Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package perl-XML-Bare for openSUSE:Factory 
checked in at 2026-07-23 23:08:22
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-XML-Bare (Old)
 and      /work/SRC/openSUSE:Factory/.perl-XML-Bare.new.2004 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "perl-XML-Bare"

Thu Jul 23 23:08:22 2026 rev:30 rq:1366830 version:0.53

Changes:
--------
--- /work/SRC/openSUSE:Factory/perl-XML-Bare/perl-XML-Bare.changes      
2024-03-07 18:27:51.617568622 +0100
+++ /work/SRC/openSUSE:Factory/.perl-XML-Bare.new.2004/perl-XML-Bare.changes    
2026-07-23 23:08:32.864506686 +0200
@@ -1,0 +2,11 @@
+Mon Jul 20 18:29:37 UTC 2026 - Tina Müller <[email protected]>
+
+- Add CVE-2026-57074-r1.patch (CVE-2026-57074, bsc#1271637)
+
+-------------------------------------------------------------------
+Mon Jul 20 17:49:38 UTC 2026 - Tina Müller <[email protected]>
+
+- Add CVE-2026-13401-r1.patch (CVE-2026-13401, bsc#1271640)
+- Add cpanspec.yml for overriding spec values
+
+-------------------------------------------------------------------

New:
----
  CVE-2026-13401-r1.patch
  CVE-2026-57074-r1.patch
  README.md
  _scmsync.obsinfo
  build.specials.obscpio
  cpanspec.yml

----------(New B)----------
  New:
- Add CVE-2026-13401-r1.patch (CVE-2026-13401, bsc#1271640)
- Add cpanspec.yml for overriding spec values
  New:
- Add CVE-2026-57074-r1.patch (CVE-2026-57074, bsc#1271637)
----------(New E)----------

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ perl-XML-Bare.spec ++++++
--- /var/tmp/diff_new_pack.tHENs4/_old  2026-07-23 23:08:35.128585719 +0200
+++ /var/tmp/diff_new_pack.tHENs4/_new  2026-07-23 23:08:35.164586976 +0200
@@ -1,7 +1,7 @@
 #
 # spec file for package perl-XML-Bare
 #
-# Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany.
+# Copyright (c) 2026 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -12,21 +12,25 @@
 # license that conforms to the Open Source Definition (Version 1.9)
 # published by the Open Source Initiative.
 
-# Please submit bugfixes or comments via http://bugs.opensuse.org/
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
 #
 
 
+%define cpan_name XML-Bare
 Name:           perl-XML-Bare
 Version:        0.53
 Release:        0
-%define cpan_name XML-Bare
-Summary:        Minimal XML parser implemented via a C state engine
-License:        Artistic-1.0 or GPL-1.0+
-Group:          Development/Libraries/Perl
-Url:            http://search.cpan.org/dist/XML-Bare/
-Source:         
http://www.cpan.org/authors/id/C/CO/CODECHILD/%{cpan_name}-%{version}.tar.gz
-Patch0:         fix-pointers.diff
-BuildRoot:      %{_tmppath}/%{name}-%{version}-build
+License:        Artistic-1.0 OR GPL-1.0-or-later
+Summary:        Minimal XML parser / schema checker / pretty-printer using C 
internally
+URL:            https://metacpan.org/release/%{cpan_name}
+Source0:        
https://cpan.metacpan.org/authors/id/C/CO/CODECHILD/%{cpan_name}-%{version}.tar.gz
+Source1:        cpanspec.yml
+Source100:      README.md
+# PATCH-FIX-UPSTREAM https://github.com/nanoscopic/perl-XML-Bare/pull/2
+Patch0:         CVE-2026-13401-r1.patch
+# PATCH-FIX-UPSTREAM https://github.com/nanoscopic/perl-XML-Bare/pull/1
+Patch1:         CVE-2026-57074-r1.patch
+Patch2:         fix-pointers.diff
 BuildRequires:  perl
 BuildRequires:  perl-macros
 BuildRequires:  perl(Test::More) >= 0.94
@@ -49,15 +53,16 @@
 expressions.
 
