Apply patch for CVE-2013-6393 [1] to fix heap-based buffer overflow when
parsing YAML tags.
Also apply a patch for hardenning the guards againt the issue

The only user in base in yaml is pkg(7) which uses the library a way that it is not affected

Submitted by:	delphij
Obtained from:	https://bugzilla.redhat.com/show_bug.cgi?id=1033990
MFC after:	3 days
Security:	CVE-2013-6393
Fix the definition of hg_cmd.

MFC after:	3 days
Slightly deobfuscate read_file() and likely pessimize the runtime
performance by epsilon.
(Translation: elminate bogus macros that hid 'returns' making it hard
 to read and moved a block of code inline rather than at the end of the
 fuction where it was effectively a 'gosub' kind of goto).
In the 17 years since r30796, the mandatory keyword has never been used
in any files as far as I can tell, and is currently unused. Retire it.
Don't believe we have a requirement until after we've checked all the
known key words. This will make error messages slightly better in
weird corner cases, but should otherwise be a nop.
Move the check for standard keyword + optional inclusion specifier to
its proper location. Otherwise you could have 'file.c standard pci'
without an error. This construct isn't in our tree, and has no well
defined meaning.
Remove some unnecessary code.  The offsets read from the first block are
overwritten a few lines bellow.

Reviewed by:	ray
Approved by:	adrian (mentor)
Fix a logic error.  Because of this inflateReset() wasn't being called and
the output buffer wasn't being cleared between the inflate() calls,
producing zeroed output after the first inflate() call.

This fixes the read of mkuzip(8) images with geom_uncompress(4).

Reviewed by:	ray
Approved by:	adrian (mentor)