@@ -139,8 +139,8 @@
+                     end+=3;
+                     /* check if this is a surrogate */
+                     if ((codepoint & 0xFC00) == 0xD800) {
+-                        end++;
+-                        if (str[end] == '\\' && str[end + 1] == 'u') {
++                        if (end + 2 < len && str[end + 1] == '\\' && str[end + 2] == 'u') {
++                            end++;
+                             unsigned int surrogate = 0;
+                             hexToDigit(&surrogate, str + end + 2);
+                             codepoint =
diff --git a/yajl-CVE-2022-24795.patch b/yajl-CVE-2022-24795.patch
new file mode 100644
index 0000000..8554ee8
--- /dev/null
+++ b/yajl-CVE-2022-24795.patch
@@ -0,0 +1,30 @@
+Description: Fix for CVE-2022-24795
+ An integer overflow will lead to heap memory corruption with large (~2GB) inputs.
+Origin: https://github.com/ppisar/yajl/commit/23cea2d7677e396efed78bbf1bf153961fab6bad
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1040036
+Bug: https://github.com/lloyd/yajl/issues/239
+---
+ src/yajl_buf.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/src/yajl_buf.c
++++ b/src/yajl_buf.c
+@@ -45,7 +45,17 @@
+ 
+     need = buf->len;
+ 
+-    while (want >= (need - buf->used)) need <<= 1;
++    if (((buf->used > want) ? buf->used : want) > (size_t)(buf->used + want)) {
++        /* We cannot allocate more memory than SIZE_MAX. */
++        abort();
++    }
++    while (want >= (need - buf->used)) {
++        if (need >= (size_t)((size_t)(-1)<<1)>>1) {
++            /* need would overflow. */
++            abort();
++        }
++        need <<= 1;
++    }
+ 
+     if (need != buf->len) {
+         buf->data = (unsigned char *) YA_REALLOC(buf->alloc, buf->data, need);
diff --git a/yajl-CVE-2023-33460.patch b/yajl-CVE-2023-33460.patch
new file mode 100644
index 0000000..97cafb7
--- /dev/null
+++ b/yajl-CVE-2023-33460.patch
@@ -0,0 +1,36 @@
+Description: Fix for CVE-2023-33460a
+ Memory leak in yajl 2.1.0 with use of yajl_tree_parse function
+ See https://github.com/lloyd/yajl/issues/250#issuecomment-1628695214
+Origin: https://github.com/openEuler-BaseService/yajl/commit/23a122eddaa28165a6c219000adcc31ff9a8a698
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039984
+Bug: https://github.com/lloyd/yajl/issues/250
+---
+ src/yajl_tree.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/src/yajl_tree.c
++++ b/src/yajl_tree.c
+@@ -143,7 +143,7 @@
+     ctx->stack = stack->next;
+ 
+     v = stack->value;
+-
++    free (stack->key);
+     free (stack);
+ 
+     return (v);
+@@ -444,7 +444,14 @@
+              snprintf(error_buffer, error_buffer_size, "%s", internal_err_str);
+              YA_FREE(&(handle->alloc), internal_err_str);
+         }
++        while(ctx.stack != NULL) {
++             yajl_val v = context_pop(&ctx);
++             yajl_tree_free(v);
++        }
+         yajl_free (handle);
++	//If the requested memory is not released in time, it will cause memory leakage
++	if(ctx.root)
++	     yajl_tree_free(ctx.root);
+         return NULL;
+     }
+ 
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/yajl.git/commitdiff/d039ce01a2876feb5b7f421685a9d4d2650209c0