--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:libtext-csv-xs-perl
User: [email protected]
Usertags: pu
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
In coordination with the security team, I've uploaded
libtext-csv-xs-perl/1.60-1+deb13u1 to trixie in order to fix
https://security-tracker.debian.org/tracker/CVE-2026-7111
aka #1135232
| Text::CSV_XS versions before 1.62 for Perl have a use-after-free when
| registered callbacks extend the Perl argument stack, which may enable
| type confusion or memory corruption. …
The fix is 1 quilt patch, taken from the respective uptream commit
(also included in the 1.62 upstream release, aka tested in the wild),
which is also already in unstable.
Find attached the complete debdiff against the version in trixie.
Thanks in advance,
gregor
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmn7ep1fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgb4Sw//ckWUm+rojfX9peN3hUjtA5DFqwN4LCBgwAklj5gDkzwbgnQuFuV6SHlL
38kWtqQuxRLAQg6lkcngV6M3J1I0f/fnJgGuRtDF463NKc0xo+iQqEYJc6VYy6U1
dFYRRE/z/WYgFfxS1h9A4Gxc4isIXVtn5omZNCeEHXII4fQk8DmFan/eWwGc7cZh
nmBzBwQ4HTZD7kVJ4OHK9BRU12yj+bpJdtnm2gyP7PCiW03xUpkLDZVJvWZfSO+e
8DOVFlXeS3qX7uvSqdqQTMFJnOZ0by/kKdILDeQD8yHkB1+31CDvOcL+YWPjd184
CTLEhD+TrRK1HpOa954FUEYVlquLfct/YfFDA/PmDyZSz9QfCiMmkQgEnL02Bcpw
LBOvtvFDgl1MTC2pvt7rKMzx2xnGwSy6aYo9C+sEOS1JbT2lj0WlR0hkZE1kWCh1
g/wyBC8AU3QRUQhsEtvkGkr6lbvsYO+j6pCsIOEBr5nBjR+k+FdIGp84Vx01L/v1
Fk+a3gFXOFBsbtILCrFMyT+m41G8epbBr6D+aXoZFnp/jPxX0+RxA7touxsEi8pQ
Odr+8GCHS924RPa/syuUAvwi0w6q27EQltLQNppb59ID2Yztf/bOthskvGLehwqp
HiE8natvdAyTrHYFIAZWb9WD4x2BIbWKFRsx0by0jqNEDavsMhc=
=npYS
-----END PGP SIGNATURE-----
diff -Nru libtext-csv-xs-perl-1.60/debian/changelog
libtext-csv-xs-perl-1.60/debian/changelog
--- libtext-csv-xs-perl-1.60/debian/changelog 2025-02-02 02:20:05.000000000
+0100
+++ libtext-csv-xs-perl-1.60/debian/changelog 2026-05-06 17:02:23.000000000
+0200
@@ -1,3 +1,11 @@
+libtext-csv-xs-perl (1.60-1+deb13u1) trixie; urgency=medium
+
+ * Fix possible stack corruption: CVE-2026-7111.
+ Patch taken from upstream Git commit, as released in 1.62.
+ (Closes: #1135232)
+
+ -- gregor herrmann <[email protected]> Wed, 06 May 2026 17:02:23 +0200
+
libtext-csv-xs-perl (1.60-1) unstable; urgency=medium
* Import upstream version 1.60.
diff -Nru
libtext-csv-xs-perl-1.60/debian/patches/0001-Fix-possible-stack-corruption.patch
libtext-csv-xs-perl-1.60/debian/patches/0001-Fix-possible-stack-corruption.patch
---
libtext-csv-xs-perl-1.60/debian/patches/0001-Fix-possible-stack-corruption.patch
1970-01-01 01:00:00.000000000 +0100
+++
libtext-csv-xs-perl-1.60/debian/patches/0001-Fix-possible-stack-corruption.patch
2026-05-06 17:02:23.000000000 +0200
@@ -0,0 +1,114 @@
+From c17f31a5f2bf36674748eb4b6e25672f0571a224 Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <[email protected]>
+Date: Sat, 25 Apr 2026 16:18:57 +0200
+Subject: [PATCH] Fix possible stack corruption (thanks leont) (issue 65)
+
+SPAGAIN required if callbacks can extend the stack
+
+
+Bug: https://github.com/cpan-authors/Text-CSV_XS/issues/65
+Bug-Debian: https://bugs.debian.org/1135232
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-7111
+
+
+---
+ CSV_XS.xs | 36 ++++++++++++++++++------------------
+ ChangeLog | 1 +
+ cpanfile | 2 +-
+ sandbox/issue-65.pl | 41 ++++++++++++++++++++++++++++++++++++++---
+ 4 files changed, 58 insertions(+), 22 deletions(-)
+
+diff --git a/CSV_XS.xs b/CSV_XS.xs
+index f89859e..c348f83 100644
+--- a/CSV_XS.xs
++++ b/CSV_XS.xs
+@@ -122,6 +122,12 @@ static unsigned char ec, ebcdic2ascii[256] = {
+ croak ("self is not a hash ref"); \
+ hv = (HV *)SvRV (self)
+
++#define undef &PL_sv_undef
++#define PUT_RETURN(x) \
++ SPAGAIN; \
++ ST (0) = x; \
++ XSRETURN (1)
++
+ /* Keep in sync with .pm! */
+ #define CACHE_ID_quote_char 0
+ #define CACHE_ID_escape_char 1
+@@ -2603,7 +2609,7 @@ BOOT:
+ Perl_load_module (aTHX_ PERL_LOADMOD_NOIMPORT, newSVpvs ("IO::Handle"),
NULL, NULL, NULL);
+
+ void
+-SetDiag (SV *self, int xse, ...)
