Tina Müller (tinita)

Just to clarify a few things, I'm currently trying to understand the feature. > If the CASEDIR variable is a git repo URL with a fragment specifying the ref of...

Thanks! The leak is actually caused by a missing `yaml_parser_delete` in `tests/run-parser-test-suite.c`. That should be easy to fix, but is not a bug in libyaml itself. But thanks to the...

why did you close it?

https://build.opensuse.org/package/live_build_log/devel:openQA:GitHub:os-autoinst:openQA:PR-5524/openQA/openSUSE_Tumbleweed/x86_64 ``` [ 38s] ./tools/generate-packed-assets [ 38s] Could not find input asset "../node_modules/codemirror/lib/codemirror.css". at /usr/lib/perl5/vendor_perl/5.38.2/Mojolicious/Plugin/AssetPack.pm line 172. [ 39s] Could not find input asset "../node_modules/codemirror/lib/codemirror.css". at /usr/lib/perl5/vendor_perl/5.38.2/Mojolicious/Plugin/AssetPack.pm line 172. [...

I think this might be the wrong way. we don't want those as direct dependencies. Maybe it's better after all to wait for dependabot updates.

I never saw an issue about that here. But I went to the link and looked at the code: ``` #include #include #include #include void poc() { yaml_document_t document; memset(&document,...

I am not sure how that is something to exploit. If you find code out there that does this then the code is broken and won't work anyway. I will...

I contacted Vuldb to reject it and also complained about a missing report before disclosure.

Vuldb replied that mitre.org is responsible for this one *sigh* so I filled out their contact form. It seems to be easy to create a CVE, but it is made...

Some more detailed thoughts. In order to call something a CVE, I would at least need to see a program that does something useful and works. So let's look at...