3rdparty: bump vendored fkYAML to v0.4.4 (fixes #1746 subscription-import crashes) - #1801
Open
AlexandrKhromov2005 wants to merge 1 commit into
Open
3rdparty: bump vendored fkYAML to v0.4.4 (fixes #1746 subscription-import crashes)#1801AlexandrKhromov2005 wants to merge 1 commit into
AlexandrKhromov2005 wants to merge 1 commit into
Conversation
Replaces the vendored single-header (was v0.4.2) with the official fkYAML v0.4.4 amalgamation. v0.4.4 fixes the deserializer memory-safety bugs reachable from Clash subscription parsing (RawUpdater::updateClash) reported in throneproj#1746: out-of-bounds reads in the UTF-8 / UTF-16 buffer views and an invalid context-stack access on a crafted scalar. Those are not C++ exceptions, so the existing catch (fkyaml::exception&) does not contain them. Verified: the reported reproducers crash the v0.4.2 header under ASan/UBSan and are clean on v0.4.4, driven through the same deserialize() call path. fkYAML reports no backward-incompatible API changes since v0.4.2, so this is a drop-in replacement. Fixes throneproj#1746
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replaces the vendored fkYAML single-header
3rdparty/fkYAML/node.hpp(currently v0.4.2) with the official v0.4.4 amalgamation.Why
RawUpdater::updateClashdeserializes a subscription body withfkyaml::node::deserialize(...), guarded only bycatch (const fkyaml::exception&). #1746 reported several deserializer memory-safety bugs reachable from a malicious subscription provider:01 00 0a)m_context_stack.back()on an empty deque indeserialize_scalar(SEGV)These are not C++ exceptions, so
catch (fkyaml::exception&)does not contain them — a crafted Clash YAML crashes the client on subscription update. fkYAML's author fixed the whole cluster in v0.4.4 and recommended replacing the header (comment in #1746).Verification
I built a driver that mirrors the
updateClashpath (deserialize, catching onlyfkyaml::exception) under ASan+UBSan and ran the reporters' minimal PoCs against both headers:01 00 0a(UTF-16 tail)fkYAML reports no backward-incompatible API changes since v0.4.2, so this is a drop-in replacement; the header also compiles standalone under
-std=c++20(the project standard). CI will confirm the full build.Fixes #1746