From 702448e9554eddba3984a31c5286235471e9ef8d Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 14 Apr 2026 02:27:55 -0400 Subject: [PATCH] import Oracle_OSS perl-XML-Parser-2.47-6.1.0.1.el10_1 --- .gitignore | 2 +- .perl-XML-Parser.metadata | 1 - ...x-a-buffer-overwrite-in-parse_stream.patch | 64 ------ ...ch => XML-Parser-2.48-CVE-2006-10002.patch | 0 ...ch => XML-Parser-2.48-CVE-2006-10003.patch | 0 ...rl-XML-Parser.spec => perl-XML-Parser.spec | 207 ++++++++++++++---- sources | 1 + 7 files changed, 170 insertions(+), 105 deletions(-) delete mode 100644 .perl-XML-Parser.metadata delete mode 100644 SOURCES/XML-Parser-2.44_01-Fix-a-buffer-overwrite-in-parse_stream.patch rename SOURCES/XML-Parser-2.48-CVE-2006-10002.patch => XML-Parser-2.48-CVE-2006-10002.patch (100%) rename SOURCES/XML-Parser-2.48-CVE-2006-10003.patch => XML-Parser-2.48-CVE-2006-10003.patch (100%) rename SPECS/perl-XML-Parser.spec => perl-XML-Parser.spec (60%) create mode 100644 sources diff --git a/.gitignore b/.gitignore index adde423..e8e1992 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/XML-Parser-2.44.tar.gz +XML-Parser-2.47.tar.gz diff --git a/.perl-XML-Parser.metadata b/.perl-XML-Parser.metadata deleted file mode 100644 index 8a6e298..0000000 --- a/.perl-XML-Parser.metadata +++ /dev/null @@ -1 +0,0 @@ -0ab6b932713ec1f9927a1b1c619b6889a5c12849 SOURCES/XML-Parser-2.44.tar.gz diff --git a/SOURCES/XML-Parser-2.44_01-Fix-a-buffer-overwrite-in-parse_stream.patch b/SOURCES/XML-Parser-2.44_01-Fix-a-buffer-overwrite-in-parse_stream.patch deleted file mode 100644 index 4e2e0bc..0000000 --- a/SOURCES/XML-Parser-2.44_01-Fix-a-buffer-overwrite-in-parse_stream.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 53e71571fc0b1f8dbad5f7ff6e9eeeb233496c13 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= -Date: Thu, 13 Dec 2018 13:05:07 +0100 -Subject: [PATCH] Fix a buffer overwrite in parse_stream() - -The parse_stream() function allocates BUFSIZE-byte long output buffer. Then it -reads a string using PerlIO's read() with a maximal string length tsiz=BUFSIZE -characters into a temporary buffer. And then it retrieves a length of the string -in the temporary buffer in bytes and copies the strings from the temporary -buffer to the output buffer. - -While it works for byte-stream file handles, when using UTF-8 handles, length -in bytes can be greater than length in characters, thus the temporary buffer -can contain more bytes than the size of the output buffer and we have a buffer -overwrite. This corrupts memory, especially metadata for libc memory -management and subsequent free() aborts with "free(): invalid next size -(normal)". - -Minimal reproducer: Execute this code with an UTF-8 encoded file with non-ASCII -charcters on the standard input: - -use XML::XPath; -use open ':std', ':encoding(UTF-8)'; -my $xpath = XML::XPath->new(ioref => \*STDIN); -$xpath->find('/'); - -https://bugzilla.redhat.com/show_bug.cgi?id=1473368 -https://bugzilla.redhat.com/show_bug.cgi?id=1658512 ---- - Expat/Expat.xs | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/Expat/Expat.xs b/Expat/Expat.xs -index ed66531..dbad380 100644 ---- a/Expat/Expat.xs -+++ b/Expat/Expat.xs -@@ -343,8 +343,8 @@ parse_stream(XML_Parser parser, SV * ioref) - } - else { - tbuff = newSV(0); -- tsiz = newSViv(BUFSIZE); -- buffsize = BUFSIZE; -+ tsiz = newSViv(BUFSIZE); /* in UTF-8 characters */ -+ buffsize = BUFSIZE * 6; /* in bytes that encode an UTF-8 string */ - } - - while (! done) -@@ -386,9 +386,11 @@ parse_stream(XML_Parser parser, SV * ioref) - croak("read error"); - - tb = SvPV(tbuff, br); -- if (br > 0) -+ if (br > 0) { -+ if (br > buffsize) -+ croak("The input buffer is not large enough for read UTF-8 decoded string"); - Copy(tb, buffer, br, char); -- else -+ } else - done = 1; - - PUTBACK ; --- -2.18.1 - diff --git a/SOURCES/XML-Parser-2.48-CVE-2006-10002.patch b/XML-Parser-2.48-CVE-2006-10002.patch similarity index 100% rename from SOURCES/XML-Parser-2.48-CVE-2006-10002.patch rename to XML-Parser-2.48-CVE-2006-10002.patch diff --git a/SOURCES/XML-Parser-2.48-CVE-2006-10003.patch b/XML-Parser-2.48-CVE-2006-10003.patch similarity index 100% rename from SOURCES/XML-Parser-2.48-CVE-2006-10003.patch rename to XML-Parser-2.48-CVE-2006-10003.patch diff --git a/SPECS/perl-XML-Parser.spec b/perl-XML-Parser.spec similarity index 60% rename from SPECS/perl-XML-Parser.spec rename to perl-XML-Parser.spec index edbdbb3..2289ebe 100644 --- a/SPECS/perl-XML-Parser.spec +++ b/perl-XML-Parser.spec @@ -1,52 +1,59 @@ Name: perl-XML-Parser -Version: 2.44 -Release: 12%{?dist} +Version: 2.47 +Release: 6.1.0.1%{?dist} Summary: Perl module for parsing XML documents -Group: Development/Libraries -License: GPL+ or Artistic -Url: http://search.cpan.org/dist/XML-Parser/ -Source0: http://search.cpan.org/CPAN/authors/id/T/TO/TODDR/XML-Parser-%{version}.tar.gz -# Fix a buffer overwrite in parse_stream() with wide characters on the standard -# input, bug #1658512, CPAN RT#128006 -Patch0: XML-Parser-2.44_01-Fix-a-buffer-overwrite-in-parse_stream.patch +License: Artistic-2.0 +Url: https://metacpan.org/release/XML-Parser +Source0: https://cpan.metacpan.org/authors/id/T/TO/TODDR/XML-Parser-%{version}.tar.gz # Fix buffer overflow in parse_stream when filehandle has :utf8 # CVE-2006-10002 -Patch1: XML-Parser-2.48-CVE-2006-10002.patch +Patch0: XML-Parser-2.48-CVE-2006-10002.patch # Fix off-by-one heap buffer overflow in st_serial_stack growth check # CVE-2006-10003 -Patch2: XML-Parser-2.48-CVE-2006-10003.patch +Patch1: XML-Parser-2.48-CVE-2006-10003.patch +# Build +BuildRequires: coreutils +BuildRequires: expat-devel +BuildRequires: findutils +BuildRequires: gcc +BuildRequires: glibc-common BuildRequires: make BuildRequires: perl-devel BuildRequires: perl-generators BuildRequires: perl-interpreter -BuildRequires: perl(Carp) BuildRequires: perl(Config) -BuildRequires: perl(Devel::CheckLib) -BuildRequires: perl(DynaLoader) -BuildRequires: perl(ExtUtils::MakeMaker) +BuildRequires: perl(Devel::CheckLib) >= 1.16 +BuildRequires: perl(English) +BuildRequires: perl(ExtUtils::MakeMaker) >= 6.76 +BuildRequires: perl(lib) +# Runtime +BuildRequires: perl(Carp) BuildRequires: perl(FileHandle) -BuildRequires: perl(File::Temp) +BuildRequires: perl(File::Spec) BuildRequires: perl(if) BuildRequires: perl(IO::File) BuildRequires: perl(IO::Handle) -BuildRequires: perl(lib) +# LWPExternEnt.pl script is loaded by Parser.pm +BuildRequires: perl(LWP::UserAgent) BuildRequires: perl(overload) BuildRequires: perl(strict) -BuildRequires: perl(Test) -BuildRequires: perl(Test::More) -BuildRequires: