Your message dated Thu, 30 Nov 2023 20:52:39 +0000
with message-id <[email protected]>
and subject line Bug#1051427: fixed in perl 5.38.2-1
has caused the Debian Bug report #1051427,
regarding perl: libperl symbols for strlcat and strlcpy lost with glibc 2.38
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1051427: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051427
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: perl
Version: 5.36.0-7
Severity: important
Tags: ftbfs patch
As noticed by Ubuntu and reported by doko on IRC, this package fails to
build from source with glibc 2.38 (currently in experimental.)
dpkg-gensymbols: error: some symbols or patterns disappeared in the symbols
file: see diff output below
dpkg-gensymbols: warning: debian/libperl5.36/DEBIAN/symbols doesn't match
completely debian/libperl5.36.symbols
--- debian/libperl5.36.symbols (libperl5.36_5.36.0-8_amd64)
+++ dpkg-gensymbolszhalIX 2023-09-07 18:42:16.688071199 +0000
@@ -925,8 +925,8 @@
Perl_my_stat_flags@Base 5.36.0
Perl_my_strerror@Base 5.36.0
Perl_my_strftime@Base 5.36.0
- Perl_my_strlcat@Base 5.36.0
- Perl_my_strlcpy@Base 5.36.0
+#MISSING: 5.36.0-8# Perl_my_strlcat@Base 5.36.0
+#MISSING: 5.36.0-8# Perl_my_strlcpy@Base 5.36.0
Perl_my_strtod@Base 5.36.0
Perl_my_unexec@Base 5.36.0
Perl_my_vsnprintf@Base 5.36.0
This is because glibc added strlcpy and strlcat in
https://sourceware.org/git/?p=glibc.git;a=commit;h=454a20c8756c9c1d55419153255fc7692b3d2199
so the Configure script now detects them and disables the replacement
implementations inside src:perl, losing the corresponding libperl symbols
in the process.
I suspect nothing external actually uses the lost symbols, but it's best
to be on the safe side. The attached patch tells Configure to ignore
the new glibc functions, so that libperl keeps binary compatibility.
We will need this for whichever version of perl is in sid when glibc
2.38 enters it. I'll upload it soon for 5.36, and see what to do
with 5.38 when the transition is ready to start.
--
Niko Tyni [email protected]
>From edd4457e4f61460f32a04c566e1da68dcf238d98 Mon Sep 17 00:00:00 2001
From: Niko Tyni <[email protected]>
Date: Thu, 7 Sep 2023 19:16:29 +0100
Subject: [PATCH] Explicitly do not use strlcpy and strlcat from glibc 2.38
This keeps libperl symbols stable
---
debian/config.debian | 2 ++
1 file changed, 2 insertions(+)
diff --git a/debian/config.debian b/debian/config.debian
index 7afc379e7..300416ae2 100644
--- a/debian/config.debian
+++ b/debian/config.debian
@@ -119,6 +119,8 @@ then
-Ui_libutil \
-Ui_xlocale \
-Uversiononly \
+ -Ud_strlcpy \
+ -Ud_strlcat \
-DDEBUGGING=$debugging \
-Doptimize=\"$optimize\" \
$extra_path \
--
2.39.1
--- End Message ---
--- Begin Message ---
Source: perl
Source-Version: 5.38.2-1
Done: Niko Tyni <[email protected]>
We believe that the bug you reported is fixed in the latest version of
perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Niko Tyni <[email protected]> (supplier of updated perl package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 30 Nov 2023 20:28:47 +0200
Source: perl
Architecture: source
Version: 5.38.2-1
Distribution: experimental
Urgency: medium
Maintainer: Niko Tyni <[email protected]>
Changed-By: Niko Tyni <[email protected]>
Closes: 1051427 1055109 1056746
Changes:
perl (5.38.2-1) experimental; urgency=medium
.
* Update to new upstream version 5.38.2.
+ [SECURITY] CVE-2023-47038: Write past buffer end via illegal
user-defined Unicode property. (Closes: #1056746)
* Restore optimization level of op.c and opmini.c on hppa and sh4.
