head 1.2; access; symbols pkgsrc-2026Q2:1.1.0.4 pkgsrc-2026Q2-base:1.1 pkgsrc-2026Q1:1.1.0.2; locks; strict; comment @# @; 1.2 date 2026.07.16.18.57.37; author wiz; state dead; branches; next 1.1; commitid cnixJgiQyaTQwUNG; 1.1 date 2026.05.27.22.35.30; author wiz; state Exp; branches 1.1.2.1 1.1.4.1; next ; commitid QGw1UsX5Kez9lvHG; 1.1.2.1 date 2026.05.27.22.35.30; author maya; state dead; branches; next 1.1.2.2; commitid 7Lex1JUIlSbPTaJG; 1.1.2.2 date 2026.06.09.22.30.58; author maya; state Exp; branches; next ; commitid 7Lex1JUIlSbPTaJG; 1.1.4.1 date 2026.08.09.19.00.15; author bsiegert; state Exp; branches; next 1.1.4.2; commitid fENwMM2FgdVPLZQG; 1.1.4.2 date 2026.08.10.11.50.22; author bsiegert; state dead; branches; next ; commitid sTrsik6xz1ncm5RG; desc @@ 1.2 log @perl: update to 5.44.0. Core Enhancements Named Parameters in Signatures Multi-variable foreach can now use aliased references Enhanced operation of regular expression patterns under /xx Unicode 17.0 is supported New source of entropy for PRNG seeding Security CVE-2026-8376 - Buffer overflow in Perl_study_chunk CVE-2026-57432 - Buffer overflow in S_measure_struct CVE-2026-13221 - Regex trie 16-bit field overflow Incompatible Changes Unicode rules are now fully enforced on identifier and regular expression group names. More details at https://metacpan.org/dist/perl/changes @ text @$NetBSD: patch-cpan_Archive-Tar_lib_Archive_Tar.pm,v 1.1 2026/05/27 22:35:30 wiz Exp $ Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch --- cpan/Archive-Tar/lib/Archive/Tar.pm.orig 2026-01-18 16:32:21.000000000 +0000 +++ cpan/Archive-Tar/lib/Archive/Tar.pm @@@@ -24,7 +24,7 @@@@ use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLI use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLINK $CHOWN $CHMOD $DO_NOT_USE_PREFIX $HAS_PERLIO $HAS_IO_STRING $SAME_PERMISSIONS $INSECURE_EXTRACT_MODE $ZERO_PAD_NUMBERS @@ISA @@EXPORT $RESOLVE_SYMLINK - $EXTRACT_BLOCK_SIZE + $EXTRACT_BLOCK_SIZE $MAX_FILE_SIZE ]; @@ISA = qw[Exporter]; @@@@ -41,6 +41,7 @@@@ $EXTRACT_BLOCK_SIZE = 1024 * 1024 * 1024; $ZERO_PAD_NUMBERS = 0; $RESOLVE_SYMLINK = $ENV{'PERL5_AT_RESOLVE_SYMLINK'} || 'speed'; $EXTRACT_BLOCK_SIZE = 1024 * 1024 * 1024; +$MAX_FILE_SIZE = 1024 * 1024 * 1024; BEGIN { use Config; @@@@ -444,6 +445,14 @@@@ sub _read_tar { my $block = BLOCK_SIZE->( $entry->size ); + if ( $MAX_FILE_SIZE && $entry->size > $MAX_FILE_SIZE ) { + $self->_error( qq[Entry '] . $entry->full_path . + qq[' declared size ] . $entry->size . + qq[ bytes exceeds \$Archive::Tar::MAX_FILE_SIZE ] . + qq[($MAX_FILE_SIZE); refusing to allocate] ); + next LOOP; + } + $data = $entry->get_content_by_ref; my $skip = 0; @@@@ -2186,6 +2195,13 @@@@ extraction may fail with an error. cannot be arbitrarily large since some operating systems limit the number of bytes that can be written in one call to C, so if this is too large, extraction may fail with an error. + +=head2 $Archive::Tar::MAX_FILE_SIZE + +This variable holds an upper bound on the per-entry declared size that +C will accept when reading an archive. Entries whose header +claims a larger size are refused with an error before any read allocation. +Defaults to 1 GiB. Set to 0 to disable the cap. =cut @ 1.1 log @perl: fix security problem in Archive::Tar Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header Bump PKGREVISION. @ text @d1 1 a1 1 $NetBSD$ @ 1.1.4.1 log @Pullup ticket #7224 - requested by maya lang/perl5: security fix (via patch) perl5: Update to 5.42.3 Updated for security fixes. Remove local patches backporting security fixes. Release notes: Security CVE-2026-8376 - Buffer overflow in Perl_study_chunk Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. On 32-bit builds, this can lead to an integer overflow of the size of the buffer leading to out-of-bounds writes. CVE-2026-57432 - Buffer overflow in S_measure_struct If you call pack or unpack to operate on a structure whose computed size is too large to fit in memory, an integer overflow could happen that would result in a buffer overflow. This usually happens as a result of embedding a large number