Debian Patches

Status for libyaml-syck-perl/1.34-2+deb13u3

Patch Description Author Forwarded Bugs Origin Last update
disable-compiler-check.patch Disable compiler check. This is not needed in a Debian build environment, and more importantly,
it breaks cross-builds.		 gregor herrmann <gregoa@debian.org> not-needed debian vendor 2020-02-04
Address-memory-corruption-leading-to-str-value-being.patch Address memory corruption leading to 'str' value being set on empty keys

When yaml is parsed, qstr is allocated

In cases when the keys point to empty values there is no value

copied to qstr and no null value is copied in		 Timothy Legge <timlegge@gmail.com> yes upstream https://github.com/cpan-authors/YAML-Syck/commit/dcf4c8477b82ef439f43fd20dc099082d096df02 2025-10-09
fix-address-all-4-C-layer-audit-findings-from-issue-.patch fix: address all 4 C-layer audit findings from issue #67
- HIGH: Fix heap buffer overflow in emitter tag buffer. The 512-byte
fixed allocation overflowed via strcat(tag, ref) with long class names.
Now tracks buffer size and grows dynamically with Renew() when needed.

- MEDIUM: Fix base64 decoder reading past buffer end on trailing
newlines. Added s < send guard to the inner whitespace-skip loop.

- MEDIUM: Replace strtok(id, "/:") with savepv copy + strtok at all 6
call sites in the parser handler. strtok mutated n->type_id in place,
corrupting shared node data. Each site now operates on a local copy
that is freed after use.

- LOW: Fix memory leak in syck_hdlr_add_anchor when a node already has
an anchor. The incoming anchor string 'a' was leaked on early return.

Closes #67		 Toddr Bot <toddbot@rinaldo.us> no https://github.com/cpan-authors/YAML-Syck/commit/e8844a31c8cf0052914b198fc784ed4e6b8ae69e 2026-03-14
fix-prevent-buffer-underflow-in-base60-sexagesimal-p.patch fix: prevent buffer underflow in base60 (sexagesimal) parsing
The inner while loop in int#base60 and float#base60 parsing could
decrement a pointer past the start of the string buffer when processing
the leftmost segment (no colon found). The subsequent dereference
(*colon) then read one byte before the allocated buffer — undefined
behavior that could corrupt data or crash under ASan/Valgrind.

buffer start, and restructure the post-loop logic to handle the
no-colon (final segment) case explicitly without dereferencing
out-of-bounds memory.		 Toddr Bot <toddbot@rinaldo.us> no https://github.com/toddr/YAML-Syck/commit/208a4d3bd1b5cdb4a791a6e3905bd6bd45e9d005 2026-03-20
rebase-apply-review-feedback-on-69.patch rebase: apply review feedback on #69 Toddr Bot <toddbot@rinaldo.us> no https://github.com/toddr/YAML-Syck/commit/936b68c43544597663f8cb584aeffa7e08b85eed 2026-03-14
fix-prevent-memory-leaks-when-Load-LoadJSON-croak-on.patch fix: prevent memory leaks when Load/LoadJSON croak on parse errors
The parser error handler calls croak() which longjmps past the normal
cleanup path, leaking the SyckParser and (in JSON mode) the preprocessed
string buffer. In list context, the temporary AV also leaked.

Fix:
- Add SAVEDESTRUCTOR_X for the SyckParser, mirroring the emitter pattern
- Use SAVEFREEPV for the JSON preprocessed string (replaces manual Safefree)
- Mortalize the list-context AV so scope unwinding frees it on croak

Verified with 10,000 consecutive parse error iterations without crash.		 Toddr Bot <toddbot@rinaldo.us> no https://github.com/toddr/YAML-Syck/commit/bcc6cb7b7d8ffc4b06868525e839f4824e38bcf1 2026-04-14
Fix-four-libsyck-memory-safety-CVEs-reachable-from-Y.patch Fix four libsyck memory-safety CVEs reachable from YAML::Syck::Load()
Reported by Paul Johnson via the CPANSec coordinated-disclosure process.
All four defects live in the bundled libsyck C library, are reachable from
the default YAML::Syck::Load() path on untrusted input with no special flags
(!!binary, anchors and block scalars are all on the default path), and are
present through 1.46. Each has a small, self-contained fix plus a regression
test under t/cve-*.t.

== The defects and fixes ==

CVE-2026-57075 - CWE-125 Out-of-bounds Read (base64 decoder)
emitter.c: syck_base64dec() indexed the 256-entry static b64_xtable with a
plain signed char, e.g. `b64_xtable[(int)s[0]]`. Where char is signed
(x86-64, arm64) any !!binary byte >= 0x80 sign-extends to a NEGATIVE index
and reads before the table. Non-crashing, but the read value can surface in
the decoded !!binary result.
Fix: cast each of the four index sites to (unsigned char) so a high byte is
always a 0-255 index. b64_xtable[(int)b64_table[i]] at setup is left as-is;
that table is pure ASCII.

