Compare commits

...

No commits in common. "c8" and "c10s" have entirely different histories.
c8 ... c10s

10 changed files with 225 additions and 101 deletions

1
.fmf/version Normal file
View File

@ -0,0 +1 @@
1

8
.gitignore vendored
View File

@ -1 +1,7 @@
SOURCES/XML-Parser-2.44.tar.gz
XML-Parser-2.36.tar.gz
/XML-Parser-2.40.tar.gz
/XML-Parser-2.41.tar.gz
/XML-Parser-2.43.tar.gz
/XML-Parser-2.44.tar.gz
/XML-Parser-2.46.tar.gz
/XML-Parser-2.47.tar.gz

View File

@ -1 +0,0 @@
0ab6b932713ec1f9927a1b1c619b6889a5c12849 SOURCES/XML-Parser-2.44.tar.gz

View File

@ -1,64 +0,0 @@
From 53e71571fc0b1f8dbad5f7ff6e9eeeb233496c13 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Thu, 13 Dec 2018 13:05:07 +0100
Subject: [PATCH] Fix a buffer overwrite in parse_stream()
The parse_stream() function allocates BUFSIZE-byte long output buffer. Then it
reads a string using PerlIO's read() with a maximal string length tsiz=BUFSIZE
characters into a temporary buffer. And then it retrieves a length of the string
in the temporary buffer in bytes and copies the strings from the temporary
buffer to the output buffer.
While it works for byte-stream file handles, when using UTF-8 handles, length
in bytes can be greater than length in characters, thus the temporary buffer
can contain more bytes than the size of the output buffer and we have a buffer
overwrite. This corrupts memory, especially metadata for libc memory
management and subsequent free() aborts with "free(): invalid next size
(normal)".
Minimal reproducer: Execute this code with an UTF-8 encoded file with non-ASCII
charcters on the standard input:
use XML::XPath;
use open ':std', ':encoding(UTF-8)';
my $xpath = XML::XPath->new(ioref => \*STDIN);
$xpath->find('/');
https://bugzilla.redhat.com/show_bug.cgi?id=1473368
https://bugzilla.redhat.com/show_bug.cgi?id=1658512
---
Expat/Expat.xs | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/Expat/Expat.xs b/Expat/Expat.xs
index ed66531..dbad380 100644
--- a/Expat/Expat.xs
+++ b/Expat/Expat.xs
@@ -343,8 +343,8 @@ parse_stream(XML_Parser parser, SV * ioref)
}
else {
tbuff = newSV(0);
- tsiz = newSViv(BUFSIZE);
- buffsize = BUFSIZE;
+ tsiz = newSViv(BUFSIZE); /* in UTF-8 characters */
+ buffsize = BUFSIZE * 6; /* in bytes that encode an UTF-8 string */
}
while (! done)
@@ -386,9 +386,11 @@ parse_stream(XML_Parser parser, SV * ioref)
croak("read error");
tb = SvPV(tbuff, br);
- if (br > 0)
+ if (br > 0) {
+ if (br > buffsize)
+ croak("The input buffer is not large enough for read UTF-8 decoded string");
Copy(tb, buffer, br, char);
- else
+ } else
done = 1;
PUTBACK ;
--
2.18.1

24
gating.yaml Normal file
View File

@ -0,0 +1,24 @@
--- !Policy
product_versions:
- fedora-*
decision_context: bodhi_update_push_testing
subject_type: koji_build
rules:
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
# Rawhide
--- !Policy
product_versions:
- fedora-*
decision_context: bodhi_update_push_stable
subject_type: koji_build
rules:
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
# RHEL
--- !Policy
product_versions:
- rhel-*
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