as the repeat count for an item. CVE-2026-13221 - Regex trie 16-bit field overflow The trie optimization in the regex engine could overflow in an alternation with more than ~65k branches. This could cause both false positives and false negatives on such regular expressions. Modules and Pragmata Updated Modules and Pragmata Archive::Tar has been upgraded from version 3.04 to 3.12. This fixes CVE-2026-9538, CVE-2026-42496, and CVE-2026-42497. Compress::Raw::Bzip2 has been upgraded from version 2.213 to 2.218. HTTP::Tiny has been upgraded from version 0.090 to 0.096. This fixes CVE-2026-7010 and CVE-2026-7017. IO::Compress has been upgraded from version 2.213 to 2.223. This fixes CVE-2025-15649, CVE-2026-48961, CVE-2026-48962, and CVE-2026-48959. Module::CoreList has been upgraded from version 5.20260329_42 to 5.20260802_42. Socket has been upgraded from version 2.038 to 2.041. This fixes CVE-2026-12087. Storable has been upgraded from version 3.37 to 3.37_01. This fixes CVE-2026-57433. @ text @d1 54 @ 1.1.4.2 log @Pullup ticket #7224 - requested by maya lang/perl5: security fix follow-up: remove 0-byte patches, these files were meant to be deleted in the last commit. @ text @@ 1.1.2.1 log @file patch-cpan_Archive-Tar_lib_Archive_Tar.pm was added on branch pkgsrc-2026Q1 on 2026-06-09 22:30:58 +0000 @ text @d1 54 @ 1.1.2.2 log @Pullup ticket #7132 - requested by taca lang/perl5: Security fix Revisions pulled up: - lang/perl5/Makefile 1.292-1.293 - lang/perl5/distinfo 1.197-1.198 - lang/perl5/patches/patch-cpan_Archive-Tar_lib_Archive_Tar.pm 1.1 - lang/perl5/patches/patch-regcomp__study.c 1.1 --- Module Name: pkgsrc Committed By: wiz Date: Wed May 27 22:28:20 UTC 2026 Modified Files: pkgsrc/lang/perl5: Makefile distinfo Added Files: pkgsrc/lang/perl5/patches: patch-regcomp__study.c Log Message: perl: apply upstream security fix for regex on 32-bit systems. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: wiz Date: Wed May 27 22:35:30 UTC 2026 Modified Files: pkgsrc/lang/perl5: Makefile distinfo Added Files: pkgsrc/lang/perl5/patches: patch-cpan_Archive-Tar_lib_Archive_Tar.pm Log Message: perl: fix security problem in Archive::Tar Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header Bump PKGREVISION. @ text @a0 54 $NetBSD: patch-cpan_Archive-Tar_lib_Archive_Tar.pm,v 1.1 2026/05/27 22:35:30 wiz Exp $ Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch --- cpan/Archive-Tar/lib/Archive/Tar.pm.orig 2026-01-18 16:32:21.000000000 +0000 +++ cpan/Archive-Tar/lib/Archive/Tar.pm @@@@ -24,7 +24,7 @@@@ use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLI use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLINK $CHOWN $CHMOD $DO_NOT_USE_PREFIX $HAS_PERLIO $HAS_IO_STRING $SAME_PERMISSIONS $INSECURE_EXTRACT_MODE $ZERO_PAD_NUMBERS @@ISA @@EXPORT $RESOLVE_SYMLINK - $EXTRACT_BLOCK_SIZE + $EXTRACT_BLOCK_SIZE $MAX_FILE_SIZE ]; @@ISA = qw[Exporter]; @@@@ -41,6 +41,7 @@@@ $EXTRACT_BLOCK_SIZE = 1024 * 1024 * 1024; $ZERO_PAD_NUMBERS = 0; $RESOLVE_SYMLINK = $ENV{'PERL5_AT_RESOLVE_SYMLINK'} || 'speed'; $EXTRACT_BLOCK_SIZE = 1024 * 1024 * 1024; +$MAX_FILE_SIZE = 1024 * 1024 * 1024; BEGIN { use Config; @@@@ -444,6 +445,14 @@@@ sub _read_tar { my $block = BLOCK_SIZE->( $entry->size ); + if ( $MAX_FILE_SIZE && $entry->size > $MAX_FILE_SIZE ) { + $self->_error( qq[Entry '] . $entry->full_path . + qq[' declared size ] . $entry->size . + qq[ bytes exceeds \$Archive::Tar::MAX_FILE_SIZE ] . + qq[($MAX_FILE_SIZE); refusing to allocate] ); + next LOOP; + } + $data = $entry->get_content_by_ref; my $skip = 0; @@@@ -2186,6 +2195,13 @@@@ extraction may fail with an error. cannot be arbitrarily large since some operating systems limit the number of bytes that can be written in one call to C, so if this is too large, extraction may fail with an error. + +=head2 $Archive::Tar::MAX_FILE_SIZE + +This variable holds an upper bound on the per-entry declared size that +C will accept when reading an archive. Entries whose header +claims a larger size are refused with an error before any read allocation. +Defaults to 1 GiB. Set to 0 to disable the cap. =cut @