perl(vars) -BuildRequires: perl(warnings) -BuildRequires: expat-devel -# The script LWPExternEnt.pl is loaded by Parser.pm -BuildRequires: perl(LWP::UserAgent) BuildRequires: perl(URI) BuildRequires: perl(URI::file) -Requires: perl(:MODULE_COMPAT_%(eval "`perl -V:version`"; echo $version)) +BuildRequires: perl(XSLoader) +# Tests +BuildRequires: perl(File::Temp) +BuildRequires: perl(if) +BuildRequires: perl(Test) +BuildRequires: perl(Test::More) +BuildRequires: perl(warnings) Requires: perl(IO::File) Requires: perl(IO::Handle) - +Requires: perl(LWP::UserAgent) +Requires: perl(LWP) +Requires: perl(URI) +Requires: perl(URI::file) %{?perl_default_filter} %global __provides_exclude %{?__provides_exclude:%__provides_exclude|}perl\\(XML::Parser\\)$ @@ -62,51 +69,173 @@ parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time. +%package tests +Summary: Tests for %{name} +Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release} +Requires: perl-Test-Harness + +%description tests +Tests from %{name}. Execute them +with "%{_libexecdir}/%{name}/test". + %prep %setup -q -n XML-Parser-%{version} %patch -P0 -p1 %patch -P1 -p1 -%patch -P2 -p1 chmod 644 samples/{canonical,xml*} -perl -pi -e 's|^#!/usr/local/bin/perl\b|#!%{__perl}|' samples/{canonical,xml*} +perl -MConfig -pi -e 's|^#!/usr/local/bin/perl\b|$Config{startperl}|' samples/{canonical,xml*} # Remove bundled library rm -r inc perl -i -ne 'print $_ unless m{^inc/}' MANIFEST +# Help generators to recognize Perl scripts +for F in t/*.t; do + perl -i -MConfig -ple 'print $Config{startperl} if $. == 1 && !s{\A#!.*perl\b}{$Config{startperl}}' "$F" + chmod +x "$F" +done + %build -CFLAGS="$RPM_OPT_FLAGS" perl Makefile.PL INSTALLDIRS=vendor -make %{?_smp_mflags} OPTIMIZE="$RPM_OPT_FLAGS" +perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 NO_PERLLOCAL=1 OPTIMIZE="$RPM_OPT_FLAGS" +%{make_build} %install -make pure_install DESTDIR=$RPM_BUILD_ROOT -find $RPM_BUILD_ROOT -type f -name .packlist -exec rm -f {} ';' -find $RPM_BUILD_ROOT -type f -name '*.bs' -a -size 0 -exec rm -f {} ';' -chmod -R u+w $RPM_BUILD_ROOT/* +%{make_install} +find $RPM_BUILD_ROOT -type f -name '*.bs' -a -size 0 -delete +%{_fixperms} $RPM_BUILD_ROOT/* for file in samples/REC-xml-19980210.xml; do iconv -f iso-8859-1 -t utf-8 < "$file" > "${file}_" mv -f "${file}_" "$file" - sed -i -e "s/encoding='ISO-8859-1'/encoding='UTF-8'/" "$file" + perl -i -pe "s/encoding='ISO-8859-1'/encoding='UTF-8'/" "$file" done +# Install tests +mkdir -p %{buildroot}%{_libexecdir}/%{name} +cp -a t samples %{buildroot}%{_libexecdir}/%{name} +cat > %{buildroot}%{_libexecdir}/%{name}/test << 'EOF' +#!/bin/bash +set -e +# Some tests write into temporary files/directories. The easiest solution +# is to copy the tests into a writable directory and execute them from there. +DIR=$(mktemp -d) +pushd "$DIR" +cp -a %{_libexecdir}/%{name}/* ./ +prove -I . -j "$(getconf _NPROCESSORS_ONLN)" +popd +rm -rf "$DIR" +EOF +chmod +x %{buildroot}%{_libexecdir}/%{name}/test + %check +export HARNESS_OPTIONS=j$(perl -e 'if ($ARGV[0] =~ /.*-j([0-9][0-9]*).*/) {print $1} else {print 1}' -- '%{?