How is this CVE-2024-3205 affected?

[zhuofeng6]

https://nvd.nist.gov/vuln/detail/CVE-2024-3205

[hasufell]

NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

[hasufell]

Code:

libyaml/src/emitter.c

Lines 740 to 788 in f8f760f

	/*
	*
	* Expect a flow item node.
	*/
	static int
	yaml_emitter_emit_flow_sequence_item(yaml_emitter_t *emitter,
	yaml_event_t *event, int first)
	{
	if (first)
	{
	if (!yaml_emitter_write_indicator(emitter, "[", 1, 1, 0))
	return 0;
	if (!yaml_emitter_increase_indent(emitter, 1, 0))
	return 0;
	emitter->flow_level ++;
	}
	if (event->type == YAML_SEQUENCE_END_EVENT)
	{
	emitter->flow_level --;
	emitter->indent = POP(emitter, emitter->indents);
	if (emitter->canonical && !first) {
	if (!yaml_emitter_write_indicator(emitter, ",", 0, 0, 0))
	return 0;
	if (!yaml_emitter_write_indent(emitter))
	return 0;
	}
	if (!yaml_emitter_write_indicator(emitter, "]", 0, 0, 0))
	return 0;
	emitter->state = POP(emitter, emitter->states);
	return 1;
	}
	if (!first) {
	if (!yaml_emitter_write_indicator(emitter, ",", 0, 0, 0))
	return 0;
	}
	if (emitter->canonical || emitter->column > emitter->best_width) {
	if (!yaml_emitter_write_indent(emitter))
	return 0;
	}
	if (!PUSH(emitter, emitter->states, YAML_EMIT_FLOW_SEQUENCE_ITEM_STATE))
	return 0;
	return yaml_emitter_emit_node(emitter, event, 0, 1, 0, 0);
	}

[zhuofeng6]

Is this pr to fix the CVE?
#259

[zhuofeng6]

Code:

libyaml/src/emitter.c

Lines 740 to 788 in f8f760f

	/*
	*
	* Expect a flow item node.
	*/
	static int
	yaml_emitter_emit_flow_sequence_item(yaml_emitter_t *emitter,
	yaml_event_t *event, int first)
	{
	if (first)
	{
	if (!yaml_emitter_write_indicator(emitter, "[", 1, 1, 0))
	return 0;
	if (!yaml_emitter_increase_indent(emitter, 1, 0))
	return 0;
	emitter->flow_level ++;
	}
	if (event->type == YAML_SEQUENCE_END_EVENT)
	{
	emitter->flow_level --;
	emitter->indent = POP(emitter, emitter->indents);
	if (emitter->canonical && !first) {
	if (!yaml_emitter_write_indicator(emitter, ",", 0, 0, 0))
	return 0;
	if (!yaml_emitter_write_indent(emitter))
	return 0;
	}
	if (!yaml_emitter_write_indicator(emitter, "]", 0, 0, 0))
	return 0;
	emitter->state = POP(emitter, emitter->states);
	return 1;
	}
	if (!first) {
	if (!yaml_emitter_write_indicator(emitter, ",", 0, 0, 0))
	return 0;
	}
	if (emitter->canonical || emitter->column > emitter->best_width) {
	if (!yaml_emitter_write_indent(emitter))
	return 0;
	}
	if (!PUSH(emitter, emitter->states, YAML_EMIT_FLOW_SEQUENCE_ITEM_STATE))
	return 0;
	return yaml_emitter_emit_node(emitter, event, 0, 1, 0, 0);
	}

Where exactly is this memory leak?

[perlpunk]

It's hard to review a PR if there is no reproducer I guess...

[hasufell]

@perlpunk there's supposedly evidence in the fuzzing data https://drive.google.com/drive/folders/1lwNEs8wqwkUV52f3uQNYMPrxRuXPtGQs?usp=sharing

I haven't checked yet

[perlpunk]

At least I can download some files from the shared drive, but the two input files I can find there have nothing to do with flow sequences. Also seem to be broken.
This is one of the files (I removed some broken stuff at the beginning that the parser complained about):

- -  - - -   - - - -     - - - - - -   - - -  - -  -     - - -   - - - -     - - - - - - -  -  - - - - ---   -     -  -- - -     - - -     - - - - - - -  -  -  - - - -     -  --   -  - 
-  - - -    - - - -   - - -  - - - -     - - -   - - - - -   - - - -     -     - - - - - - -  -  -  - - - -     - - -   -  - 
-  - - -    - - - -   - - -  - - - -     - - -   - - - - -   - - - -     - -    - - -     - - - - - -   - - -  - -  -     - - -   - -- -   - - - -       --  - 

[perlpunk]

Please see my notes in #258 how I tried to reproduce (and failed)

[zhuofeng6]

I think this can only be a bug, not a cve. After all, it's common.

What do you think, my brother @perlpunk

[perlpunk]

brother?

[perlpunk]

Please see my latest comment here: #258 (comment)
I believe it's not a libyaml vulnerability or bug.