Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package perl-Sereal-Decoder for
openSUSE:Factory checked in at 2026-08-19 17:57:42
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-Sereal-Decoder (Old)
and /work/SRC/openSUSE:Factory/.perl-Sereal-Decoder.new.1258 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Sereal-Decoder"
Wed Aug 19 17:57:42 2026 rev:17 rq:1371821 version:5.10.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/perl-Sereal-Decoder/perl-Sereal-Decoder.changes
2026-07-28 18:15:38.605776853 +0200
+++
/work/SRC/openSUSE:Factory/.perl-Sereal-Decoder.new.1258/perl-Sereal-Decoder.changes
2026-08-19 17:57:56.797192362 +0200
@@ -1,0 +2,15 @@
+Thu Aug 6 07:51:41 UTC 2026 - Tina Müller <[email protected]>
+
+- updated to 5.10.0 (5.010)
+ see /usr/share/doc/packages/perl-Sereal-Decoder/Changes
+
+ 5.010
+ * Reset the pending frozen-object state (thaw_av and ref_thawhash) at the
+ start of every decode. A decode that died before srl_finalize_structure
+ ran -- a truncated document, for example -- left those populated, and
the
+ next decode on the same decoder then thawed items belonging to the
failed
+ document and looked up ref_thawhash keys pointing at freed AVs. That
+ segfaulted or silently produced the wrong class.
+ See https://github.com/Sereal/Sereal/pull/316
+
+-------------------------------------------------------------------
Old:
----
Sereal-Decoder-5.009.tar.gz
New:
----
Sereal-Decoder-5.010.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Sereal-Decoder.spec ++++++
--- /var/tmp/diff_new_pack.0ULYLq/_old 2026-08-19 17:57:57.690224390 +0200
+++ /var/tmp/diff_new_pack.0ULYLq/_new 2026-08-19 17:57:57.692224462 +0200
@@ -18,10 +18,10 @@
%define cpan_name Sereal-Decoder
Name: perl-Sereal-Decoder
-Version: 5.9.0
+Version: 5.10.0
Release: 0
-# 5.009 -> normalize -> 5.9.0
-%define cpan_version 5.009
+# 5.010 -> normalize -> 5.10.0
+%define cpan_version 5.010
License: Artistic-1.0 OR GPL-1.0-or-later
Summary: Binary serialization module for Perl (decoder part)
URL: https://metacpan.org/release/%{cpan_name}
++++++ Sereal-Decoder-5.009.tar.gz -> Sereal-Decoder-5.010.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.009/Changes
new/Sereal-Decoder-5.010/Changes
--- old/Sereal-Decoder-5.009/Changes 2026-07-17 09:59:58.000000000 +0200
+++ new/Sereal-Decoder-5.010/Changes 2026-08-05 13:52:28.000000000 +0200
@@ -5,6 +5,15 @@
* of the decoder before upgrading to version 5 of the *
* encoder! *
****************************************************************
+5.010
+ * Reset the pending frozen-object state (thaw_av and ref_thawhash) at the
+ start of every decode. A decode that died before srl_finalize_structure
+ ran -- a truncated document, for example -- left those populated, and the
+ next decode on the same decoder then thawed items belonging to the failed
+ document and looked up ref_thawhash keys pointing at freed AVs. That
+ segfaulted or silently produced the wrong class.
+ See https://github.com/Sereal/Sereal/pull/316
+
5.009
* Only use Perl's C<$Config{ccflags}> when building bundled zstd on
AIX / IBM toolchains, or when C<SEREAL_ZSTD_USE_CONFIG_CCFLAGS> is
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.009/MANIFEST
new/Sereal-Decoder-5.010/MANIFEST
--- old/Sereal-Decoder-5.009/MANIFEST 2026-07-17 10:03:14.000000000 +0200
+++ new/Sereal-Decoder-5.010/MANIFEST 2026-08-05 13:53:53.000000000 +0200
@@ -138,6 +138,7 @@
t/902_bad_input.t
t/903_reentrancy.t
t/903_regr_oob_copy_shortbinary.t
+t/904_regr_thaw_state_reuse.t
t/data/corpus
t/lib/Sereal/BulkTest.pm
t/lib/Sereal/TestSet.pm
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.009/META.json
new/Sereal-Decoder-5.010/META.json
--- old/Sereal-Decoder-5.009/META.json 2026-07-17 10:03:14.000000000 +0200
+++ new/Sereal-Decoder-5.010/META.json 2026-08-05 13:53:53.000000000 +0200
@@ -60,6 +60,6 @@
"url" : "git://github.com/Sereal/Sereal.git"
}
},
- "version" : "5.009",
+ "version" : "5.010",
"x_serialization_backend" : "JSON::PP version 4.07"
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.009/META.yml
new/Sereal-Decoder-5.010/META.yml
--- old/Sereal-Decoder-5.009/META.yml 2026-07-17 10:03:14.000000000 +0200
+++ new/Sereal-Decoder-5.010/META.yml 2026-08-05 13:53:53.000000000 +0200
@@ -32,5 +32,5 @@
resources:
bugtracker: https://github.com/Sereal/Sereal/issues
repository: git://github.com/Sereal/Sereal.git
-version: '5.009'
+version: '5.010'
x_serialization_backend: 'CPAN::Meta::YAML version 0.018'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.009/lib/Sereal/Decoder/Constants.pm
