CVE-2017-16516

[pfsmorigo]

Hello, yajl-ruby has a fix for CVE-2017-16516 that might be affecting yajl as well. Can you backport it? The commit is https://github.com/brianmario/yajl-ruby/commit/a8ca8f476655adaa187eedc60bdc770fff3c51ce

Thanks!

[berrange]

I confirmed the problem affects git master, but only if asserts are enabled. IOW,

• If you do cmake -DCMAKE_BUILD_TYPE=Debug then the two JSON documents illustrated in https://github.com/brianmario/yajl-ruby/issues/176 will trigger asserts.

• If you use cmake -DCMAKE_BUILD_TYPE=Release, then it will pass -DNDEBUG to CC which disables asserts.

Simply not passing CMAKE_BUILD_TYPE at all appears to have the same behaviour as the Release build on my cmake install at least.

The fix mentioned from yajl-ruby works on git master to avoid the asserts.