From patchwork Thu Nov 5 17:02:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 103150 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.26]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.990.1793898176790299197 for ; Thu, 05 Nov 2026 09:02:57 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=Fp3dTV53; spf=pass (domain: est.tech, ip: 52.101.72.26, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=WLYiSC3vPIbPCEIJwOFVxkPiOPnL6I22sHZScdUZX7ne8AHWw/5W9177F+Muk1o/AgYv61yUChhkZM/J73MW6y+XNaiSM0evV/QJ5WHEdLyeWNQhbCwzLmwA8uqD1ELyGefJyIZNuUd3A5bhFSOvwJPhdwXONLo0OGUkr44kIq4EAN81ZqYgqm2jQmBMYiKyhtbf9MDAXyVXfCiYm4TSy3X9+FZeDUOX+tcEY5c3FzuzJagY0a3/q0tkJpghharha8aajJMUW3qq/bQh52pmTCfsc5LQy2jS9CuRCRrPxUFHoX3KJB4J+08tQRl7lf2uFhqKBPZvhtfItKiaSuJGlg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=JA48viKTcnUMeCVF7Wc4EndvIgww3d9OHmHg5INxR9w=; b=W5Ugtt8+l4XQtVkFjusQCc/NAtKciE3+sW0RwEsPOudoI9qVtQX9bjsQjfW7aQK3ht0PfSHcYyfw5wKqtEMzP3NhZjgcOvbaInyRCut8ngDe/j06fWpyJ1DG6sQiRH6mw7eEFDtfN/EIN+ZAEr1OM2/9l3lVdjujWrhwt7FKL6jAO/x+fs4eyLblz5Yp5jk1Gshk2Qm/aVLNxUaEK6Tua0lwvgk5VzGV/EKSmbKYzDNn7tc5ThPJreDx7XKaMPgpYeasPx2IYSuZVTxr9TCNtCeuAqSnXuwavjaDqLU+3RRqirCoW5K07gj9jBawCuFaxhXTVzrvbAmWzrc5Ypw3og== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JA48viKTcnUMeCVF7Wc4EndvIgww3d9OHmHg5INxR9w=; b=Fp3dTV53UpW7gsgls84MCJri0/Hxby0GoN7V9E/J1wNo6J92UZx9vl/UJTQZ7f/otOJBrsemvXFnrwwiF1oenMk4er8C3McZRrgHsNavkFf4WQQUOcBhi6QRSzv+t0ho1OxxW91PTS3UbqpXznVXrG6j6JSI82SEoc1dsNlYvx5cDVlmip2Q0QWAUMHUQDNV5k9tMicMsCLUVxx+R+AUzWcAFJiapYFTQHTHF8C+LTM3qIdek2s2z0x6NJ4XC4ox1OHmpO1KGW2aZgCaKrpn5WOIIuGrQAEz74280aC9ojusycmDV9MUMU+rLy2yLtWqvv3h7/wgvpe2T52DtiWcrw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AM6P189MB3107.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6c0::19) by PAWP189MB2527.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:358::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.10; Thu, 5 Nov 2026 17:02:51 +0000 Received: from AM6P189MB3107.EURP189.PROD.OUTLOOK.COM ([fe80::bc97:3847:8f02:acb]) by AM6P189MB3107.EURP189.PROD.OUTLOOK.COM ([fe80::bc97:3847:8f02:acb%6]) with mapi id 15.21.0592.009; Thu, 5 Nov 2026 17:02:51 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org Subject: [wrynose][PATCH 1/2] perl-cross: add patches for perl-5.42.3 Date: Thu, 5 Nov 2026 18:02:48 +0100 Message-ID: <20261105170249.55552-1-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) X-ClientProxiedBy: DU6P191CA0044.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:53f::24) To AM6P189MB3107.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6c0::19) Return-Path: jaipaul.cheernam@est.tech MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM6P189MB3107:EE_|PAWP189MB2527:EE_ X-MS-Office365-Filtering-Correlation-Id: 167cf859-9710-4d97-bb11-08df3b5ea038 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|261026121527099003|261026140227099003|261022075727099003|261022105027099003|261102123227099003|261021121427099003|261028144727099003|10067099003|260925021311599003|11063799006|260925022911599003|260925021911599003|261009223027099003|261009221227099003|261009223327099003|261009221727099003|261009220027099003|6133799003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: V5ZZIpWehiFj7/4tm/RdX7KmFOj/VLJr9wN/fpwz9b85ZsOQpa2C3hi0AkA8To7lbt9/VtiEpyCTyBQA+jA0EiHthu+5x1SYm7jaEJQTgp1ZCBZQ8U/yk8K3XPFcqezJ+XlN6UQ5oHC+qk2q0aZLgplqSFYQFXKrn/fuwPm13evChXAatg2zEV+LgKHgGy6FjoUtpV+Y0FPkeO32+IR2p5MH+qVnh5y7IMParrgLpY9p6M9uMNj1ORSkY2aS6RGPMnSqIstcOpXJJ7scXDkiRzQ8rUDwSq2cAVSHLgesnaxM23S8gEYo7LdpdW8/JCCaoDR7czQvjc7mBsInrn5BjRkW+XId8lP/F5jI0leH1amutpbIfgsChJt+VwCkPuxLPN4ZyMHKWFFMt8FQQrgR0oI3Vg0FPfBy1q/Ck8/aJBKAfJQLv9jJYnWavP6ehwoOnOaKZjBtPZWQty2T4jantV9pQ4ONvIccMjXJl+EKEtjOzIK16kcR2tiRapWens+dkdSCdzd4kRmTphyFyUNUAmO1qbDmDoOzudUSP9dCdKNdtnF2PZ9tnBatHxyyuAMrboNj9PiGJYdpyvJYCSMH9sHV+axVNbCcmmHKwdnT44Lj1ZZXOhsakENEp8FewlfbPvdrlMulq7nwetdVRDR1P0Oavtpam7tmWJogrWOlPB0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM6P189MB3107.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(261026121527099003)(261026140227099003)(261022075727099003)(261022105027099003)(261102123227099003)(261021121427099003)(261028144727099003)(10067099003)(260925021311599003)(11063799006)(260925022911599003)(260925021911599003)(261009223027099003)(261009221227099003)(261009223327099003)(261009221727099003)(261009220027099003)(6133799003)(18002099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: