.gitignore

@@ -1 +1 @@
-SOURCES/Storable-3.15.tar.gz
+SOURCES/Storable-3.11_repackaged.tar.gz

.perl-Storable.metadata

@@ -1 +1 @@
-dfd5ef17f9cdca7c246a90cbde7948e4c0168670 SOURCES/Storable-3.15.tar.gz
+57bb71759dfa59062cbab415584321b4e90ad368 SOURCES/Storable-3.11_repackaged.tar.gz

SOURCES/Storable-3.15-perl-134179-include-regexps-in-the-seen-objects-tabl.patch

@@ -1,92 +0,0 @@
-From 16f2ddb794883529d5a3ad8326974a07aae7e567 Mon Sep 17 00:00:00 2001
-From: Tony Cook <tony@develop-help.com>
-Date: Mon, 10 Jun 2019 10:17:20 +1000
-Subject: [PATCH] (perl #134179) include regexps in the seen objects table on
- retrieve
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Also, bless the regexp object, so freezing/thawing bless qr//, "Foo"
-returns a "Foo" blesses regexp.
-
-Signed-off-by: Petr Písař <ppisar@redhat.com>
----
- dist/Storable/Storable.xs |  5 +++--
- dist/Storable/t/regexp.t  |  4 +++-
- dist/Storable/t/weak.t    | 10 +++++++++-
- 3 files changed, 15 insertions(+), 4 deletions(-)
-
-diff --git a/dist/Storable/Storable.xs b/dist/Storable/Storable.xs
-index ed729c94a6..6a45d8adf2 100644
---- a/dist/Storable/Storable.xs
-+++ b/dist/Storable/Storable.xs
-@@ -6808,8 +6808,7 @@ static SV *retrieve_regexp(pTHX_ stcxt_t *cxt, const char *cname) {
-     SV *sv;
-     dSP;
-     I32 count;
--
--    PERL_UNUSED_ARG(cname);
-+    HV *stash;
- 
-     ENTER;
-     SAVETMPS;
-@@ -6857,6 +6856,8 @@ static SV *retrieve_regexp(pTHX_ stcxt_t *cxt, const char *cname) {
- 
-     sv = SvRV(re_ref);
-     SvREFCNT_inc(sv);
-+    stash = cname ? gv_stashpv(cname, GV_ADD) : 0;
-+    SEEN_NN(sv, stash, 0);
-     
-     FREETMPS;
-     LEAVE;
-diff --git a/dist/Storable/t/regexp.t b/dist/Storable/t/regexp.t
-index acf28cfec6..e7c6c7e94a 100644
---- a/dist/Storable/t/regexp.t
-+++ b/dist/Storable/t/regexp.t
-@@ -37,7 +37,7 @@ while (<DATA>) {
-     }
- }
- 
--plan tests => 9 + 3*scalar(@tests);
-+plan tests => 10 + 3*scalar(@tests);
- 
- SKIP:
- {
-@@ -75,6 +75,8 @@ SKIP:
-     ok(!eval { dclone($re) }, "should fail to clone, even with use re 'eval'");
- }
- 
-+is(ref(dclone(bless qr//, "Foo")), "Foo", "check reblessed regexps");
-+
- for my $test (@tests) {
-     my ($code, $not, $match, $matchc, $name) = @$test;
-     my $qr = eval $code;
-diff --git a/dist/Storable/t/weak.t b/dist/Storable/t/weak.t
-index 220c70160f..48752fbec4 100644
---- a/dist/Storable/t/weak.t
-+++ b/dist/Storable/t/weak.t
-@@ -29,7 +29,7 @@ sub BEGIN {
- }
- 
- use Test::More 'no_plan';
--use Storable qw (store retrieve freeze thaw nstore nfreeze);
-+use Storable qw (store retrieve freeze thaw nstore nfreeze dclone);
- require 'testlib.pl';
- our $file;
- use strict;
-@@ -143,3 +143,11 @@ foreach (@tests) {
-   $stored = nfreeze $input;
-   tester($stored, \&freeze_and_thaw, $testsub, 'network string');
- }
-+
-+{
-+    # [perl #134179] sv_upgrade from type 7 down to type 1
-+    my $foo = [qr//,[]];
-+    weaken($foo->[1][0][0] = $foo->[1]);
-+    my $out = dclone($foo); # croaked here
-+    is_deeply($out, $foo, "check they match");
-+}
--- 
-2.20.1
-