++SetDiag (SV *self, int xse, SV *line = undef)
+
+ PPCODE:
+ HV *hv;
+@@ -2619,8 +2625,8 @@ SetDiag (SV *self, int xse, ...)
+ ST (0) = sv_2mortal (SvDiag (xse));
+ }
+
+- if (xse && items > 2 && SvPOK (ST (2))) {
+- sv_setpvn (ST (0), SvPVX (ST (2)), SvCUR (ST (2)));
++ if (xse && SvPOK (line)) {
++ sv_setpvn (ST (0), SvPVX (line), SvCUR (line));
+ SvIOK_on (ST (0));
+ }
+
+@@ -2670,8 +2676,8 @@ Parse (SV *self, SV *src, SV *fields, SV *fflags)
+ av = (AV *)SvRV (fields);
+ avf = (AV *)SvRV (fflags);
+
+- ST (0) = xsParse (self, hv, av, avf, src, 0) ? &PL_sv_yes : &PL_sv_no;
+- XSRETURN (1);
++ int x = xsParse (self, hv, av, avf, src, 0);
++ PUT_RETURN (x ? &PL_sv_yes : &PL_sv_no);
+ /* XS Parse */
+
+ void
+@@ -2691,8 +2697,8 @@ print (SV *self, SV *io, SV *fields)
+ av = (AV *)SvRV (fields);
+ }
+
+- ST (0) = xsCombine (self, hv, av, io, 1) ? &PL_sv_yes : &PL_sv_no;
+- XSRETURN (1);
++ int x = xsCombine (self, hv, av, io, 1);
++ PUT_RETURN (x ? &PL_sv_yes : &PL_sv_no);
+ /* XS print */
+
+ void
+@@ -2706,26 +2712,20 @@ getline (SV *self, SV *io)
+ CSV_XS_SELF;
+ av = newAV ();
+ avf = newAV ();
+- ST (0) = xsParse (self, hv, av, avf, io, 1)
+- ? sv_2mortal (newRV_noinc ((SV *)av))
+- : &PL_sv_undef;
+- XSRETURN (1);
++ int x = xsParse (self, hv, av, avf, io, 1);
++ PUT_RETURN (x ? sv_2mortal (newRV_noinc ((SV *)av)) : undef);
+ /* XS getline */
+
+ void
+-getline_all (SV *self, SV *io, ...)
++getline_all (SV *self, SV *io, SV *offset = undef, SV *length = undef)
+
+ PPCODE:
+ HV *hv;
+- SV *offset, *length;
+
+ CSV_XS_SELF;
+
+- offset = items > 2 ? ST (2) : &PL_sv_undef;
+- length = items > 3 ? ST (3) : &PL_sv_undef;
+-
+- ST (0) = xsParse_all (self, hv, io, offset, length);
+- XSRETURN (1);
++ SV *x = xsParse_all (self, hv, io, offset, length);
++ PUT_RETURN (x);
+ /* XS getline_all */
+
+ void
+--
+2.53.0
+
diff -Nru libtext-csv-xs-perl-1.60/debian/patches/series
libtext-csv-xs-perl-1.60/debian/patches/series
--- libtext-csv-xs-perl-1.60/debian/patches/series 1970-01-01
01:00:00.000000000 +0100
+++ libtext-csv-xs-perl-1.60/debian/patches/series 2026-05-06
17:02:23.000000000 +0200
@@ -0,0 +1 @@
+0001-Fix-possible-stack-corruption.patch
--- End Message ---