 %prep
-%autosetup -p1 -n %{cpan_name}-%{version}
-find . -type f -print0 | xargs -0 chmod 644
+%autosetup -n %{cpan_name}-%{version} -p1
+
+find . -type f ! -path "*/t/*" ! -name "*.pl" ! -path "*/bin/*" ! -path 
"*/script/*" ! -path "*/scripts/*" ! -name "configure" -print0 | xargs -0 chmod 
644
 
 %build
-%{__perl} Makefile.PL INSTALLDIRS=vendor OPTIMIZE="%{optflags}"
-%{__make} %{?_smp_mflags}
+perl Makefile.PL INSTALLDIRS=vendor OPTIMIZE="%{optflags}"
+%make_build
 
 %check
-%{__make} test
+make test
 
 %install
 %perl_make_install
@@ -65,6 +70,5 @@
 %perl_gen_filelist
 
 %files -f %{name}.files
-%defattr(-,root,root,755)
 %doc Changes README
 

++++++ CVE-2026-13401-r1.patch ++++++
From: CPANSec Security Scanner Bot <[email protected]>
Subject: [PATCH] XML::Bare: advance stuck attribute-name state (infinite loop)

Infinite loop (CWE-835) in the hand-rolled C parser (parser.c), reached
by the default XML::Bare->new(text=>$xml)->parse on untrusted XML.

The `att_nameqsdone` state — reached after a single-quoted attribute
*name* — loops back to itself without advancing `cpos` on any character
other than `=` or NUL, spinning forever in C on malformed input. The
parser holds the interpreter for the duration of the call, so no
Perl-level signal (`alarm`, etc.) can interrupt it: a single request
pins a CPU indefinitely. Triggers: `<a ='c'>`, `<a b='''''''c'>`,
`<x y=''''''z'>`.

Fix: advance the cursor before looping, so the scan terminates at the
next `=` or at the NUL sentinel (already handled by the `case 0` branch).
--- a/parser.c
+++ b/parser.c
@@ -484,6 +485,7 @@
           cpos++;
           goto att_eq1;
       }
+      cpos++; // advance the cursor so malformed input (no '=' after a quoted 
attr name) cannot spin forever
       goto att_nameqsdone;
       
     att_eq1:

++++++ CVE-2026-57074-r1.patch ++++++
From: CPANSec Security Scanner Bot <[email protected]>
Subject: [PATCH] XML::Bare: bounds truncated fixed-advance lookahead (heap OOB 
read)

Heap-buffer-overflow READ (CWE-125) in the hand-rolled C parser
(parser.c), reached by the default XML::Bare->new(text=>$xml)->parse on
untrusted XML.

Several transitions advance `cpos` by a fixed amount past a recognised
token without checking the buffer end, then dereference the new position:

  - the `<![CDATA` match does `cpos += 9` after confirming only eight
    bytes (`<![CDATA`), so a truncated tail such as `<![CDATA\0` steps
    one byte past the NUL terminator;
  - the three "self-closing tag" branches (name_x, name_gap, att_name)
    do `cpos += 2` on the assumption that a `>` follows the `/`, so a
    truncated tail such as `<a/\0` steps past the NUL.

The subsequent `let = *cpos;` in val_1/val_x/cdata then reads out of
bounds. Trigger: `<!-- c --><a/`.

Fix: require the full `<![CDATA[` (nine bytes) before the `+= 9`, and
only skip the assumed `>` when `*(cpos+1)` is non-NUL. Both changes are
behaviour-preserving for well-formed input — real CDATA always carries
the `[`, and a non-truncated self-close always has a byte after the `/`;
they differ only on the truncated-tail case that previously overran the
allocation.
--- a/parser.c
+++ b/parser.c
@@ -193,7 +193,8 @@
                     *(cpos+4) == 'D' &&
                     *(cpos+5) == 'A' &&
                     *(cpos+6) == 'T' &&
-                    *(cpos+7) == 'A'    ) {
+                    *(cpos+7) == 'A' &&
+                    *(cpos+8) == '['    ) { // require full "<![CDATA[" so 
cpos+=9 cannot skip past a truncated tail
                   cpos += 9;
                   curnode->type = 1;
                   goto cdata;
@@ -344,7 +345,7 @@
           temp = nodec_addchildr( curnode, tagname, tagname_len );
           temp->z = cpos +1 - xmlin;
           tagname_len            = 0;
-          cpos+=2;
+          if( *(cpos+1) ) cpos += 2; else cpos++; // skip assumed '>' only if 
not the NUL terminator
           goto val_1;
       }
       