View File

@ -1,41 +1,51 @@
Name: perl-XML-Parser
Version: 2.44
Release: 11%{?dist}
Version: 2.47
Release: 6%{?dist}
Summary: Perl module for parsing XML documents
Group: Development/Libraries
License: GPL+ or Artistic
Url: http://search.cpan.org/dist/XML-Parser/
Source0: http://search.cpan.org/CPAN/authors/id/T/TO/TODDR/XML-Parser-%{version}.tar.gz
# Fix a buffer overwrite in parse_stream() with wide characters on the standard
# input, bug #1658512, CPAN RT#128006
Patch0: XML-Parser-2.44_01-Fix-a-buffer-overwrite-in-parse_stream.patch
License: Artistic-2.0
Url: https://metacpan.org/release/XML-Parser
Source0: https://cpan.metacpan.org/authors/id/T/TO/TODDR/XML-Parser-%{version}.tar.gz
# Build
BuildRequires: coreutils
BuildRequires: expat-devel
BuildRequires: findutils
BuildRequires: gcc
BuildRequires: glibc-common
BuildRequires: make
BuildRequires: perl-devel
BuildRequires: perl-generators
BuildRequires: perl(Carp)
BuildRequires: perl-interpreter
BuildRequires: perl(Config)
BuildRequires: perl(Devel::CheckLib)
BuildRequires: perl(ExtUtils::MakeMaker)
BuildRequires: perl(Devel::CheckLib) >= 1.16
BuildRequires: perl(English)
BuildRequires: perl(ExtUtils::MakeMaker) >= 6.76
BuildRequires: perl(lib)
# Runtime
BuildRequires: perl(Carp)
BuildRequires: perl(FileHandle)
BuildRequires: perl(File::Spec)
BuildRequires: perl(if)
BuildRequires: perl(IO::File)
BuildRequires: perl(IO::Handle)
BuildRequires: perl(lib)
BuildRequires: perl(strict)
BuildRequires: perl(Test)
BuildRequires: perl(Test::More)
BuildRequires: perl(vars)
BuildRequires: perl(warnings)
BuildRequires: expat-devel
# The script LWPExternEnt.pl is loaded by Parser.pm
# LWPExternEnt.pl script is loaded by Parser.pm
BuildRequires: perl(LWP::UserAgent)
BuildRequires: perl(overload)
BuildRequires: perl(strict)
BuildRequires: perl(URI)
BuildRequires: perl(URI::file)
Requires: perl(:MODULE_COMPAT_%(eval "`perl -V:version`"; echo $version))
BuildRequires: perl(XSLoader)
# Tests
BuildRequires: perl(if)
BuildRequires: perl(Test)
BuildRequires: perl(Test::More)
BuildRequires: perl(warnings)
Requires: perl(IO::File)
Requires: perl(IO::Handle)
Requires: perl(LWP::UserAgent)
Requires: perl(URI)
Requires: perl(URI::file)
%{?perl_default_filter}
%global __provides_exclude %{?__provides_exclude:%__provides_exclude|}perl\\(XML::Parser\\)$
@ -51,46 +61,165 @@ parse call. They can also be given as extra arguments to the parse
methods, in which case they override options given at XML::Parser
creation time.
%package tests
Summary: Tests for %{name}
Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
Requires: perl-Test-Harness
%description tests
Tests from %{name}. Execute them
with "%{_libexecdir}/%{name}/test".
%prep
%setup -q -n XML-Parser-%{version}
%patch0 -p1
chmod 644 samples/{canonical,xml*}
perl -pi -e 's|^#!/usr/local/bin/perl\b|#!%{__perl}|' samples/{canonical,xml*}
perl -MConfig -pi -e 's|^#!/usr/local/bin/perl\b|$Config{startperl}|' samples/{canonical,xml*}
# Remove bundled library
rm -r inc
sed -i -e '/^inc\// d' MANIFEST
perl -i -ne 'print $_ unless m{^inc/}' MANIFEST
# Help generators to recognize Perl scripts
for F in t/*.t; do
perl -i -MConfig -ple 'print $Config{startperl} if $. == 1 && !s{\A#!.*perl\b}{$Config{startperl}}' "$F"
chmod +x "$F"
done
%build
CFLAGS="$RPM_OPT_FLAGS" perl Makefile.PL INSTALLDIRS=vendor
make %{?_smp_mflags} OPTIMIZE="$RPM_OPT_FLAGS"
perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 NO_PERLLOCAL=1 OPTIMIZE="$RPM_OPT_FLAGS"
%{make_build}
%install
make pure_install DESTDIR=$RPM_BUILD_ROOT
find $RPM_BUILD_ROOT -type f -name .packlist -exec rm -f {} ';'
find $RPM_BUILD_ROOT -type f -name '*.bs' -a -size 0 -exec rm -f {} ';'
chmod -R u+w $RPM_BUILD_ROOT/*
%{make_install}
find $RPM_BUILD_ROOT -type f -name '*.bs' -a -size 0 -delete
%{_fixperms} $RPM_BUILD_ROOT/*
for file in samples/REC-xml-19980210.xml; do
iconv -f iso-8859-1 -t utf-8 < "$file" > "${file}_"
mv -f "${file}_" "$file"
sed -i -e "s/encoding='ISO-8859-1'/encoding='UTF-8'/" "$file"
perl -i -pe "s/encoding='ISO-8859-1'/encoding='UTF-8'/" "$file"
done
# Install tests
mkdir -p %{buildroot}%{_libexecdir}/%{name}
cp -a t samples %{buildroot}%{_libexecdir}/%{name}
cat > %{buildroot}%{_libexecdir}/%{name}/test << 'EOF'
#!/bin/bash
set -e
# Some tests write into temporary files/directories. The easiest solution
# is to copy the tests into a writable directory and execute them from there.
DIR=$(mktemp -d)
pushd "$DIR"
cp -a %{_libexecdir}/%{name}/* ./
prove -I . -j "$(getconf _NPROCESSORS_ONLN)"
popd
rm -rf "$DIR"
EOF
chmod +x %{buildroot}%{_libexecdir}/%{name}/test
%check
export HARNESS_OPTIONS=j$(perl -e 'if ($ARGV[0] =~ /.*-j([0-9][0-9]*).*/) {print $1} else {print 1}' -- '%{?_smp_mflags}')
make test
%files
%doc README Changes samples/
%license LICENSE
%{perl_vendorarch}/XML/
%{perl_vendorarch}/auto/XML/
%{_mandir}/man3/*.3*
%{_mandir}/man3/XML::Parser*.3*
%files tests
%{_libexecdir}/%{name}
%changelog
* Thu Dec 13 2018 Petr Pisar <ppisar@redhat.com> - 2.44-11
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 2.47-6
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018
* Thu Aug 08 2024 Troy Dawson <tdawson@redhat.com> - 2.47-5
- Bump release for Aug 2024 java mass rebuild
* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 2.47-4
- Bump release for June 2024 mass rebuild
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.47-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.47-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Tue Jan 02 2024 Jitka Plesnikova <jplesnik@redhat.com> - 2.47-1
- 2.47 bump (rhbz#2256150)
* Wed Sep 20 2023 Jitka Plesnikova <jplesnik@redhat.com> - 2.46-16
- Package tests
* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.46-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Tue Jul 11 2023 Jitka Plesnikova <jplesnik@redhat.com> - 2.46-14
- Perl 5.38 rebuild
* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.46-13
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.46-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Tue May 31 2022 Jitka Plesnikova <jplesnik@redhat.com> - 2.46-11
- Perl 5.36 rebuild
* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.46-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.46-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Fri May 21 2021 Jitka Plesnikova <jplesnik@redhat.com> - 2.46-8
- Perl 5.34 rebuild
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.46-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.46-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Jul 21 2020 Petr Pisar <ppisar@redhat.com> - 2.46-5
- Modernize a spec file
* Tue Jun 23 2020 Jitka Plesnikova <jplesnik@redhat.com> - 2.46-4
- Perl 5.32 rebuild
* Tue Mar 10 2020 Jitka Plesnikova <jplesnik@redhat.com> - 2.46-3
- Specify all dependencies
* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.46-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Tue Sep 24 2019 Jitka Plesnikova <jplesnik@redhat.com> - 2.46-1
- 2.46 bump
* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.44-17
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Fri May 31 2019 Jitka Plesnikova <jplesnik@redhat.com> - 2.44-16
- Perl 5.30 rebuild
* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.44-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Thu Dec 13 2018 Petr Pisar <ppisar@redhat.com> - 2.44-14
- Fix a buffer overwrite in parse_stream() with wide characters on the standard
input (bug #1658512)
input (bug #1473368)
* Mon Jul 23 2018 Jitka Plesnikova <jplesnik@redhat.com> - 2.44-13
- Specify all dependencies
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.44-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Fri Jun 29 2018 Jitka Plesnikova <jplesnik@redhat.com> - 2.44-11
- Perl 5.28 rebuild
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.44-10
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