Many thanks to John David Anglin. (Closes: #1055109)
* Build depend on libc6-dev (>= 2.37-8) on ppc64el for correct F_GETLK
et al. (See #1050592)
* Explicitly do not use strlcpy and strlcat from glibc 2.38 to keep
libperl5.38 symbols stable. (Closes: #1051427)
Checksums-Sha1:
d808207fdbb42f594fe3f25b42cf0535944e5ba6 2933 perl_5.38.2-1.dsc
0b5d76399e77b21ce892cd38f4a63703628ce896 418808
perl_5.38.2.orig-regen-configure.tar.xz
af1d5f9e0499f3cfa4736433631aebf7624714da 13679524 perl_5.38.2.orig.tar.xz
ccea4d87c1506daebe673c7e39aaf640de07465e 165496 perl_5.38.2-1.debian.tar.xz
261a5bb3fa46820f2b2b61607646d9a6a6e038dc 6238 perl_5.38.2-1_source.buildinfo
Checksums-Sha256:
4603d34507fe493fd4f549c409e97113f226631d8b052e6dfabdb862e156b751 2933
perl_5.38.2-1.dsc
4d1b34cc058f9963cb89785ecc040d57f6d7725cd83329cfa4ef8b27566454d2 418808
perl_5.38.2.orig-regen-configure.tar.xz
d91115e90b896520e83d4de6b52f8254ef2b70a8d545ffab33200ea9f1cf29e8 13679524
perl_5.38.2.orig.tar.xz
d0757268043ecd9424ad2bd16eece8a12482fc0bf74cc6f4ad1cab5e3febc87b 165496
perl_5.38.2-1.debian.tar.xz
5c42c25041de4a46623236500b7e07a11e4519e491ca883cffb437f1593a3e03 6238
perl_5.38.2-1_source.buildinfo
Files:
ba5878793f7cc1c878e2a4d76382bca9 2933 perl standard perl_5.38.2-1.dsc
139d4ab28a90409790d01ec7a38b6858 418808 perl standard
perl_5.38.2.orig-regen-configure.tar.xz
d3957d75042918a23ec0abac4a2b7e0a 13679524 perl standard perl_5.38.2.orig.tar.xz
56630ee7524b9b73b86c192ca9f2dbf7 165496 perl standard
perl_5.38.2-1.debian.tar.xz
90be53110b5a5822dfc0b35cfa800f15 6238 perl standard
perl_5.38.2-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEEdqKOQsmBHZHoj7peLsD/s7cwGx8FAmVo1KoRHG50eW5pQGRl
Ymlhbi5vcmcACgkQLsD/s7cwGx+KOBAAti0QN6RdToOgGzGxQ8lTObfItVRobdkR
l/wXsBObf+RpwLkOE5h8TZq/q+OwzAIkA/inu9z/q+67v99YxqdTnyEvrON5X2LX
rKH/NKsBDGjLNdxWpn3WqMDAbt3Eqr4WKr0nOgHXlWWOOV7OLnYJ5nacKlDwG94T
BJmYLdmcVd9aTquPVaRt0Kcyd56uA0crQ01tN9TzlXXS7BA62/1McseFwqfotNpA
tzSxAUmt1ZF8WqUFchCWcFq4v/EcOA1PNF7vnUzVMtiztX8j4eSpyrmbTKOhyYxu
k5eQujQZLcvMQnmG7B+IWKmaUqtdqO2lpgUuNY4lh6tWl6GD3J4bmBfcMEPnyjoa
zG6fY8yCPklt0FX42rRHAu4iNuBe7aaAXPoo6rmBSDFPg6cdtbUc5VaZqNY0Hz+B
Y4O/0pe8nr2CTx625MYjl7ZbbtTdWOxb349lx6PyYnaD6Sl5qnCHgIn0xAe+WLJp
BzaCA3vCW4RL29meewrgdy1gfhQq/QIvk2AutzhZZin5PH+T8zJDkkuGLvYWvDY9
Fw3fHmiWO06z4Q02Kh6PTKmqP6o0pYzIgkcSgp52YrTSARrApqtFACTmc3TeLp8t
nGNnadQPd79EfG7JCduMhRcY8Q+AntoXcWCb6+GAGQPd4nz5RW0pzP3s8xLKt/ne
PiWg+WtNpRY=
=+pJi
-----END PGP SIGNATURE-----
--- End Message ---