new/Sereal-Decoder-5.010/lib/Sereal/Decoder/Constants.pm
--- old/Sereal-Decoder-5.009/lib/Sereal/Decoder/Constants.pm 2026-07-17
10:01:31.000000000 +0200
+++ new/Sereal-Decoder-5.010/lib/Sereal/Decoder/Constants.pm 2026-08-05
13:52:37.000000000 +0200
@@ -4,7 +4,7 @@
require Exporter;
our @ISA = qw(Exporter);
-our $VERSION = '5.009';
+our $VERSION = '5.010';
our ( @EXPORT_OK, %DEFINE, %TAG_INFO_HASH, @TAG_INFO_ARRAY );
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.009/lib/Sereal/Decoder.pm
new/Sereal-Decoder-5.010/lib/Sereal/Decoder.pm
--- old/Sereal-Decoder-5.009/lib/Sereal/Decoder.pm 2026-07-17
10:01:31.000000000 +0200
+++ new/Sereal-Decoder-5.010/lib/Sereal/Decoder.pm 2026-08-05
13:52:37.000000000 +0200
@@ -5,7 +5,7 @@
use Carp qw/croak/;
use XSLoader;
-our $VERSION = '5.009';
+our $VERSION = '5.010';
our $XS_VERSION = $VERSION; $VERSION = eval $VERSION;
use Exporter 'import';
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.009/srl_decoder.c
new/Sereal-Decoder-5.010/srl_decoder.c
--- old/Sereal-Decoder-5.009/srl_decoder.c 2026-07-10 12:47:32.000000000
+0200
+++ new/Sereal-Decoder-5.010/srl_decoder.c 2026-08-05 13:47:13.000000000
+0200
@@ -106,6 +106,7 @@
SRL_STATIC_INLINE void srl_read_single_value(pTHX_ srl_decoder_t *dec, SV*
into, SV** container); /* main recursive dump routine */
SRL_STATIC_INLINE void srl_finalize_structure(pTHX_ srl_decoder_t *dec);
/* optional finalize structure logic */
SRL_STATIC_INLINE void srl_clear_decoder(pTHX_ srl_decoder_t *dec);
/* clean up decoder after a dump */
+SRL_STATIC_INLINE void srl_clear_thaw_state(pTHX_ srl_decoder_t *dec);
/* discard pending frozen-object state */
/* the internal routines to handle each kind of object we have to deserialize
*/
SRL_STATIC_INLINE void srl_read_copy(pTHX_ srl_decoder_t *dec, SV* into);
@@ -618,9 +619,36 @@
PTABLE_clear(dec->ref_bless_av);
}
+ srl_clear_thaw_state(aTHX_ dec);
+
dec->recursion_depth = 0;
}
+/* Discard the pending frozen-object bookkeeping.
+ *
+ * thaw_av holds the frozen items awaiting a THAW call, and ref_thawhash maps
the
+ * address of each frozen item's argument AV to its class stash (see the
+ * PTABLE_store in srl_read_frozen_object). Both are consumed by
+ * srl_finalize_structure, which frees those argument AVs as it goes.
+ *
+ * Neither may survive into another document. An entry left in ref_thawhash is
+ * keyed on an address perl is free to recycle, so a later PTABLE_find can
match
+ * an unrelated AV and hand back a stale class stash -- or a mortal info AV
that
+ * died documents ago. An item left in thaw_av gets thawed as part of the
*next*
+ * document, operating on an SV that belongs to the previous one.
+ *
+ * Both happen in practice when a decode dies before reaching finalize, e.g.
on a
+ * truncated document: srl_read_frozen_object has already pushed onto thaw_av
by
+ * the time the buffer runs out. */
+SRL_STATIC_INLINE void
+srl_clear_thaw_state(pTHX_ srl_decoder_t *dec)
+{
+ if (dec->ref_thawhash)
+ PTABLE_clear(dec->ref_thawhash);
+ if (dec->thaw_av)
+ av_clear(dec->thaw_av);
+}
+
SRL_STATIC_INLINE srl_decoder_t *
srl_begin_decoding(pTHX_ srl_decoder_t *dec, SV *src, UV start_offset)
{
@@ -642,6 +670,14 @@
/* Set to being in use. */;
SRL_DEC_SET_OPTION(dec, SRL_F_DECODER_DIRTY);
+ /* Start from a clean slate regardless of how the previous decode on this
+ * decoder ended. srl_clear_decoder() returns early when buf.start ==
+ * buf.end, so cleanup on the way out is not guaranteed to have run -- and
+ * after a croak there may have been no cleanup at all. Leftover
frozen-object
+ * state is not merely stale, it is a use-after-free waiting to happen
+ * (see srl_clear_thaw_state). */
+ srl_clear_thaw_state(aTHX_ dec);
+
/* Register our structure for destruction on scope exit */
SAVEDESTRUCTOR_X(&srl_decoder_destructor_hook, (void *)dec);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Sereal-Decoder-5.009/t/904_regr_thaw_state_reuse.t
new/Sereal-Decoder-5.010/t/904_regr_thaw_state_reuse.t
--- old/Sereal-Decoder-5.009/t/904_regr_thaw_state_reuse.t 1970-01-01
01:00:00.000000000 +0100
+++ new/Sereal-Decoder-5.010/t/904_regr_thaw_state_reuse.t 2026-08-05
13:47:13.000000000 +0200
@@ -0,0 +1,86 @@
+#!perl
+use strict;
+use warnings;
+use Test::More;
+use File::Spec;
+use lib File::Spec->catdir(qw(t lib));
+
+BEGIN {
+ lib->import('lib')
+ if !-d 't';
+}
+
+use Sereal::Decoder;
+use Test::Warn;
+
+# Regression test: a decoder reused after a failed decode of a document
+# containing a FREEZE'd object.