12
plans/internal.fmf Normal file
View File

@ -0,0 +1,12 @@
summary: Private (RHEL) beakerlib tests
enabled: false
adjust:
- when: distro == rhel
enabled: true
because: private tests are accesible only within rhel pipline
discover:
- name: rhel
how: fmf
url: https://pkgs.devel.redhat.com/git/tests/perl-XML-Parser
execute:
how: tmt

5
plans/sanity.fmf Normal file
View File

@ -0,0 +1,5 @@
summary: Sanity tests
discover:
how: fmf
execute:
how: tmt

1
sources Normal file
View File

@ -0,0 +1 @@
SHA512 (XML-Parser-2.47.tar.gz) = 3f9de53341bc85b87c88ad31e04b13f1f95516eec0d7e5fd1c1a3b3e66a91ca3d4de7c649978599219a4d4372f6218764ab5e1805b7155b5ca200006e1b0908f

11
tests/upstream-tests.fmf Normal file
View File

@ -0,0 +1,11 @@
summary: Upstream tests
component: perl-XML-Parser
require: perl-XML-Parser-tests
test: /usr/libexec/perl-XML-Parser/test
enabled: true
tag:
- rhel-buildroot
adjust:
- enabled: false
when: distro < rhel-10 or distro < centos-stream-10
continue: false