@@ -368,7 +369,7 @@
           curnode->z = cpos+1-xmlin;
           curnode = curnode->parent;
           if( !curnode ) goto done;
-          cpos+=2; // am assuming next char is >
+          if( *(cpos+1) ) cpos += 2; else cpos++; // was: assume next char is 
> (skip past NUL on truncated tail)
           goto val_1;
         case '=':
           cpos++;
@@ -425,7 +426,7 @@
           curnode->z = cpos+1-xmlin;
           curnode = curnode->parent;
           if( !curnode ) goto done;
-          cpos += 2;
+          if( *(cpos+1) ) cpos += 2; else cpos++; // "/> assumed" — skip '>' 
only if present, not the NUL
           goto val_1;
         case ' ':
           if( *(cpos+1) == '=' ) {

++++++ README.md ++++++

## Build Results

Current state of perl in openSUSE:Factory is

![Factory build 
results](https://br.opensuse.org/status/openSUSE:Factory/perl-XML-Bare/standard)

The current state of perl in the devel project build (devel:languages:perl)

![Devel project build 
results](https://br.opensuse.org/status/devel:languages:perl/perl-XML-Bare)



++++++ _scmsync.obsinfo ++++++
mtime: 1784572197
commit: 1b19042aec0994cb1163175d68806b622f7fdde94f2a137c5ed10af40a4f312c
url: https://src.opensuse.org/perl/perl-XML-Bare
revision: 1b19042aec0994cb1163175d68806b622f7fdde94f2a137c5ed10af40a4f312c
projectscmsync: https://src.opensuse.org/perl/_ObsPrj

++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore      1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore      2026-07-20 20:29:57.000000000 +0200
@@ -0,0 +1 @@
+.osc

++++++ cpanspec.yml ++++++
---
#description_paragraphs: 3
#description: |-
#  override description from CPAN
#summary: override summary from CPAN
#no_testing: broken upstream
#sources:
#  - source1
#  - source2
patches:
  fix-pointers.diff: -p1
  CVE-2026-57074-r1.patch: -p1 PATCH-FIX-UPSTREAM 
https://github.com/nanoscopic/perl-XML-Bare/pull/1
  CVE-2026-13401-r1.patch: -p1 PATCH-FIX-UPSTREAM 
https://github.com/nanoscopic/perl-XML-Bare/pull/2
#  bar.patch:
#  baz.patch: PATCH-FIX-OPENSUSE
#preamble: |-
# BuildRequires:  gcc-c++
#post_prep: |-
# hunspell=`pkg-config --libs hunspell | sed -e 's,-l,,; s,  *,,g'`
# sed -i -e "s,hunspell-X,$hunspell," t/00-prereq.t Makefile.PL
#post_build: |-
# rm unused.files
#post_install: |-
# sed on %{name}.files
#license: SUSE-NonFree
#skip_noarch: 1
#custom_build: |-
#./Build build flags=%{?_smp_mflags} --myflag
#custom_test: |-
#startserver && make test
#ignore_requires: Bizarre::Module
#ignore_provides: Module::To::Ignore
#skip_doc: regexp_to_skip_for_doc.*
#add_doc: files to add to docs
#misc: |-
#anything else to be added to spec file
#follows directly after %files section, so it can contain new blocks or also
#changes to %files section
#epoch: number
# Where module files should be searched for. Default: lib/
#index_dir:

Reply via email to