+#
+# srl_read_frozen_object() pushes the item onto dec->thaw_av and records the
+# address of its argument AV in dec->ref_thawhash. Both are consumed later, by
+# srl_finalize_structure(). If the decode dies in between -- e.g. on a
truncated
+# document -- finalize never runs, so those entries survive.
+#
+# srl_clear_decoder_body_state() used to reset ref_seenhash, ref_stashes and
+# ref_bless_av but not thaw_av or ref_thawhash, so the leftovers were still
there
+# for the next document. The next decode that needed finalizing would then walk
+# the previous document's thaw_av entries and look up ref_thawhash keys that
point
+# at long-freed AVs, which segfaults or silently returns the wrong class.
+#
+# Before the fix this file dies with SIGSEGV rather than failing an assertion,
+# because perl cannot trap that.
+
+# Documents are hardcoded, as in t/901_regr_segv.t, so this test does not need
+# Sereal::Encoder. Both were produced with freeze_callbacks enabled:
+# frozen: { a => bless(\"secret", "Frz") }
+# good: { b => bless(\"other", "Frz"), c => "plain" }
+my $frozen_doc = "=\xf3rl\x05\x00Qaa2cFrz\x28\x2b\x01fsecret";
+my $good_doc = "=\xf3rl\x05\x00Raceplainab2cFrz\x28\x2b\x01eother";
+
+{
+ package Frz;
+ sub THAW {
+ my ($class, $serializer, $data) = @_;
+ return bless \$data, 'Thawed';
+ }
+}
+
+sub check_good {
+ my ($out, $label) = @_;
+ return 0 unless ok(ref($out) eq 'HASH', "$label: decoded a hash");
+ my $ok = 1;
+ $ok &&= is(ref($out->{b}), 'Thawed', "$label: frozen value was thawed");
+ $ok &&= is(${ $out->{b} // \'' }, 'other', "$label: thawed value is
intact");
+ $ok &&= is($out->{c}, 'plain', "$label: sibling value is intact");
+ return $ok;
+}
+
+# Control: the good document on its own decodes correctly.
+check_good(Sereal::Decoder->new->decode($good_doc), "virgin decoder");
+
+# Every truncation that makes the decode fail must leave the decoder clean
enough
+# to handle the next document. Sweeping rather than picking one offset keeps
this
+# robust if the document layout ever changes.
+my $swept = 0;
+for my $cut (6 .. length($frozen_doc) - 1) {
+ my $decoder = Sereal::Decoder->new;
+
+ my $died = !eval { $decoder->decode(substr($frozen_doc, 0, $cut)); 1 };
+ next unless $died; # only interested in cuts that actually fail
+ $swept++;
+
+ my $out;
+ warnings_are {
+ eval { $out = $decoder->decode($good_doc); 1 }
+ or diag("reuse after a failed decode threw: $@");
+ }
+ [], "cut=$cut: reusing the decoder produces no warnings";
+
+ check_good($out, "cut=$cut");
+}
+
+ok($swept > 0, "at least one truncation failed to decode (swept $swept)");
+
+pass("Alive");
+
+done_testing();
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.0ULYLq/_old 2026-08-19 17:57:57.943233464 +0200
+++ /var/tmp/diff_new_pack.0ULYLq/_new 2026-08-19 17:57:57.947233607 +0200
@@ -1,6 +1,6 @@
-mtime: 1784358800
-commit: 1a383fc7b74d83fcc8a802d4d2c6855fce453bb89eff897c95d695cd08e8d8c9
+mtime: 1786002702
+commit: 6831bed12e6978beeba75828f6f11ff7100a2f1fcc06313ccb16bb77a44fc4f1
url: https://src.opensuse.org/perl/perl-Sereal-Decoder
-revision: 1a383fc7b74d83fcc8a802d4d2c6855fce453bb89eff897c95d695cd08e8d8c9
+revision: 6831bed12e6978beeba75828f6f11ff7100a2f1fcc06313ccb16bb77a44fc4f1
projectscmsync: https://src.opensuse.org/perl/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-08-06 09:51:42.000000000 +0200
@@ -0,0 +1 @@
+.osc