RfdIYUrOa5sEAzcCfgadUrGevHLnPOnF/dOv0Gj/6wmwp4CboZ+fvQGDsVoEKuLJo44o8wiWH/BgMiCZzdp28ltQdu1A9T4hvpuCFgyFnkyYg9JeBjWVOiSA9lURRlskjGqPdbx67LvJkXWST3Sn57HfC/6ZhvO3DklvtGqRHiD9r9Bd3yVsDhudpJquIg1CXQsmGAEi/v+BIl2eJg0TUlJSvyBViApcsX+mdUHOCCQcTX4xM90SzwQKfDEHtdwqCCKITkZvUw1iKV0SpspVmWFReddOC4ddHAihQagog87sYkdGCIk2qfP2hnlxgun8hnCJ+cAPVocALu+nmPL9y5mfdq8FHL07SVymRB6ceuG0ea4erMhb/cqj6xis1+F3ShDV4taS3gdK7bV5BtcrXnRg32H0zYtqgL7Kh+le1UfKJZ0MP6sfBsPpXCEbrb0DE01hJJcavZsI0YJcKOBOpomoRSktOoGyoRXFZ7nNdPdIJqAFHYmxEWqILLDvnv1Bq/LYwlXfrKR2fqN51wT2MMdAoGjwsepjVr8wASH8J7mO0tZnwWoYc/kpLXvnUyh5T5qSkjEibqZFzmrQt5ZBz2sWubaVT5ZcVS6Fj9UJZGoepcgJ4z/EBhCqftjRWHhjIV607SJDx1GWuRuto17/6IOe1zSJUSQsJhLX/MVU9IZIznXFgjMKKoRqFLvU5beJnBvk/tvDcWZmc7FmMEdmaOGNYszYw7AWmzDtWTKdC+4chFPRDtOU8upT8heSMmDkuzqaKvMsWuOmTDjIG0B9nE5BZtUwMkxVdRSL3YJAg89/fREyRI3SvTMVFxVJHl2u+4jyo5o/FyHShD/asS8f2I5fW8oPiKrrBmQlnHB88roFZPeQ1vi5o8hsmPk1aStVKjnARyGoKdhL1amDeFD1P0OQ3Li7l3U9RFPbS+/sVaCKbdZ890FP+giQidfSUjSSi0PaHn8oLBS0d4//e1BJJs1shdD7kKdsu2IZjsH+7ZAGRzi9TLKT3HLi/5WiX3XCQoMkISeT6/2IUogwESZSP1WZ1XTQyDJp28Zf4hYI43pQakV4+J4Gg63LeTtb28CAj8zloS73Swt1VzyXJtuwUp4XHEV7vTz1WR5O3oYqid9ADhG8oaVaticihT+ympHn6GV43CgJkZZuOvgOJ6ziNWPF1aS6j7EiPCm0WHpDkVsav7fdtsLK8JXXqaaXim8ikrStAi8J9qbNikIEVcwvOHbZpKVBj2G/vNjk2pxxuD72u2/JizSqKO4rR8bcoxzgDQLdCHR57BFgwS1KIPQiPKrGoaJzrUj6Tj5r9dp9Prugwf0wZon4wZ149TrPhk+lRngddQv5+5EnOoVaBrIEmNFj4w7/syH0aChFVdjUPs9Nnuo5uc6RlLERBQsbhvrSXdmi26mkM8uX4o6ogc1fvMTAHjZHefeV7FcOzUvWDxwhmodKpRrH8/VlmMyjEWBHyg4p5ZIbL8zNESnuPXLKS0dGek5GZZ9my/IN8ufSVTbHaIC7rnD/xjKN2ySua59KN58DSCNO2mmmoptR15doDu6VfS5NXYhKAIiFNhBpOX0OGUoc7cQOEuZVVbfO90XxXM2qXsOF5ehZqRXAOld72+uK/T/421Q4TqZH2k2DbTVbiNL9waGzgTX30cM1KXkTA4LZBkOd4E3iGDP/QXEhE9Q4H/QkOSb75H/Rr5s4ktzU8dZJqD1YqMfz47NMGjTDUV8J25y4WwwX/uEmgVxEKtutIr3C3R8PBADr4BOUUik= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 167cf859-9710-4d97-bb11-08df3b5ea038 X-MS-Exchange-CrossTenant-AuthSource: AM6P189MB3107.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2026 17:02:51.2429 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: C/s39f8zZ8+QG+B5CzcyzcqO2H+sJoDL0bMxpgbRy4vEyVBFTZdjSpD4tzmeLe9NIUWd5nuwJV+DJ91VV8PnhPPNRQ6AAT0MhsxwWhJiuc8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWP189MB2527 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 17:03:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249566 perl-cross 1.6.4 has no patchset for the 5.42.3 point release and aborts configure on unknown versions. Reuse the 5.42.0 patchset, as its cnf/diffs/README advises ("Copy the closest available version"). Signed-off-by: Jaipaul Cheernam --- ...rl-cross-add-patches-for-perl-5.42.3.patch | 226 ++++++++++++++++++ .../perl-cross/perlcross_1.6.4.bb | 1 + 2 files changed, 227 insertions(+) create mode 100644 meta/recipes-devtools/perl-cross/files/0001-perl-cross-add-patches-for-perl-5.42.3.patch diff --git a/meta/recipes-devtools/perl-cross/files/0001-perl-cross-add-patches-for-perl-5.42.3.patch b/meta/recipes-devtools/perl-cross/files/0001-perl-cross-add-patches-for-perl-5.42.3.patch new file mode 100644 index 0000000000..a7fbd116f1 --- /dev/null +++ b/meta/recipes-devtools/perl-cross/files/0001-perl-cross-add-patches-for-perl-5.42.3.patch @@ -0,0 +1,226 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jaipaul Cheernam +Date: Thu, 5 Nov 2026 14:00:00 +0000 +Subject: [PATCH] perl-cross: add patches for perl-5.42.3 + +Reuse the perl 5.42.0 patchset for the 5.42.3 point release. + +Upstream-Status: Inappropriate [oe-specific; perl-cross goes 5.42.0 -> 5.44.0] +Signed-off-by: Jaipaul Cheernam +--- + cnf/diffs/perl5-5.42.3/constant.patch | 1 + + cnf/diffs/perl5-5.42.3/dynaloader.patch | 1 + + cnf/diffs/perl5-5.42.3/findext.patch | 1 + + cnf/diffs/perl5-5.42.3/installscripts.patch | 1 + + cnf/diffs/perl5-5.42.3/liblist.patch | 70 +++++++++++++++++++++ + cnf/diffs/perl5-5.42.3/makemaker.patch | 1 + + cnf/diffs/perl5-5.42.3/posix-makefile.patch | 1 + + cnf/diffs/perl5-5.42.3/test-checkcase.patch | 1 + + cnf/diffs/perl5-5.42.3/test-makemaker.patch | 1 + + cnf/diffs/perl5-5.42.3/xconfig.patch | 48 ++++++++++++++ + 10 files changed, 126 insertions(+) + create mode 120000 cnf/diffs/perl5-5.42.3/constant.patch + create mode 120000 cnf/diffs/perl5-5.42.3/dynaloader.patch + create mode 120000 cnf/diffs/perl5-5.42.3/findext.patch + create mode 120000 cnf/diffs/perl5-5.42.3/installscripts.patch + create mode 100644 cnf/diffs/perl5-5.42.3/liblist.patch + create mode 120000 cnf/diffs/perl5-5.42.3/makemaker.patch + create mode 120000 cnf/diffs/perl5-5.42.3/posix-makefile.patch + create mode 120000 cnf/diffs/perl5-5.42.3/test-checkcase.patch + create mode 120000 cnf/diffs/perl5-5.42.3/test-makemaker.patch + create mode 100644 cnf/diffs/perl5-5.42.3/xconfig.patch + +diff --git a/cnf/diffs/perl5-5.42.3/constant.patch b/cnf/diffs/perl5-5.42.3/constant.patch +new file mode 120000 +index 0000000..065e198 +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/constant.patch +@@ -0,0 +1 @@ ++../perl5-5.22.3/constant.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/dynaloader.patch b/cnf/diffs/perl5-5.42.3/dynaloader.patch +new file mode 120000 +index 0000000..ffb73eb +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/dynaloader.patch +@@ -0,0 +1 @@ ++../perl5-5.22.3/dynaloader.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/findext.patch b/cnf/diffs/perl5-5.42.3/findext.patch +new file mode 120000 +index 0000000..9efbe5b +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/findext.patch +@@ -0,0 +1 @@ ++../perl5-5.22.3/findext.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/installscripts.patch b/cnf/diffs/perl5-5.42.3/installscripts.patch +new file mode 120000 +index 0000000..1c05e0f +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/installscripts.patch +@@ -0,0 +1 @@ ++../perl5-5.36.0/installscripts.