CVE-2026-57076 - CWE-416 Use After Free (anchor key string)
handler.c: an anchor name allocated by syck_strndup was used both as
node->anchor (owned by the node, freed by syck_free_node) AND as the key in
p->anchors. Freeing the node freed the table key, leaving a dangling key; an
anchor redefinition then had st_delete/st_strcmp compare against freed
memory.
Fix: give the anchors and bad_anchors tables sole ownership of their key
strings. Each table key becomes a private syck_strndup() copy, always a
distinct allocation from any node->anchor, and syck_st_free_nodes() frees the
key when its entry leaves the table at teardown. Because no pointer is then
both a table key and a node->anchor, freeing a node can no longer dangle a
key. (syck_.c, handler.c)

CVE-2026-57077 - CWE-125 Out-of-bounds Read (lexer newline scan)
token.c: newline_len()/is_newline() dereferenced *ptr (and *(ptr+1) for
\r\n) with no NUL terminator or bounds guarantee. During block-scalar lexing
at a document boundary the scan ran one byte past the heap lexer buffer.
This is an incomplete-fix follow-on to CVE-2025-11683, on a lexer path the
earlier fix did not cover.
Fix: give is_newline()/newline_len() an explicit `limit` parameter and check
it before every read, then pass the live bound at each call site (YYLIMIT, or
the scalar-buffer end for the one backward chomp walk, which also gains an
explicit `fc >= ptr` lower-bound guard). Changing the helper signatures makes
the compiler flag every call site, so none is missed - the failure mode that
left CVE-2025-11683 incomplete.

CVE-2026-13713 - CWE-416 Use After Free / CWE-415 Double Free (anchor node)
handler.c: when an anchor name is redefined or removed,
syck_hdlr_remove_anchor / syck_hdlr_add_anchor freed the SyckNode stored
under that name (syck_free_node). That node can still be live on the parser's
value stack, so syck_hdlr_add_node reaches it again and frees it a second
time. On a normal build the 48-byte node chunk is freed twice and the
interpreter aborts - a remote-crash DoS from a 7-byte input.
Fix: do not free an evicted anchor node inline. Add a parser-owned "retired"
table; syck_retire_node() moves the evicted node there and syck_st_free()
frees the table at teardown. Retired nodes keep node->anchor != NULL, so
syck_hdlr_add_node never re-frees them, and each node is evicted at most once,
so there is no double free at teardown. (handler.c, syck_.c, syck.h)

fix relies on CVE-2026-57076's: only once table keys are private copies
distinct from node->anchor is it safe to defer freeing an evicted node to
teardown. Applied together here.

== Regression tests (t/cve-*.t, one file per CVE) ==

Each test Loads its documented trigger in-process (one CVE per file, so a
crash only takes down that file, which the harness reports as failed) and
wraps Load() in eval{} so the patched behaviour - an ordinary parse-error
croak - passes while an uncatchable C-level abort fails the file. Verified in
both directions on a normal build (no ASan):

cve-2026-13713 : unpatched -> file aborts (SIGABRT/SIGTRAP); patched -> pass.
Provable on any build (it crashes).
cve-2026-57075 : unpatched -> high-bit !!binary decodes to leaked bytes
("A" on the author's build) instead of ""; patched -> "".
Provable via output on any build.
cve-2026-57076 : non-crashing UAF - silent on a normal build; proven by the
ASan CI job (heap-use-after-free READ in st_strcmp).
cve-2026-57077 : one-byte over-read - silent on a normal build; proven by the
ASan CI job (heap-buffer-overflow READ in newline_len).

== Documentation and packaging ==

- CLAUDE.md: new "Security & CVE Work" section documenting the policy - one
t/cve-<id>-<slug>.t per CVE, made to fail provably without the fix where
possible, in-process (no forked perl; note on why fork() is unsafe on
Windows), with silent defects proven by the ASan job.
- MANIFEST: add the four t/cve-*.t files.

== Verification ==

- Full suite passes with the fixes: 72 files / 1176 tests (AUTOMATED_TESTING=1,
leak tests active); no RSS growth over 200k iterations of the anchor paths.
- The asan CI job (added separately in .github/workflows/testsuite.yml)
confirmed all three ASan-visible defects on the unpatched tree with stack
traces matching the report, and goes green with these fixes.		 Todd Rinaldo <toddr@cpan.org> no debian https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b 2026-07-13

All known versions for source package 'libyaml-syck-perl'

Links