SOURCES/Storable-3.16-Storable-make-count-large-enough.patch

@@ -1,53 +0,0 @@
-From f7724052d1b8b75339f5ec2cc3d5b35ca5d130b5 Mon Sep 17 00:00:00 2001
-From: Tony Cook <tony@develop-help.com>
-Date: Wed, 7 Aug 2019 11:13:53 +1000
-Subject: [PATCH] Storable: make count large enough
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-AvARRAY() could be very large, and we check for that at line 3807,
-but int was (potentially) too small to make that comparison
-meaningful.
-
-CID 174681.
-
-Signed-off-by: Petr Písař <ppisar@redhat.com>
----
- dist/Storable/Storable.xs | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/dist/Storable/Storable.xs b/dist/Storable/Storable.xs
-index 6a45d8adf2..d75125b839 100644
---- a/dist/Storable/Storable.xs
-+++ b/dist/Storable/Storable.xs
-@@ -3662,7 +3662,7 @@ static int store_hook(
-     SV *ref;
-     AV *av;
-     SV **ary;
--    int count;			/* really len3 + 1 */
-+    IV count;			/* really len3 + 1 */
-     unsigned char flags;
-     char *pv;
-     int i;
-@@ -3752,7 +3752,7 @@ static int store_hook(
-     SvREFCNT_dec(ref);			/* Reclaim temporary reference */
- 
-     count = AvFILLp(av) + 1;
--    TRACEME(("store_hook, array holds %d items", count));
-+    TRACEME(("store_hook, array holds %" IVdf " items", count));
- 
-     /*
-      * If they return an empty list, it means they wish to ignore the
-@@ -3986,7 +3986,7 @@ static int store_hook(
-      */
- 
-     TRACEME(("SX_HOOK (recursed=%d) flags=0x%x "
--             "class=%" IVdf " len=%" IVdf " len2=%" IVdf " len3=%d",
-+             "class=%" IVdf " len=%" IVdf " len2=%" IVdf " len3=%" IVdf,
-              recursed, flags, (IV)classnum, (IV)len, (IV)len2, count-1));
- 
-     /* SX_HOOK <flags> [<extra>] */
--- 
-2.20.1
-

SOURCES/perl-5.31.6-disallow-vstring-magic-strings-over-2GB-1.patch

@@ -1,67 +0,0 @@
-From ea1e86cfdf26a330e58ea377a80273de7110011b Mon Sep 17 00:00:00 2001
-From: Tony Cook <tony@develop-help.com>
-Date: Wed, 21 Aug 2019 11:37:58 +1000
-Subject: [PATCH] disallow vstring magic strings over 2GB-1
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-On reads this could result in buffer overflows, so avoid writing
-such large vstrings to avoid causing problems for older Storable.
-
-Since we no longer write such large vstrings, we don't want to accept
-them.
-
-I doubt that restricting versions strings to under 2GB-1 will have
-a practical effect on downstream users.
-
-fixes #17306
-
-Signed-off-by: Petr Písař <ppisar@redhat.com>
----
- dist/Storable/Storable.xs | 19 ++++++++++++++++---
- 1 file changed, 16 insertions(+), 3 deletions(-)
-
-diff --git a/dist/Storable/Storable.xs b/dist/Storable/Storable.xs
-index c2335680ab..d27ac58012 100644
---- a/dist/Storable/Storable.xs
-+++ b/dist/Storable/Storable.xs
-@@ -2628,6 +2628,12 @@ static int store_scalar(pTHX_ stcxt_t *cxt, SV *sv)
-             /* The macro passes this by address, not value, and a lot of
-                called code assumes that it's 32 bits without checking.  */
-             const SSize_t len = mg->mg_len;
-+            /* we no longer accept vstrings over I32_SIZE-1, so don't emit
-+               them, also, older Storables handle them badly.
-+            */
-+            if (len >= I32_MAX) {
-+                CROAK(("vstring too large to freeze"));
-+            }
-             STORE_PV_LEN((const char *)mg->mg_ptr,
-                          len, SX_VSTRING, SX_LVSTRING);
-         }
-@@ -5937,12 +5943,19 @@ static SV *retrieve_lvstring(pTHX_ stcxt_t *cxt, const char *cname)
- {
- #ifdef SvVOK
-     char *s;
--    I32 len;
-+    U32 len;
-     SV *sv;
- 
-     RLEN(len);
--    TRACEME(("retrieve_lvstring (#%d), len = %" IVdf,
--             (int)cxt->tagnum, (IV)len));
-+    TRACEME(("retrieve_lvstring (#%d), len = %" UVuf,
-+             (int)cxt->tagnum, (UV)len));
-+
-+    /* Since we'll no longer produce such large vstrings, reject them
-+       here too.
-+    */
-+    if (len >= I32_MAX) {
-+        CROAK(("vstring too large to fetch"));
-+    }
- 
-     New(10003, s, len+1, char);
-     SAFEPVREAD(s, len, s);
--- 
-2.21.0
-