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/liblist.patch b/cnf/diffs/perl5-5.42.3/liblist.patch +new file mode 100644 +index 0000000..1dae0bb +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/liblist.patch +@@ -0,0 +1,70 @@ ++diff --git a/cpan/ExtUtils-MakeMaker/lib/ExtUtils/Liblist/Kid.pm b/cpan/ExtUtils-MakeMaker/lib/ExtUtils/Liblist/Kid.pm ++index fbdc79aea2..976fd268aa 100644 ++--- a/cpan/ExtUtils-MakeMaker/lib/ExtUtils/Liblist/Kid.pm +++++ b/cpan/ExtUtils-MakeMaker/lib/ExtUtils/Liblist/Kid.pm ++@@ -20,9 +20,10 @@ use File::Basename; ++ use File::Spec; ++ ++ sub ext { ++- if ( $^O eq 'VMS' ) { goto &_vms_ext; } ++- elsif ( $^O eq 'MSWin32' ) { goto &_win32_ext; } ++- else { goto &_unix_os2_ext; } +++ if ( $Config{usemmldlt} ){ goto &_ld_ext; } +++ elsif ( $^O eq 'VMS' ) { goto &_vms_ext; } +++ elsif ( $^O eq 'MSWin32' ) { goto &_win32_ext; } +++ else { goto &_unix_os2_ext; } ++ } ++ ++ sub _space_dirs_split { ++@@ -643,4 +644,51 @@ sub _vms_ext { ++ wantarray ? ( $lib, '', $ldlib, '', ( $give_libs ? \@flibs : () ) ) : $lib; ++ } ++ +++# A direct test for -l validity. +++# Because guessing real file names for -llib options when dealing +++# with a cross compiler is generally a BAD IDEA^tm. +++sub _ld_ext { +++ my($self,$potential_libs, $verbose, $give_libs) = @_; +++ $verbose ||= 0; +++ +++ if ($^O =~ 'os2' and $Config{perllibs}) { +++ # Dynamic libraries are not transitive, so we may need including +++ # the libraries linked against perl.dll again. +++ +++ $potential_libs .= " " if $potential_libs; +++ $potential_libs .= $Config{perllibs}; +++ } +++ return ("", "", "", "", ($give_libs ? [] : ())) unless $potential_libs; +++ warn "Potential libraries are '$potential_libs':\n" if $verbose; +++ +++ my($ld) = $Config{ld}; +++ my($ldflags) = $Config{ldflags}; +++ my($libs) = defined $Config{perllibs} ? $Config{perllibs} : $Config{libs}; +++ +++ my $try = 'try_mm.c'; +++ my $tryx = 'try_mm.x'; +++ open(TRY, '>', $try) || die "Can't create MakeMaker test file $try: $!\n"; +++ print TRY "int main(void) { return 0; }\n"; +++ close(TRY); +++ +++ my $testlibs = ''; +++ my @testlibs = (); +++ foreach my $thislib (split ' ', $potential_libs) { +++ $testlibs = join(' ', @testlibs); +++ if($thislib =~ /^-L/) { +++ push(@testlibs, $thislib); +++ next +++ }; +++ my $cmd = "$ld $ldflags -o $tryx $try $testlibs $thislib >/dev/null 2>&1"; +++ my $ret = system($cmd); +++ warn "Warning (mostly harmless): " . "No library found for $thislib\n" if $ret; +++ next if $ret; +++ push @testlibs, $thislib; +++ } +++ unlink($try); +++ unlink($tryx); +++ +++ return (join(' ', @testlibs), '', join(' ', @testlibs), ''); +++} +++ ++ 1; +diff --git a/cnf/diffs/perl5-5.42.3/makemaker.patch b/cnf/diffs/perl5-5.42.3/makemaker.patch +new file mode 120000 +index 0000000..d7bd609 +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/makemaker.patch +@@ -0,0 +1 @@ ++../perl5-5.38.0/makemaker.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/posix-makefile.patch b/cnf/diffs/perl5-5.42.3/posix-makefile.patch +new file mode 120000 +index 0000000..29463b7 +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/posix-makefile.patch +@@ -0,0 +1 @@ ++../perl5-5.22.3/posix-makefile.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/test-checkcase.patch b/cnf/diffs/perl5-5.42.3/test-checkcase.patch +new file mode 120000 +index 0000000..36c5186 +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/test-checkcase.patch +@@ -0,0 +1 @@ ++../perl5-5.22.3/test-checkcase.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/test-makemaker.patch b/cnf/diffs/perl5-5.42.3/test-makemaker.patch +new file mode 120000 +index 0000000..4e970ff +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/test-makemaker.patch +@@ -0,0 +1 @@ ++../perl5-5.34.0/test-makemaker.patch +\ No newline at end of file +diff --git a/cnf/diffs/perl5-5.42.3/xconfig.patch b/cnf/diffs/perl5-5.42.3/xconfig.patch +new file mode 100644 +index 0000000..a65609b +--- /dev/null ++++ b/cnf/diffs/perl5-5.42.3/xconfig.patch +@@ -0,0 +1,48 @@ ++perl-cross assumes the sources use xconfig.h with -DUSE_CROSS_COMPILE ++With perl 5.20.0, it's no longer true. Regardless of what mainline perl ++uses, let's stick with the old xconfig.h way for now. ++ ++--- a/perl.h +++++ b/perl.h ++@@ -43,7 +43,11 @@ ++ */ ++ /* #define PERL_RC_STACK */ ++ ++-#include "config.h" +++#ifndef USE_CROSS_COMPILE +++# include "config.h" +++#else +++# include "xconfig.h" +++#endif ++ ++ /* This fakes up using Mingw for locale handling. In order to not define WIN32 ++ * in this file (and hence throughout the code that isn't expecting it), this ++--- a/perl_langinfo.h +++++ b/perl_langinfo.h ++@@ -4,7 +4,11 @@ ++ #ifndef PERL_LANGINFO_H ++ #define PERL_LANGINFO_H 1 ++ +++#ifdef USE_CROSS_COMPILE +++#include "xconfig.h" +++#else ++ #include "config.h" +++#endif ++ ++ #if defined(I_LANGINFO) ++ # include ++--- a/locale.c +++++ b/locale.c ++@@ -327,7 +327,11 @@ ++ * initialization. This is done before option parsing, and before any thread ++ * creation, so can be a file-level static. (Must come before #including ++ * perl.h) */ ++-#include "config.h" +++#ifndef USE_CROSS_COMPILE +++# include "config.h" +++#else +++# include "xconfig.h" +++#endif ++ ++ /* Returns the Unix errno portion; ignoring any others. This is a macro here ++ * instead of putting it into perl.h, because unclear to khw what should be diff --git a/meta/recipes-devtools/perl-cross/perlcross_1.6.4.bb b/meta/recipes-devtools/perl-cross/perlcross_1.6.4.bb index 3c544c9746..584c08defa 100644 --- a/meta/recipes-devtools/perl-cross/perlcross_1.6.4.bb +++ b/meta/recipes-devtools/perl-cross/perlcross_1.6.4.bb @@ -15,6 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/${PV}/perl-cross-${PV}.tar.gz;name=perl-c file://0001-perl-cross-add-LDFLAGS-when-linking-libperl.patch \ file://determinism.patch \ file://0001-Makefile-check-the-file-if-patched-or-not.patch \ + file://0001-perl-cross-add-patches-for-perl-5.42.3.patch \ " GITHUB_BASE_URI = "https://github.com/arsv/perl-cross/releases/" From patchwork Thu Nov 5 17:02:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 103151 X-Patchwork-Delegate: yoann.congal@smile.fr Received: from AM0PR02CU008.outbound.protection.outlook.com (AM0PR02CU008.outbound.protection.outlook.com [52.101.72.26]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.990.1793898176790299197 for ; Thu, 05 Nov 2026 09:02:58 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=MU72v4oS; spf=pass (domain: est.tech, ip: 52.101.72.26, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=iOqF2YXbYP7T2/zo5Q89t17ez+cbHgynKza63ZK8UdilIQi8LAqMqYft7Q9QOxAcC1jTVWEcUk2tQ0fe1ta5iFfUeBwhkBIVz3PvwGyoWXEFltrOsV82h99UNlhV/824Gh2EQbgQjuHe4uhPsE7gPysGLDr/kmQd05hZj0DKctfoLwKwVF2zJ6VftP8KeZsxn37Tzz6wQxsGQhJG3yaF6Ne+RmF1sodS+n1zyV9F6xIguIIpxlpyFCjfhCb/2s6eNMf2r9f3Ls88ItaQOLZFusz9OPdLj6r5qx0WmwLLx4eJW5XpUNpYAJFs0zOXx0gzCkjfovMUgNgH4ee5J67PEg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=52ZIqzkMBs6w6XTYLu8BRWH4doQZn/Id7C4addn/qI4=; b=ulX56qmw5nXXpKvDHd/uDIPVY1JmKn2nd3Qs5IbbRffiSeZEIMuVovWflAZMz8b+2lJ/VB/O0WTXZy3w37UBB/9OYXi3LVzwkPi5mRasXzbcMX/7nIS77fgSo5P28BlPa0q6rOOkN9ZikESmm4C3b3S/7H82iTXA/ozG1exufwzmNnvWVZHB7H49bsAMhdvz1/hLTYg4DpcsGSwaOYWS2cTComnUey4e0uDod8zxn+M3r+2aGgPlyPI0OeNcnLVZVPhGIFTdne52Rw2TPtjDXlHoRr4ge2rT8f3op93iPnpkd+Wuy3oimYeOBhzPG6qok1HSb8JmVAlwM+84dbQydw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=52ZIqzkMBs6w6XTYLu8BRWH4doQZn/Id7C4addn/qI4=; b=MU72v4oSW9ej9ZEw+gQwQLe/KfOBhJJ2wScB9zSPVnKQVd7Anj6mMsXJZpPhqKqXhPmD5EAYPZ2/2LyfUgJ+fhs6EztklPbmh3/DcnxHWwO+WXES3QHv4nhJUQp1bjZTxWrXzNc8kNpiS8254Oeu4hV/HGLITcw1RaKX9f7u/IqbszRajBHkSITZCrUvp5BtbpIRDOm2zjkb/+unQ8GJ1UcYqpiomhbfXZCxfCQhcULX9gNrBWolSq2/CbpUXLY6UYVuoJgoTFxADb0hFC6cLNfMugS0jnQhFY9oA0lcvzst9vERgUtBFLZu90jlXu9mJq03Qikl7QVXBl0J89e4Ng== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from AM6P189MB3107.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6c0::19) by PAWP189MB2527.EURP189.PROD.OUTLOOK.COM (2603:10a6:102:358::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.10; Thu, 5 Nov 2026 17:02:53 +0000 Received: from AM6P189MB3107.EURP189.PROD.OUTLOOK.COM ([fe80::bc97:3847:8f02:acb]) by AM6P189MB3107.EURP189.PROD.OUTLOOK.COM ([fe80::bc97:3847:8f02:acb%6]) with mapi id 15.21.0592.009; Thu, 5 Nov 2026 17:02:53 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org Subject: [wrynose][PATCH 2/2] perl: upgrade 5.42.0 -> 5.42.3 Date: Thu, 5 Nov 2026 18:02:49 +0100 Message-ID: <20261105170249.55552-2-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20261105170249.55552-1-jaipaul.cheernam@est.tech> References: <20261105170249.55552-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DUZPR01CA0318.eurprd01.prod.exchangelabs.com (2603:10a6:10:4ba::7) To AM6P189MB3107.EURP189.PROD.OUTLOOK.COM (2603:10a6:20b:6c0::19) Return-Path: jaipaul.cheernam@est.tech MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM6P189MB3107:EE_|PAWP189MB2527:EE_ X-MS-Office365-Filtering-Correlation-Id: 2d86fc85-b0ee-4fcb-eb3c-08df3b5ea164 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|23010399003|1800799024|261026121527099003|261026140227099003|261022075727099003|261022105027099003|261102123227099003|261021121427099003|261022113327099003|261028144727099003|261021123027099003|10067099003|260925021311599003|11063799006|260925022911599003|260925021911599003|261009223027099003|6133799003|22082099003|12006099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: kZ/S3FsXgAGeVQ+1qncCi3SHtPlqZWZLiLwG8PrnXNsjVcYN11UIq7LNC/yT0w/YJ5jrsTU909eRKthOZKTnS86Cj2hMB3zi7dfib60ajcLyI/u5sOFWvfoQQf5rQLN7sSUzN8bw+/m/jmqoK0TCEcqALz6yGCNJVSoP5DcI11r1YL5ROGdwc8HQVzyivvukj4CbUzUfMuXF3Mefp2Y4ftAZhWXGNnxQb9ijxoVc0J2yNC0DliVXj7uxviuVSMd+ygbNNmNTAo7Ww+s/yP2cndRacqt/Ce9rl1+adZ9lgw1c0WlkmKelcSVbPIZXJrq9qTpJMXTPd1d3FIkZZJgYBK+OncJSXNNMD90UZlcKmTIpgVKYgMDkdxOqt+qrhjJGjt9lfxVDPE7biVCkj7/l32BG7owXU2gcpAL5wNJEMHRRcaRR19ca/l96PUz0kmcpOsGs7r9rYXYtrxxKBj3c8Sk/x46BJoVw9oerBoeb9I48Il8Hzr7pXGCwiPZSXbtCpVEYRHBSN7sX1D5V04b+Mg1wxMo3D0+EbQ35XIklvdgGf/xMR4bcgk20/vxStnm6ICqJEX89vPeYJmtrGzHktSHZlvsc9gvIvIGOf3imlLXYXtc7W8aM+j/SdDf4P29T X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM6P189MB3107.