_smp_mflags}') make test %files %doc README Changes samples/ +%license LICENSE %{perl_vendorarch}/XML/ %{perl_vendorarch}/auto/XML/ -%{_mandir}/man3/*.3* +%{_mandir}/man3/XML::Parser*.3* +%files tests +%{_libexecdir}/%{name} %changelog -* Thu Mar 26 2026 Jitka Plesnikova - 2.44-12 +* Mon Apr 13 2026 EL Errata - 2.47-6.1.0.1 +- Add perl(LWP) Requires + +* Fri Mar 27 2026 Jitka Plesnikova - 2.47-6.1 - Fix CVE-2006-10002, CVE-2006-10003 -* Thu Dec 13 2018 Petr Pisar - 2.44-11 +* Tue Oct 29 2024 Troy Dawson - 2.47-6 +- Bump release for October 2024 mass rebuild: + Resolves: RHEL-64018 + +* Thu Aug 08 2024 Troy Dawson - 2.47-5 +- Bump release for Aug 2024 java mass rebuild + +* Mon Jun 24 2024 Troy Dawson - 2.47-4 +- Bump release for June 2024 mass rebuild + +* Thu Jan 25 2024 Fedora Release Engineering - 2.47-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sun Jan 21 2024 Fedora Release Engineering - 2.47-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Tue Jan 02 2024 Jitka Plesnikova - 2.47-1 +- 2.47 bump (rhbz#2256150) + +* Wed Sep 20 2023 Jitka Plesnikova - 2.46-16 +- Package tests + +* Fri Jul 21 2023 Fedora Release Engineering - 2.46-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue Jul 11 2023 Jitka Plesnikova - 2.46-14 +- Perl 5.38 rebuild + +* Fri Jan 20 2023 Fedora Release Engineering - 2.46-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Fri Jul 22 2022 Fedora Release Engineering - 2.46-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Tue May 31 2022 Jitka Plesnikova - 2.46-11 +- Perl 5.36 rebuild + +* Fri Jan 21 2022 Fedora Release Engineering - 2.46-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Fri Jul 23 2021 Fedora Release Engineering - 2.46-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Fri May 21 2021 Jitka Plesnikova - 2.46-8 +- Perl 5.34 rebuild + +* Wed Jan 27 2021 Fedora Release Engineering - 2.46-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Tue Jul 28 2020 Fedora Release Engineering - 2.46-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 21 2020 Petr Pisar - 2.46-5 +- Modernize a spec file + +* Tue Jun 23 2020 Jitka Plesnikova - 2.46-4 +- Perl 5.32 rebuild + +* Tue Mar 10 2020 Jitka Plesnikova - 2.46-3 +- Specify all dependencies + +* Thu Jan 30 2020 Fedora Release Engineering - 2.46-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Tue Sep 24 2019 Jitka Plesnikova - 2.46-1 +- 2.46 bump + +* Fri Jul 26 2019 Fedora Release Engineering - 2.44-17 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Fri May 31 2019 Jitka Plesnikova - 2.44-16 +- Perl 5.30 rebuild + +* Sat Feb 02 2019 Fedora Release Engineering - 2.44-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Dec 13 2018 Petr Pisar - 2.44-14 - Fix a buffer overwrite in parse_stream() with wide characters on the standard - input (bug #1658512) + input (bug #1473368) + +* Mon Jul 23 2018 Jitka Plesnikova - 2.44-13 +- Specify all dependencies + +* Fri Jul 13 2018 Fedora Release Engineering - 2.44-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri Jun 29 2018 Jitka Plesnikova - 2.44-11 +- Perl 5.28 rebuild * Fri Feb 09 2018 Fedora Release Engineering - 2.44-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild diff --git a/sources b/sources new file mode 100644 index 0000000..8c14121 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (XML-Parser-2.47.tar.gz) = 3f9de53341bc85b87c88ad31e04b13f1f95516eec0d7e5fd1c1a3b3e66a91ca3d4de7c649978599219a4d4372f6218764ab5e1805b7155b5ca200006e1b0908f