SPECS/perl-Storable.spec

@@ -1,20 +1,20 @@
 Name:           perl-Storable
 Epoch:          1
-Version:        3.15
+Version:        3.11
-Release:        442%{?dist}
+Release:        3%{?dist}
 Summary:        Persistence for Perl data structures
 # __Storable__.pm:  GPL+ or Artistic
+## Not in the binary packages
+# t/CVE-2015-1592.inc:  BSD (same as Metasploit Framwork)
 License:        GPL+ or Artistic
 URL:            https://metacpan.org/release/Storable
-Source0:        https://cpan.metacpan.org/authors/id/X/XS/XSAWYERX/Storable-%{version}.tar.gz
+# Storable-3.11 was repackaged without t/CVE-2015-1592.inc file (perl commit
-# Fix deep cloning regular expression objects, RT#134179,
+# fb5f378b17e3b41db03064c19b9205db64a3354c) to silent antivirus alerts,
-# in Perl upstream after 5.31.0
+# bug #1663711, # RT#133706, in perl upstream after 5.29.5, Original source URL:
-Patch0:         Storable-3.15-perl-134179-include-regexps-in-the-seen-objects-tabl.patch
+# https://cpan.metacpan.org/authors/id/X/XS/XSAWYERX/Storable-%%{version}.tar.gz
-# Fix array length check in a store hook, in Perl upstream after 5.31.2
+Source0:        Storable-3.11_repackaged.tar.gz
-Patch1:         Storable-3.16-Storable-make-count-large-enough.patch
+# bash for stacksize script (ulimit) that is executed at build time
-# Fix a buffer overflow when processing a vstring longer than 2^31-1,
+BuildRequires:  bash
-# Perl GH#17306, in perl upstream after 5.31.6
-Patch2:         perl-5.31.6-disallow-vstring-magic-strings-over-2GB-1.patch
 BuildRequires:  gcc
 BuildRequires:  make
 BuildRequires:  perl-devel
@@ -30,6 +30,7 @@ BuildRequires:  perl(warnings)
 # Win32 not used on Linux
 # Win32API::File not used on Linux
 # Run-time:
+# Carp substitutes missing Log::Agent
 BuildRequires:  perl(Carp)
 BuildRequires:  perl(Exporter)
 # Fcntl is optional, but locking is good
@@ -60,6 +61,8 @@ BuildRequires:  perl(Hash::Util)
 # core Storable.
 BuildRequires:  perl(Tie::Hash)
 Requires:       perl(:MODULE_COMPAT_%(eval "`perl -V:version`"; echo $version))
+# Carp substitutes missing Log::Agent
+Requires:       perl(Carp)
 Requires:       perl(Config)
 # Fcntl is optional, but locking is good
 Requires:       perl(Fcntl)
@@ -74,22 +77,19 @@ can be conveniently stored to disk and retrieved at a later time.
 
 %prep
 %setup -q -n Storable-%{version}
-%patch0 -p3
-%patch1 -p3
-%patch2 -p3
 
 %build
-perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 NO_PERLLOCAL=1 OPTIMIZE="$RPM_OPT_FLAGS"
+perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 OPTIMIZE="$RPM_OPT_FLAGS"
-%{make_build}
+make %{?_smp_mflags}
 
 %install
-%{make_install}
+make pure_install DESTDIR=$RPM_BUILD_ROOT
 find $RPM_BUILD_ROOT -type f -name '*.bs' -size 0 -delete
 find $RPM_BUILD_ROOT -type f -name '*.3pm' -size 0 -delete
 %{_fixperms} $RPM_BUILD_ROOT/*
 
 %check
-unset PERL_CORE PERL_TEST_MEMORY PERL_RUN_SLOW_TESTS
+unset PERL_TEST_MEMORY PERL_RUN_SLOW_TESTS
 make test
 
 %files
@@ -99,40 +99,9 @@ make test
 %{_mandir}/man3/*
 
 %changelog
-* Mon Nov 25 2019 Petr Pisar <ppisar@redhat.com> - 1:3.15-442
+* Mon Jan 07 2019 Petr Pisar <ppisar@redhat.com> - 1:3.11-3
-- Fix a buffer overflow when processing a vstring longer than 2^31-1
-  (Perl GH#17306)
-
-* Thu Aug 08 2019 Petr Pisar <ppisar@redhat.com> - 1:3.15-441
-- Fix array length check in a store hook
-
-* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1:3.15-440
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Tue Jun 11 2019 Petr Pisar <ppisar@redhat.com> - 1:3.15-439
-- Fix deep cloning regular expression objects (RT#134179)
-
-* Thu May 30 2019 Jitka Plesnikova <jplesnik@redhat.com> - 1:3.15-438
-- Increase release to favour standalone package
-
-* Wed Apr 24 2019 Petr Pisar <ppisar@redhat.com> - 1:3.15-1
-- 3.15 bump
-
-* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1:3.11-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Mon Jan 07 2019 Petr Pisar <ppisar@redhat.com> - 1:3.11-6
 - Storable-3.11 source archive repackaged without a t/CVE-2015-1592.inc file
-  (RT#133706)
+  (bug #1663711)
-
-* Mon Aug 27 2018 Petr Pisar <ppisar@redhat.com> - 1:3.11-5
-- Fix recursion check (RT#133326)
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1:3.11-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Tue Jun 26 2018 Jitka Plesnikova <jplesnik@redhat.com> - 1:3.11-3
-- Perl 5.28 rebuild
 
 * Tue Jun 05 2018 Petr Pisar <ppisar@redhat.com> - 1:3.11-2
 - Do not package empty Storable::Limit(3pm) manual page