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(23010399003)(1800799024)(261026121527099003)(261026140227099003)(261022075727099003)(261022105027099003)(261102123227099003)(261021121427099003)(261022113327099003)(261028144727099003)(261021123027099003)(10067099003)(260925021311599003)(11063799006)(260925022911599003)(260925021911599003)(261009223027099003)(6133799003)(22082099003)(12006099003)(18002099003)(56012099006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 5tcBLSuhe32biCKx/5kCIsqCuQvnmGcaGFbQYRrT+PWVQ8IJ86xIblb117x2EI6B0TLwp4REtN6JH53lNoekkpXUFXd9fmHaRF2T08M1ER3P1cs/yad7URw8Sez/eDRx1UM1kboo+71I/sPRdQJ4BL28Ch1zsba69r0iz4IcpXGqhoDrEJWCa9JKUFJP6euf1GRjI4QulmRYqg3pInWiVU5s90LQNVLzqzFxCbW2QjH5M5CZ08fhaelPO5bD+uHM8nA8oFCLFnKN7H6SYOFuRNQ4G74WbCPnj3p9XtWflsypkPTYpHZj5Drfq1AxCepFDHXAqixS0aoWjJ0jCt3hgFaQ6HTU61fs0Lni0wzMkMM1TkClcxI+Pno5NkP6KA1iOnFe59Yk+79C1FWXn+xFIp2ihlSPFqJFy3fx4xKDMp5bkc65bH/spf5IFyoMx70Em11VIprUzAR9P+VMQ5Nwocxcotc/wogN7HJx9wtn59QqAS5QB2WDeKWF86tSbx/XoH6KClrEsz680OlZ1qlTo7jebtwguGKVTkg0xaiJ/MrltkTIZpXeG0SIsF/7gvMAc9xol47EfIRfxcafo9zGHO8L4rlr+AL8IHGwsn5llMTLm9Q+lMtFlMVay+42phKQ39rtuOj3xXL9+C4JuXm+lKvhDu1Q9QSSN58Q+WYH4Bfp1yF2Q2vPF2wLQfsSEBTR/HwEEqXEpplJl4nIppKyNRDOCtkWx4CgGul3a2yHWgi51UxiVJvz5JadwfRXdwkKlFwwJogObZT7CW9Tw5vtLrKCXWHhrxuL0KMwJr18zrkPvkvQ+sOvgMy+A+vkWoYLhwk7qKstt61Q14IC3kdx0+3XPNlRXJR/Z5EOQa6/AmFlRNeTLpzX5lK78KxYGEFXknmYzadRI3sUc+/76mwuO1rFxbyy14yUhEzQpVfM8RpLc8iYD4cUgirkAukajbwazurN3mMvwJLN+Xsk/nSDWfQwzWn9v4VpRrrZcuuKjv4YjoFNWz49c/cU/chn5Gx7r59tmjg5TsgGPjjVz0Q/jSOjVm/5iOSLCjFUEBC5/3V2M6CnU/2re7Rf+jyEFcMcrCw9xigYSy69fCNn70TWu7mCIEDb3FwaY29QMIHuQchSVu3B0wQ8yQ9N3lUVuu96OTtUMd8fQp+qlviqT2Ifp19rekN4va7G7Quy56Sc5wUECOdZLaqMfpaJxQgMKaLuWW+Xo5Au5gLHaQz5QIMZxrJH7mEwheEPvoZ1VnvsNaHvh9z1NdpocvmjpmM5XGOAzIIAOrxJ1LyCGA0hWOH2LsYK173YwCOGUelWokFv5/4EA05pEcHLTV9qt5UW4DJKgbE1k4zoKIZEOzNAqHqp+CT6zks83ZL9Vn7IgY175ZpL/KC4G/YgYy6ZXRBTVZDBJbNh67tjlqto9lCy8hQ4xh6+lvPNQaE1PUkBpYbLkSqgC4Ayj2maC/GGqJJflrlLkr07fmKLrLACy+mDslU6YfpeF7P+LolwI9dxzhRw5/xsPkoyaDOZbxEpMsHfzJtaGriXvcocP3WbPNNU6t3kXtLYVgDt8zttl6aNBhvnK1AqqvQOnKtLwfqadnaBMvewUS3o8YAXSWUzru9JCV8CMCC8l1/LqGsXJ6Y7EBWcQIfHLpZo5h5EoHZ6t2qBIiysJFDuLCCBSU9+0zUtpieyl6HNNkGsFcWJd/p2mfCfpCTTp+HMLHJp2IKMsecgvVBkmSnZC8iTT7KDEAtego1YnA== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 2d86fc85-b0ee-4fcb-eb3c-08df3b5ea164 X-MS-Exchange-CrossTenant-AuthSource: AM6P189MB3107.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Nov 2026 17:02:53.2151 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 3Bu9QP4qXxM3NoOUAr/i7rVL1mZqWznLoej+oH0Tp8DyCTTUkahM6cQ6lepFmw2JSV+jIcvXPN0vCOrgkXHZlV0YvhUDefUPHZP6gRoS1uY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWP189MB2527 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 17:03:06 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249567 ReleaseInfo: https://perldoc.perl.org/5.42.3/perl5423delta - CVE-2026-8376: buffer overflow in Perl_study_chunk (regcomp_study.c) from checking substring buffer size in characters instead of bytes - CVE-2026-57432: buffer overflow in S_measure_struct via pack/unpack on an oversized structure - CVE-2026-13221: regex trie 16-bit field overflow with >~65k alternation branches - CVE-2026-57433: Storable.xs signed int overflow unpacking hook data - Archive::Tar bumped 3.04 -> 3.12, including symlink/hardlink path traversal fix (CVE-2026-42496) All of the above are fixed upstream in 5.42.3, so the local CVE backport patches are dropped. Signed-off-by: Jaipaul Cheernam --- .../perl/files/CVE-2026-13221.patch | 75 -------------- .../perl/files/CVE-2026-42496.patch | 99 ------------------- .../perl/files/CVE-2026-57432-01.patch | 52 ---------- .../perl/files/CVE-2026-57432-02.patch | 34 ------- .../perl/files/CVE-2026-57433.patch | 32 ------ .../perl/files/CVE-2026-8376-01.patch | 62 ------------ .../perl/files/CVE-2026-8376-02.patch | 49 --------- .../perl/{perl_5.42.0.bb => perl_5.42.3.bb} | 9 +- 8 files changed, 1 insertion(+), 411 deletions(-) delete mode 100644 meta/recipes-devtools/perl/files/CVE-2026-13221.patch delete mode 100644 meta/recipes-devtools/perl/files/CVE-2026-42496.patch delete mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch delete mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch delete mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57433.patch delete mode 100644 meta/recipes-devtools/perl/files/CVE-2026-8376-01.patch delete mode 100644 meta/recipes-devtools/perl/files/CVE-2026-8376-02.patch rename meta/recipes-devtools/perl/{perl_5.42.0.bb => perl_5.42.3.bb} (98%) diff --git a/meta/recipes-devtools/perl/files/CVE-2026-13221.patch b/meta/recipes-devtools/perl/files/CVE-2026-13221.patch deleted file mode 100644 index 03396f3e43..0000000000 --- a/meta/recipes-devtools/perl/files/CVE-2026-13221.