Debian Patches
Status for libxml-bare-perl/0.53-5
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| implicit_declaration_of_free.patch | fix warning "incompatible implicit declaration of built-in function 'free'" by unconditionally including stdlib.h (required on Linux) | Florian Schlichting <fsfs@debian.org> | no | |||
| libm.patch | do not link against libm unnecessarily (Bare.so uses none of the libraries symbols) | Florian Schlichting <fsfs@debian.org> | no | |||
| pointer_from_integer.patch | fix use of pointer as int fixes "warning: comparison between pointer and integer" and "warning: assignment makes pointer from integer without a cast" compiler warnings |
Florian Schlichting <fsfs@debian.org> | no | |||
| cross.patch | Improve compiler detection (cross compilation) XML-Bare fails to cross build from source, because it uses the build architecture compiler. The compiler detection in Makefile.PL just uses "gcc". This patch makes the CC configurable via environment and falls back to the detection mechanism of perl itself. . While this improves cross building, the patch will regress msvc builds as is, because earlier getcc used to return 0 for msvc and now it'll really return a compiler there. So the patch will work on Debian, but upstream may want to refine it. |
Helmut Grohne <helmut@subdivi.de> | yes | debian upstream | vendor | 2024-05-15 |
| CVE-2026-13401-r1.patch | XML::Bare: advance stuck attribute-name state (infinite loop) Infinite loop (CWE-835) in the hand-rolled C parser (parser.c), reached by the default XML::Bare->new(text=>$xml)->parse on untrusted XML. The `att_nameqsdone` state — reached after a single-quoted attribute *name* — loops back to itself without advancing `cpos` on any character other than `=` or NUL, spinning forever in C on malformed input. The parser holds the interpreter for the duration of the call, so no Perl-level signal (`alarm`, etc.) can interrupt it: a single request pins a CPU indefinitely. Triggers: `<a ='c'>`, `<a b='''''''c'>`, `<x y=''''''z'>`. next `=` or at the NUL sentinel (already handled by the `case 0` branch). |
CPANSec Security Scanner Bot <cpan-security@security.metacpan.org> | yes | debian upstream | https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-13401-r1.patch | |
| CVE-2026-57074-r1.patch | XML::Bare: bounds truncated fixed-advance lookahead (heap OOB read) Heap-buffer-overflow READ (CWE-125) in the hand-rolled C parser (parser.c), reached by the default XML::Bare->new(text=>$xml)->parse on untrusted XML. Several transitions advance `cpos` by a fixed amount past a recognised token without checking the buffer end, then dereference the new position: - the `<![CDATA` match does `cpos += 9` after confirming only eight bytes (`<![CDATA`), so a truncated tail such as `<![CDATA\0` steps one byte past the NUL terminator; - the three "self-closing tag" branches (name_x, name_gap, att_name) do `cpos += 2` on the assumption that a `>` follows the `/`, so a truncated tail such as `<a/\0` steps past the NUL. The subsequent `let = *cpos;` in val_1/val_x/cdata then reads out of bounds. Trigger: `<!-- c --><a/`. only skip the assumed `>` when `*(cpos+1)` is non-NUL. Both changes are behaviour-preserving for well-formed input — real CDATA always carries the `[`, and a non-truncated self-close always has a byte after the `/`; they differ only on the truncated-tail case that previously overran the allocation. |
CPANSec Security Scanner Bot <cpan-security@security.metacpan.org> | yes | debian upstream | https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-57074-r1.patch |