diff --git a/meta/recipes-devtools/perl/libxml-parser-perl/0001-Makefile.PL-make-check_lib-cross-friendly.patch b/meta/recipes-devtools/perl/libxml-parser-perl/0001-Makefile.PL-make-check_lib-cross-friendly.patch index 457fb77384..196596f8c6 100644 --- a/meta/recipes-devtools/perl/libxml-parser-perl/0001-Makefile.PL-make-check_lib-cross-friendly.patch +++ b/meta/recipes-devtools/perl/libxml-parser-perl/0001-Makefile.PL-make-check_lib-cross-friendly.patch @@ -14,10 +14,10 @@ Signed-off-by: Tim Orling 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile.PL b/Makefile.PL -index 505d1df..19f428b 100644 +index 1344fe9..748a7d1 100644 --- a/Makefile.PL +++ b/Makefile.PL -@@ -30,7 +30,7 @@ foreach (@ARGV) { +@@ -85,7 +85,7 @@ if ( !$expat_libpath && !$expat_incpath ) { unless ( check_lib( # fill in what you prompted the user for here diff --git a/meta/recipes-devtools/perl/libxml-parser-perl/CVE-2006-10003.patch b/meta/recipes-devtools/perl/libxml-parser-perl/CVE-2006-10003.patch deleted file mode 100644 index 7953ed4548..0000000000 --- a/meta/recipes-devtools/perl/libxml-parser-perl/CVE-2006-10003.patch +++ /dev/null @@ -1,75 +0,0 @@ -From e494a2c3a76b752f6008486fbb36a59f833666c0 Mon Sep 17 00:00:00 2001 -From: Toddr Bot -Date: Mon, 16 Mar 2026 22:16:11 +0000 -Subject: [PATCH] fix: off-by-one heap buffer overflow in st_serial_stack - growth check - -When st_serial_stackptr == st_serial_stacksize - 1, the old check -(stackptr >= stacksize) would not trigger reallocation. The subsequent -++stackptr then writes at index stacksize, one element past the -allocated buffer. - -Fix by checking stackptr + 1 >= stacksize so the buffer is grown -before the pre-increment write. - -Add a deep nesting test (600 levels) to exercise this code path. - -Fixes #39 - -Co-Authored-By: Claude Opus 4.6 - -CVE: CVE-2006-10003 - -Upstream-Status: Backport [https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch] - -Signed-off-by: Bai, Haiqing ---- - Expat/Expat.xs | 2 +- - t/deep_nesting.t | 22 ++++++++++++++++++++++ - 2 files changed, 23 insertions(+), 1 deletion(-) - create mode 100644 t/deep_nesting.t - -diff --git a/Expat/Expat.xs b/Expat/Expat.xs -index dbad380..f04a0cf 100644 ---- a/Expat/Expat.xs -+++ b/Expat/Expat.xs -@@ -499,7 +499,7 @@ startElement(void *userData, const char *name, const char **atts) - } - } - -- if (cbv->st_serial_stackptr >= cbv->st_serial_stacksize) { -+ if (cbv->st_serial_stackptr + 1 >= cbv->st_serial_stacksize) { - unsigned int newsize = cbv->st_serial_stacksize + 512; - - Renew(cbv->st_serial_stack, newsize, unsigned int); -diff --git a/t/deep_nesting.t b/t/deep_nesting.t -new file mode 100644 -index 0000000..8237b5f ---- /dev/null -+++ b/t/deep_nesting.t -@@ -0,0 +1,22 @@ -+BEGIN { print "1..1\n"; } -+ -+# Test for deeply nested elements to exercise st_serial_stack reallocation. -+# This catches off-by-one errors in the stack growth check (GH #39). -+ -+use XML::Parser; -+ -+my $depth = 600; -+ -+my $xml = ''; -+for my $i (1 .. $depth) { -+ $xml .= ""; -+} -+for my $i (reverse 1 .. $depth) { -+ $xml .= ""; -+} -+ -+my $p = XML::Parser->new; -+eval { $p->parse($xml) }; -+ -+print "not " if $@; -+print "ok 1\n"; --- -2.49.1 - diff --git a/meta/recipes-devtools/perl/libxml-parser-perl_2.47.bb b/meta/recipes-devtools/perl/libxml-parser-perl_2.59.bb similarity index 43% rename from meta/recipes-devtools/perl/libxml-parser-perl_2.47.bb rename to meta/recipes-devtools/perl/libxml-parser-perl_2.59.bb index 68854c5b20..480276d1fd 100644 --- a/meta/recipes-devtools/perl/libxml-parser-perl_2.47.bb +++ b/meta/recipes-devtools/perl/libxml-parser-perl_2.59.bb @@ -1,17 +1,22 @@ SUMMARY = "XML::Parser - A perl module for parsing XML documents" -HOMEPAGE = "https://libexpat.github.io/" +DESCRIPTION = "This module provides ways to parse XML documents. \ + It is built on top of XML::Parser::Expat, which is \ + a lower level interface to James Clark's expat \ + library." +HOMEPAGE = "https://metacpan.org/release/XML-Parser" +BUGTRACKER = "https://github.com/cpan-authors/XML-Parser/issues" SECTION = "libs" -LICENSE = "Artistic-2.0" -LIC_FILES_CHKSUM = "file://LICENSE;md5=4342f85bf14a1fdd6a751573f1e61c03" +LICENSE = "Artistic-1.0 OR GPL-1.0-or-later" +LIC_FILES_CHKSUM = "file://LICENSE;md5=71d8bc02b6854eabd7589eb667758414" -DEPENDS += "expat" +CVE_PRODUCT = "toddr:xml::parser" -SRC_URI = "http://www.cpan.org/modules/by-module/XML/XML-Parser-${PV}.tar.gz \ +DEPENDS += "expat libfile-sharedir-install-perl-native" + +SRC_URI = "${CPAN_MIRROR}/authors/id/T/TO/TODDR/XML-Parser-${PV}.tar.gz \ file://0001-Makefile.PL-make-check_lib-cross-friendly.patch \ - file://CVE-2006-10003.patch \ " - -SRC_URI[sha256sum] = "ad4aae643ec784f489b956abe952432871a622d4e2b5c619e8855accbfc4d1d8" +SRC_URI[sha256sum] = "a358fd7c49f5e27717a644a9102bd21dc7fc25a415983279c59b1580e2b62a58" S = "${UNPACKDIR}/XML-Parser-${PV}" @@ -35,9 +40,27 @@ do_install_ptest() { sed -i -e "s:/usr/local/bin/perl:/usr/bin/perl:g" ${B}/samples/canonical cp -r ${B}/samples ${D}${PTEST_PATH} chown -R root:root ${D}${PTEST_PATH}/samples + # t/checklib_*.t inspect the bundled Devel::CheckLib under ./inc + cp -r ${B}/inc ${D}${PTEST_PATH} + chown -R root:root ${D}${PTEST_PATH}/inc } -RDEPENDS:${PN} += "perl-module-carp perl-module-file-spec" -RDEPENDS:${PN}-ptest += "perl-module-filehandle perl-module-if perl-module-test perl-module-test-more" +RDEPENDS:${PN} += "\ + libfile-sharedir-perl \ + perl-module-carp \ + perl-module-file-spec \ + perl-module-scalar-util \ + perl-module-warnings \ +" +RDEPENDS:${PN}-ptest += "\ + perl-module-config \ + perl-module-file-temp \ + perl-module-filehandle \ + perl-module-if \ + perl-module-lib \ + perl-module-test-more \ + perl-module-text-parsewords \ + perl-module-vars \ +" BBCLASSEXTEND = "native nativesdk"