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 03f74bbbd3a68350d926ee93d56ee4808c28c4c7 Mon Sep 17 00:00:00 2001 -From: Karl Williamson -Date: Thu, 26 Mar 2026 10:13:49 -0600 -Subject: [PATCH] regcomp_study: Don't create a trie that would overflow - -This addresses GH #23388 - -The design of the trie compiling code is to batch extra long tries into -smaller chunks that fit into whatever limitations there are. However, -this ticket shows that that isn't always being done. - -In this case, a bunch of branches that have TAIL operands can be -combined together, and the final TAIL is used. And the code requires -that the delta between the first branch and this final TAIL fit into a -16-bit field. That is the root cause of this bug. - -I'm not familiar enough with the trie construction code to easily -understand why the final tail needs to be used here. So this patch -simply doesn't optimize a sequence of branches into a trie that would -overflow. - -This could be revisited by someone who knows more about this than I, or -earlier in the development cycle. - -CVE: CVE-2026-13221 -Upstream-Status: Backport [https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7] -Signed-off-by: Jaipaul Cheernam ---- - regcomp_study.c | 10 ++++++++++ - t/re/pat_advanced.t | 9 +++++++++ - 2 files changed, 19 insertions(+) - -diff --git a/regcomp_study.c b/regcomp_study.c -index db7ab3a409..a1b2c3d4e5 100644 ---- a/regcomp_study.c -+++ b/regcomp_study.c -@@ -1933,6 +1933,16 @@ Perl_study_chunk(pTHX_ - tail = regnext( tail ); - } - -+ /* The code below currently saves the difference from -+ * start to finish in a 16-bit field, causing -+ * GH #23388. This defeats the design of batching -+ * tries into chunks that each fit. khw thinks it is -+ * too late in the 5.44 cycle to relook at the design, -+ * so for now anyway, don't make a trie that would -+ * overflow */ -+ if (tail - startbranch >= U16_MAX) { -+ continue; -+ } - - DEBUG_TRIE_COMPILE_r({ - regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state); -diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t -index 398680838d..c9e389ecb3 100644 ---- a/t/re/pat_advanced.t -+++ b/t/re/pat_advanced.t -@@ -4898,6 +4898,15 @@ EOF_DEBUG_OUT - $x =~ s/^[\x{0301}\x{030C}]+//; - } - -+ { # GH #23388 -+ fresh_perl_is(<<~'PROG', , "", {}, "Avoid trie overflow"); -+ my $x = join "|", "aaa".."mzz"; -+ my $y = join "|", "naa".."zzz"; -+ use re 'Debug'; -+ "fnord" =~ m/(?:$x)|(?:$y)/; -+ PROG -+ } -+ - - # !!! NOTE that tests that aren't at all likely to crash perl should go - # a ways above, above these last ones. There's a comment there that, like --- -2.43.0 diff --git a/meta/recipes-devtools/perl/files/CVE-2026-42496.patch b/meta/recipes-devtools/perl/files/CVE-2026-42496.patch deleted file mode 100644 index ae370340cf..0000000000 --- a/meta/recipes-devtools/perl/files/CVE-2026-42496.patch +++ /dev/null @@ -1,99 +0,0 @@ -From edde2083c6e93e42b979068af5529710b5e2a7ab Mon Sep 17 00:00:00 2001 -From: Stig Palmquist -Date: Thu, 21 May 2026 19:59:21 +0100 -Subject: [PATCH] Validate symlink and hardlink linkname in SECURE MODE - -Archive::Tar before 3.08 passes the tar header's linkname directly to -symlink()/link() in _make_special_file() without validating absolute -paths or '..' segments. This allows a crafted tar archive to create -symlinks or hardlinks targeting paths outside the extraction directory, -leading to arbitrary file read/write. - -Add validation in SECURE EXTRACT MODE (the default) to reject: -- Symlink/hardlink targets with absolute paths -- Symlink/hardlink targets containing '..' path traversal - -Adjusted patch paths from upstream Archive::Tar standalone repository -(lib/Archive/Tar.pm) to match perl5 source tree layout -(cpan/Archive-Tar/lib/Archive/Tar.pm). - -Upstream-Status: Backport [https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158] - -CVE: CVE-2026-42496 -CVE: CVE-2026-42497 - -Signed-off-by: Chris 'BinGOs' Williams -Signed-off-by: Abhishek Bachiphale ---- - cpan/Archive-Tar/lib/Archive/Tar.pm | 30 +++++++++++++++++++++++++ - cpan/Archive-Tar/t/04_resolved_issues.t | 2 ++ - 2 files changed, 32 insertions(+) - -diff --git a/cpan/Archive-Tar/lib/Archive/Tar.pm b/cpan/Archive-Tar/lib/Archive/Tar.pm -index 2df0931..733feef 100644 ---- a/cpan/Archive-Tar/lib/Archive/Tar.pm -+++ b/cpan/Archive-Tar/lib/Archive/Tar.pm -@@ -954,6 +954,19 @@ sub _make_special_file { - my $err; - - if( $entry->is_symlink ) { -+ if( !$INSECURE_EXTRACT_MODE ) { -+ my $linkname = $entry->linkname; -+ if( File::Spec->file_name_is_absolute($linkname) ) { -+ $self->_error( qq[Symlink '] . $entry->full_path . -+ qq[' has absolute target. Not extracting under SECURE EXTRACT MODE] ); -+ return; -+ } -+ if( grep { $_ eq '..' } File::Spec->splitdir($linkname) ) { -+ $self->_error( qq[Symlink '] . $entry->full_path . -+ qq[' target attempts traversal. Not extracting under SECURE EXTRACT MODE] ); -+ return; -+ } -+ } - my $fail; - if( ON_UNIX ) { - symlink( $entry->linkname, $file ) or $fail++; -@@ -967,6 +980,23 @@ sub _make_special_file { - $entry->linkname .q[' failed] if $fail; - - } elsif ( $entry->is_hardlink ) { -+ if( !