Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 28 Nov 2014 10:20:39 +0000
From: John Haxby <>
Subject: Re: libyaml / YAML-LibYAML DoS

On 28/11/14 05:57, Jonathan Gray wrote:
> libyaml and the perl YAML-LibYAML (aka YAML-XS) module based
> on the same code have an "impossible" assert that can be
> triggered with the following yaml.  This is a reduced testcase
> of a crash found with the afl fuzzer.
>       a: " 
> "     b: true
> In other words a crash/denial of service with untrusted yaml input.
> The libyaml author was contacted on the 21st and 27th of November.
> No response has been received but the issue has independently been
> reported publically since:
> [1] Parsing 'test.yaml': assertion "parser->simple_key_allowed || !required" failed: file "scanner.c", line 1113, function "yaml_parser_save_simple_key"
> assert(parser->simple_key_allowed || !required);    /* Impossible. */

For what it's worth PyYAML 3.10 and 3.11 have exactly the same assertion:

>>> import yaml
>>> yaml.load("""
... abc:
...     def: 'xxx
... '   ghi: 'yyy'
... """)
Traceback (most recent call last):


    assert self.allow_simple_key or not required


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.