mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-09-08 18:30:16 +00:00
Hetvi Thakar
50f5a96f22
This patch applies the upstream fix referenced in [2], using the commit shown in [1]. [1] https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-44660 Signed-off-by: Hetvi Thakar <hthakar@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
113 lines
3.1 KiB
Diff
113 lines
3.1 KiB
Diff
From 62fa316b5bdf9b2bb66efa60d1a17b38dc80f946 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Br=C3=A9nainn=20Woodsend?= <bwoodsend@gmail.com>
|
|
Date: Sun, 3 May 2026 12:22:48 +0100
|
|
Subject: [PATCH] Fix failure cleanup paths in ujson.dump()
|
|
|
|
* Add missing dec-refs for if PyTuple_Pack() or writing the payload to
|
|
file fails
|
|
|
|
* Add missing bailout for failed PyTuple_Pack()
|
|
|
|
* Add tests for all but the PyTuple_Pack() failing (which requires
|
|
inducing a malloc() failure)
|
|
|
|
CVE: CVE-2026-44660
|
|
Upstream-Status: Backport [https://github.com/ultrajson/ultrajson/commit/82af1d0ac01d09aa40c887b460d44b9d9f4bccd9]
|
|
|
|
Backport Changes:
|
|
- Adjusted source paths for ujson 5.9.0's pre-src-layout tree.
|
|
|
|
(cherry picked from commit 82af1d0ac01d09aa40c887b460d44b9d9f4bccd9)
|
|
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
|
|
---
|
|
python/objToJSON.c | 7 +++++++
|
|
tests/test_ujson.py | 33 +++++++++++++++++++++++++++++++++
|
|
2 files changed, 40 insertions(+)
|
|
|
|
diff --git a/python/objToJSON.c b/python/objToJSON.c
|
|
index 9013205..47e46c1 100644
|
|
--- a/python/objToJSON.c
|
|
+++ b/python/objToJSON.c
|
|
@@ -909,6 +909,11 @@ PyObject* objToJSONFile(PyObject* self, PyObject *args, PyObject *kwargs)
|
|
}
|
|
|
|
argtuple = PyTuple_Pack(1, data);
|
|
+ if (argtuple == NULL)
|
|
+ {
|
|
+ Py_XDECREF(write);
|
|
+ return NULL;
|
|
+ }
|
|
|
|
string = objToJSON (self, argtuple, kwargs);
|
|
|
|
@@ -925,6 +930,7 @@ PyObject* objToJSONFile(PyObject* self, PyObject *args, PyObject *kwargs)
|
|
if (argtuple == NULL)
|
|
{
|
|
Py_XDECREF(write);
|
|
+ Py_DECREF(string);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -932,6 +938,7 @@ PyObject* objToJSONFile(PyObject* self, PyObject *args, PyObject *kwargs)
|
|
if (write_result == NULL)
|
|
{
|
|
Py_XDECREF(write);
|
|
+ Py_DECREF(string);
|
|
Py_XDECREF(argtuple);
|
|
return NULL;
|
|
}
|
|
diff --git a/tests/test_ujson.py b/tests/test_ujson.py
|
|
index 9ba6f55..ccff37f 100644
|
|
--- a/tests/test_ujson.py
|
|
+++ b/tests/test_ujson.py
|
|
@@ -8,6 +8,7 @@ import os.path
|
|
import re
|
|
import subprocess
|
|
import sys
|
|
+import types
|
|
import uuid
|
|
from collections import OrderedDict
|
|
from pathlib import Path
|
|
@@ -365,6 +366,38 @@ def test_dump_to_file_like_object():
|
|
def test_dump_file_args_error():
|
|
with pytest.raises(TypeError):
|
|
ujson.dump([], "")
|
|
+ with pytest.raises(TypeError):
|
|
+ ujson.dump([], "", "")
|
|
+
|
|
+
|
|
+def test_dump_non_callable_write():
|
|
+ file = types.SimpleNamespace(write="a")
|
|
+ with pytest.raises(TypeError):
|
|
+ ujson.dump([7] * 100, file)
|
|
+
|
|
+
|
|
+def test_failed_dump():
|
|
+ with pytest.raises(TypeError):
|
|
+ ujson.dump([[0] * 100, object()], io.StringIO())
|
|
+
|
|
+
|
|
+def test_failed_dump_bogus_file():
|
|
+ file = types.SimpleNamespace(write=lambda: None)
|
|
+ with pytest.raises(TypeError, match="0 positional arguments"):
|
|
+ ujson.dump([0] * 100, file)
|
|
+
|
|
+
|
|
+def test_failed_dump_failed_write():
|
|
+ file = types.SimpleNamespace(write=lambda x: 1 / 0)
|
|
+ with pytest.raises(ZeroDivisionError):
|
|
+ ujson.dump([0] * 100, file)
|
|
+
|
|
+
|
|
+def test_failed_dump_closed_file():
|
|
+ file = io.StringIO()
|
|
+ file.close()
|
|
+ with pytest.raises(ValueError, match="closed file"):
|
|
+ ujson.dump([0] * 100, file)
|
|
|
|
|
|
def test_load_file():
|
|
--
|
|
2.35.6
|
|
|