$INSECURE_EXTRACT_MODE ) { -+ my $linkname = $entry->linkname; -+ if( File::Spec->file_name_is_absolute($linkname) ) { -+ $self->_error( qq[Hardlink '] . $entry->full_path . -+ qq[' has absolute target '$linkname'. Not extracting ] . -+ qq[under SECURE EXTRACT MODE: extraction itself chmods ] . -+ qq[the shared inode.] ); -+ return; -+ } -+ if( grep { $_ eq '..' } File::Spec->splitdir($linkname) ) { -+ $self->_error( qq[Hardlink '] . $entry->full_path . -+ qq[' target '$linkname' attempts traversal. Not ] . -+ qq[extracting under SECURE EXTRACT MODE: extraction ] . -+ qq[itself chmods the shared inode.] ); -+ return; -+ } -+ } - my $fail; - if( ON_UNIX ) { - link( $entry->linkname, $file ) or $fail++; -diff --git a/cpan/Archive-Tar/t/04_resolved_issues.t b/cpan/Archive-Tar/t/04_resolved_issues.t -index b3566a1..08d339a 100644 ---- a/cpan/Archive-Tar/t/04_resolved_issues.t -+++ b/cpan/Archive-Tar/t/04_resolved_issues.t -@@ -220,6 +220,7 @@ if ($^O ne 'msys') # symlink tests fail on Windows/msys2 - } - - { #use case 1 - in memory extraction -+ local $Archive::Tar::INSECURE_EXTRACT_MODE=1; - my $t=Archive::Tar->new; - $t->read( $archname ); - my $r = eval{ $t->extract }; -@@ -231,6 +232,7 @@ if ($^O ne 'msys') # symlink tests fail on Windows/msys2 - - { #use case 2 - iter extraction - #$DB::single = 2; -+ local $Archive::Tar::INSECURE_EXTRACT_MODE=1; - my $next=Archive::Tar->iter( $archname, 1 ); - my $failed = 0; - #use Data::Dumper; diff --git a/meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch b/meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch deleted file mode 100644 index ef92b0d7b2..0000000000 --- a/meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 5f7eb6bbbe0510964e3fb1d6bb691e5445913e55 Mon Sep 17 00:00:00 2001 -From: "Paul \"LeoNerd\" Evans" -Date: Sat, 9 May 2026 17:18:43 +0100 -Subject: [PATCH] pp_pack.c: Avoid ssize_t overflow when calculating the size - of a structure - -If the user has requested a size that would overflow a SSize_t, then the -only sensible thing to do is throw an exception, because the structure -this implies couldn't possibly fit into memory anyway. - -CVE: CVE-2026-57432 -Upstream-Status: Backport [https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55] -Signed-off-by: Jaipaul Cheernam ---- - pod/perldiag.pod | 6 ++++++ - pp_pack.c | 4 ++++ - 2 files changed, 10 insertions(+) - -diff --git a/pod/perldiag.pod b/pod/perldiag.pod -index 841e22d580..d9231077363d 100644 ---- a/pod/perldiag.pod -+++ b/pod/perldiag.pod -@@ -4880,6 +4880,12 @@ mixed-case attribute name, instead. See L. - (F) You can't specify a repeat count so large that it overflows your - signed integers. See L. - -+=item Pack template structure size is too large -+ -+(F) You called C or C to operate on a structure, whose -+computed size is too large to fit in memory. This usually happens as a -+result of embedding a large number as the repeat count for an item. -+ - =item page overflow - - (W io) A single call to write() produced more lines than can fit on a -diff --git a/pp_pack.c b/pp_pack.c -index b5c0b261ef..6075e83aac 100644 ---- a/pp_pack.c -+++ b/pp_pack.c -@@ -528,6 +528,10 @@ S_measure_struct(pTHX_ tempsym_t* symptr) - break; - } - } -+ if ((size > 0) && -+ ((len > SSize_t_MAX / size) || /* detect overflow of len * size */ -+ (len * size > SSize_t_MAX - total))) /* detect overflow of total + len * size */ -+ croak("Pack template structure size is too large"); - total += len * size; - } - return total; --- -2.43.0 diff --git a/meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch b/meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch deleted file mode 100644 index 273a247a88..0000000000 --- a/meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 40754edc72dd3e513d758153c0e2f0215897740e Mon Sep 17 00:00:00 2001 -From: "Paul \"LeoNerd\" Evans" -Date: Mon, 11 May 2026 12:25:33 +0100 -Subject: [PATCH] pp_pack.c: Avoid some other potential overflows when - calculating sizes - -CVE: CVE-2026-57432 -Upstream-Status: Backport [https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e] -Signed-off-by: Jaipaul Cheernam ---- - pp_pack.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/pp_pack.c b/pp_pack.c -index 6075e83aac..b2019902203a 100644 ---- a/pp_pack.c -+++ b/pp_pack.c -@@ -515,12 +515,12 @@ S_measure_struct(pTHX_ tempsym_t* symptr) - break; - case 'B': - case 'b': -- len = (len + 7)/8; -+ len = (len / 8) + !!(len % 8); - size = 1; - break; - case 'H': - case 'h': -- len = (len + 1)/2; -+ len = (len / 2) + !!(len % 2); - size = 1; - break; - --- -2.43.0 diff --git a/meta/recipes-devtools/perl/files/CVE-2026-57433.patch b/meta/recipes-devtools/perl/files/CVE-2026-57433.patch deleted file mode 100644 index f0ea08b1fe..0000000000 --- a/meta/recipes-devtools/perl/files/CVE-2026-57433.patch +++ /dev/null @@ -1,32 +0,0 @@ -From e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7 Mon Sep 17 00:00:00 2001 -From: "Paul \"LeoNerd\" Evans" -Date: Sat, 9 May 2026 16:47:14 +0100 -Subject: [PATCH] Storable.xs: Avoid signed int overflow when unpacking a list - of hook data items - -Upstream-Status: Backport [https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7] -CVE: CVE-2026-57433 -Signed-off-by: Vijay Anusuri ---- - dist/Storable/Storable.xs | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/dist/Storable/Storable.xs b/dist/Storable/Storable.xs -index 3930db6..62a1a6d 100644 ---- a/dist/Storable/Storable.xs -+++ b/dist/Storable/Storable.xs -@@ -5035,7 +5035,10 @@ static SV *retrieve_hook_common(pTHX_ stcxt_t *cxt, const char *cname, int large - } - else - GETMARK(len3); -- if (len3) { -+ if (len3 == I32_MAX) -+ /* If len3 is exactly I32_MAX it will upset av_extend below */ -+ CROAK(("Invalid count of hook data items")); -+ else if (len3) { - av = newAV(); - av_extend(av, len3 + 1); /* Leave room for [0] */ - AvFILLp(av) = len3; /* About to be filled anyway */ --- -2.43.0 - diff --git a/meta/recipes-devtools/perl/files/CVE-2026-8376-01.patch b/meta/recipes-devtools/perl/files/CVE-2026-8376-01.patch deleted file mode 100644 index af94eec29c..0000000000 --- a/meta/recipes-devtools/perl/files/CVE-2026-8376-01.patch +++ /dev/null @@ -1,62 +0,0 @@ -From fd23f4370d24d00352d1cc09b16687f16da6ae5b Mon Sep 17 00:00:00 2001 -From: Tony Cook -Date: Tue, 12 May 2026 14:47:31 +1000 -Subject: [PATCH 1/2] perl/perl-security#147: test cases - -The suggested case from the ticket and an alternative. - -(cherry picked from commit e842efdafe7c51a687a4907e4887988fe6a025ef) - -CVE: CVE-2026-8376 -Upstream-Status: Backport [https://github.com/Perl/perl5/commit/e842efdafe7c51a687a4907e4887988fe6a025ef] -Signed-off-by: Theo Gaige (Schneider Electric) ---- - t/re/pat_psycho.t | 18 ++++++++++++++++-- - 1 file changed, 16 insertions(+), 2 deletions(-) - -diff --git a/t/re/pat_psycho.t b/t/re/pat_psycho.t -index 336039521d..73a7992372 100644 ---- a/t/re/pat_psycho.t -+++ b/t/re/pat_psycho.t -@@ -10,7 +10,7 @@ - use strict; - use warnings; - use 5.010; -- -+use Config; - - sub run_tests; - -@@ -31,7 +31,7 @@ BEGIN { - - skip_all('$PERL_SKIP_PSYCHO_TEST set') if $ENV{PERL_SKIP_PSYCHO_TEST}; - --plan tests => 15; # Update this when adding/deleting tests. -+plan tests => 17; # Update this when adding/deleting tests. - - run_tests() unless caller; - -@@ -211,6 +211,20 @@ EOF - - - } -+ -+ SKIP: -+ { # sec #147 -+ $Config{ptrsize} == 4 -+ or skip "these only fail on x32 and use too much memory on x64", 2; -+ local $::TODO = "This crashes"; -+ # original case -+ fresh_perl_like('/\x{10000}{1073741824}/', -+ qr/Regexp out of space/, {}, "ssize_t overflow"); -+ -+ # synthesized but similar case -+ fresh_perl_like('/(?:\x{10001}\x{10000}){536870912}/', -+ qr/Regexp out of space/, {}, "ssize_t overflow again"); -+ } - } # End of sub run_tests - - 1; --- -2.43.0 - diff --git a/meta/recipes-devtools/perl/files/CVE-2026-8376-02.patch b/meta/recipes-devtools/perl/files/CVE-2026-8376-02.patch deleted file mode 100644 index 39b3d510fe..0000000000 --- a/meta/recipes-devtools/perl/files/CVE-2026-8376-02.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 49c18d4c91d5b49e0a7cbb8277f3149198004c36 Mon Sep 17 00:00:00 2001 -From: Tony Cook -Date: Tue, 12 May 2026 14:51:00 +1000 -Subject: [PATCH 2/2] perl/perl-security#147: test against the actual character - lengths - -(cherry picked from commit 5e7f119eb2bb1181be908701f22bf7068e722f1c) - -CVE: CVE-2026-8376 -Upstream-Status: Backport [https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c] -Signed-off-by: Theo Gaige (Schneider Electric) ---- - regcomp_study.c | 7 +++++++ - t/re/pat_psycho.t | 1 - - 2 files changed, 7 insertions(+), 1 deletion(-) - -diff --git a/regcomp_study.c b/regcomp_study.c -index 9106452dd5..05f1b017b1 100644 ---- a/regcomp_study.c -+++ b/regcomp_study.c -@@ -2770,6 +2770,13 @@ Perl_study_chunk(pTHX_ - (U8 *) SvEND(data->last_found)) - - (U8*)s; - l -= old; -+ -+ if (l > 0 && -+ (mincount >= SSize_t_MAX / (SSize_t)l -+ || old > SSize_t_MAX - mincount * (SSize_t)l)) { -+ FAIL("Regexp out of space"); -+ } -+ - /* Get the added string: */ - last_str = newSVpvn_utf8(s + old, l, UTF); - last_chrs = UTF ? utf8_length((U8*)(s + old), -diff --git a/t/re/pat_psycho.t b/t/re/pat_psycho.t -index 73a7992372..9fd764fd5e 100644 ---- a/t/re/pat_psycho.t -+++ b/t/re/pat_psycho.t -@@ -216,7 +216,6 @@ EOF - { # sec #147 - $Config{ptrsize} == 4 - or skip "these only fail on x32 and use too much memory on x64", 2; -- local $::TODO = "This crashes"; - # original case - fresh_perl_like('/\x{10000}{1073741824}/', - qr/Regexp out of space/, {}, "ssize_t overflow"); --- -2.43.0 - diff --git a/meta/recipes-devtools/perl/perl_5.42.0.bb b/meta/recipes-devtools/perl/perl_5.42.3.bb similarity index 98% rename from meta/recipes-devtools/perl/perl_5.42.0.bb rename to meta/recipes-devtools/perl/perl_5.42.3.bb index 886eaaaa37..1a8b0e11ee 100644 --- a/meta/recipes-devtools/perl/perl_5.42.0.bb +++ b/meta/recipes-devtools/perl/perl_5.42.3.bb @@ -16,13 +16,6 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ file://0002-Constant-Fix-up-shebang.patch \ file://determinism.patch \ file://0001-cpan-Sys-Syslog-Makefile.PL-Fix-_PATH_LOG-for-determ.patch \ - file://CVE-2026-8376-01.patch \ - file://CVE-2026-8376-02.patch \ - file://CVE-2026-13221.patch \ - file://CVE-2026-57432-01.patch \ - file://CVE-2026-57432-02.patch \ - file://CVE-2026-42496.patch \ - file://CVE-2026-57433.patch \ " SRC_URI:append:class-native = " \ file://perl-configpm-switch.patch \ @@ -31,7 +24,7 @@ SRC_URI:append:class-target = " \ file://encodefix.patch \ " -SRC_URI[perl.sha256sum] = "e093ef184d7f9a1b9797e2465296f55510adb6dab8842b0c3ed53329663096dc" +SRC_URI[perl.sha256sum] = "1137740985837b5cdf15f0cfab932279dcb4352f912fed6fc144e8b4f0823627" B = "${WORKDIR}/perl-${PV}-build"