Hello Sylvain, On 10/3/26 05:16, Sylvain Beucler wrote:
Hello Simon,On 02/10/2026 18:15, Simon Quigley wrote:Yes, a few of them are worth fixing on Bookworm. Not the whole 3.17.5 update, and I wouldn't ship a Bookworm update while Trixie still has the same bugs, but some issues are still worth fixing. I ran some tests on ruby-oj 3.14.2-1+deb12u1. These are the ones I'd look at: - An empty "^m" segfaults. - So does a key of exactly 65536 bytes that starts with ":". The 65537- byte key from the new test doesn't, and a plain 65536-byte key doesn't either. Both come back with an empty key. - Float::DIG by itself is a TypeError on this Ruby. Float::DIG::X segfaults, class cache on or off. - :create_id => nil double-frees, once the default create_id has been changed. - Indent 8 at 40 levels and indent 16 at 30 levels abort with "realloc(): invalid next size". I ran both again and they failed every time. Indent 2 and 4 were fine out to 50. Those two indents are still allowed. I wouldn't do a DLA for the rest:[snip!]The Trixie package still has the code behind each of these crashes, plus :float_format, so I don't want Bookworm to go out on its own. If the Security Team wants another Trixie DSA, Bookworm should follow that. If not, would a followup Trixie point release make sense as well, with the same small set?Thanks for these details :) Ideally, could you coordinate with upstream to issue a few CVEs/GHSAs for the important issues you short-listed? This would make it easier to coordinate with the Security Team, and also benefit other downstreams. Alternatively coordinate with the Security Team to create temporary entries (TEMP-2026-XXXX) that they can review, so we can coordinate trixie/bookworm. The Security Team will then decide whether these are worth a DSA or a SPU (point release / "no-dsa"). Once the DSA/SPU is approved, we can follow suite for bookworm-lts.
I've just emailed the Security Team asking for temporary tracker entries for that short list. https://github.com/ohler55/oj/issues/1109 has had no reply since September 26th, which is why I went that way instead of waiting on a new advisory. For what it's worth, this is my first time ever asking for such a thing, so feedback is appreciated. Thank you for bringing this up, Sylvain! Best regards, Simon Quigley [email protected]
OpenPGP_signature.asc
Description: OpenPGP digital signature
