head 1.2; access; symbols pkgsrc-2026Q2:1.1.0.4 pkgsrc-2026Q2-base:1.1 pkgsrc-2026Q1:1.1.0.2; locks; strict; comment @# @; 1.2 date 2026.07.16.18.57.37; author wiz; state dead; branches; next 1.1; commitid cnixJgiQyaTQwUNG; 1.1 date 2026.05.27.22.35.30; author wiz; state Exp; branches 1.1.2.1; next ; commitid QGw1UsX5Kez9lvHG; 1.1.2.1 date 2026.05.27.22.35.30; author maya; state dead; branches; next 1.1.2.2; commitid 7Lex1JUIlSbPTaJG; 1.1.2.2 date 2026.06.09.22.30.58; author maya; state Exp; branches; next ; commitid 7Lex1JUIlSbPTaJG; desc @@ 1.2 log @perl: update to 5.44.0. Core Enhancements Named Parameters in Signatures Multi-variable foreach can now use aliased references Enhanced operation of regular expression patterns under /xx Unicode 17.0 is supported New source of entropy for PRNG seeding Security CVE-2026-8376 - Buffer overflow in Perl_study_chunk CVE-2026-57432 - Buffer overflow in S_measure_struct CVE-2026-13221 - Regex trie 16-bit field overflow Incompatible Changes Unicode rules are now fully enforced on identifier and regular expression group names. More details at https://metacpan.org/dist/perl/changes @ text @$NetBSD: patch-cpan_Archive-Tar_lib_Archive_Tar.pm,v 1.1 2026/05/27 22:35:30 wiz Exp $ Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch --- cpan/Archive-Tar/lib/Archive/Tar.pm.orig 2026-01-18 16:32:21.000000000 +0000 +++ cpan/Archive-Tar/lib/Archive/Tar.pm @@@@ -24,7 +24,7 @@@@ use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLI use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLINK $CHOWN $CHMOD $DO_NOT_USE_PREFIX $HAS_PERLIO $HAS_IO_STRING $SAME_PERMISSIONS $INSECURE_EXTRACT_MODE $ZERO_PAD_NUMBERS @@ISA @@EXPORT $RESOLVE_SYMLINK - $EXTRACT_BLOCK_SIZE + $EXTRACT_BLOCK_SIZE $MAX_FILE_SIZE ]; @@ISA = qw[Exporter]; @@@@ -41,6 +41,7 @@@@ $EXTRACT_BLOCK_SIZE = 1024 * 1024 * 1024; $ZERO_PAD_NUMBERS = 0; $RESOLVE_SYMLINK = $ENV{'PERL5_AT_RESOLVE_SYMLINK'} || 'speed'; $EXTRACT_BLOCK_SIZE = 1024 * 1024 * 1024; +$MAX_FILE_SIZE = 1024 * 1024 * 1024; BEGIN { use Config; @@@@ -444,6 +445,14 @@@@ sub _read_tar { my $block = BLOCK_SIZE->( $entry->size ); + if ( $MAX_FILE_SIZE && $entry->size > $MAX_FILE_SIZE ) { + $self->_error( qq[Entry '] . $entry->full_path . + qq[' declared size ] . $entry->size . + qq[ bytes exceeds \$Archive::Tar::MAX_FILE_SIZE ] . + qq[($MAX_FILE_SIZE); refusing to allocate] ); + next LOOP; + } + $data = $entry->get_content_by_ref; my $skip = 0; @@@@ -2186,6 +2195,13 @@@@ extraction may fail with an error. cannot be arbitrarily large since some operating systems limit the number of bytes that can be written in one call to C, so if this is too large, extraction may fail with an error. + +=head2 $Archive::Tar::MAX_FILE_SIZE + +This variable holds an upper bound on the per-entry declared size that +C will accept when reading an archive. Entries whose header +claims a larger size are refused with an error before any read allocation. +Defaults to 1 GiB. Set to 0 to disable the cap. =cut @ 1.1 log @perl: fix security problem in Archive::Tar Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header Bump PKGREVISION. @ text @d1 1 a1 1 $NetBSD$ @ 1.1.2.1 log @file patch-cpan_Archive-Tar_lib_Archive_Tar.pm was added on branch pkgsrc-2026Q1 on 2026-06-09 22:30:58 +0000 @ text @d1 54 @ 1.1.2.2 log @Pullup ticket #7132 - requested by taca lang/perl5: Security fix Revisions pulled up: - lang/perl5/Makefile 1.292-1.293 - lang/perl5/distinfo 1.197-1.198 - lang/perl5/patches/patch-cpan_Archive-Tar_lib_Archive_Tar.pm 1.1 - lang/perl5/patches/patch-regcomp__study.c 1.1 --- Module Name: pkgsrc Committed By: wiz Date: Wed May 27 22:28:20 UTC 2026 Modified Files: pkgsrc/lang/perl5: Makefile distinfo Added Files: pkgsrc/lang/perl5/patches: patch-regcomp__study.c Log Message: perl: apply upstream security fix for regex on 32-bit systems. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: wiz Date: Wed May 27 22:35:30 UTC 2026 Modified Files: pkgsrc/lang/perl5: Makefile distinfo Added Files: pkgsrc/lang/perl5/patches: patch-cpan_Archive-Tar_lib_Archive_Tar.pm Log Message: perl: fix security problem in Archive::Tar Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header Bump PKGREVISION. @ text @a0 54 $NetBSD: patch-cpan_Archive-Tar_lib_Archive_Tar.pm,v 1.1 2026/05/27 22:35:30 wiz Exp $ Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch --- cpan/Archive-Tar/lib/Archive/Tar.pm.orig 2026-01-18 16:32:21.000000000 +0000 +++ cpan/Archive-Tar/lib/Archive/Tar.pm @@@@ -24,7 +24,7 @@@@ use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLI use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLINK $CHOWN $CHMOD $DO_NOT_USE_PREFIX $HAS_PERLIO $HAS_IO_STRING $SAME_PERMISSIONS $INSECURE_EXTRACT_MODE $ZERO_PAD_NUMBERS @@ISA @@EXPORT $RESOLVE_SYMLINK - $EXTRACT_BLOCK_SIZE + $EXTRACT_BLOCK_SIZE $MAX_FILE_SIZE ]; @@ISA = qw[Exporter]; @@@@ -41,6 +41,7 @@@@ $EXTRACT_BLOCK_SIZE = 1024 * 1024 * 1024; $ZERO_PAD_NUMBERS = 0; $RESOLVE_SYMLINK = $ENV{'PERL5_AT_RESOLVE_SYMLINK'} || 'speed'; $EXTRACT_BLOCK_SIZE = 1024 * 1024 * 1024; +$MAX_FILE_SIZE = 1024 * 1024 * 1024; BEGIN { use Config; @@@@ -444,6 +445,14 @@@@ sub _read_tar { my $block = BLOCK_SIZE->( $entry->size ); + if ( $MAX_FILE_SIZE && $entry->size > $MAX_FILE_SIZE ) { + $self->_error( qq[Entry '] . $entry->full_path . + qq[' declared size ] . $entry->size . + qq[ bytes exceeds \$Archive::Tar::MAX_FILE_SIZE ] . + qq[($MAX_FILE_SIZE); refusing to allocate] ); + next LOOP; + } + $data = $entry->get_content_by_ref; my $skip = 0; @@@@ -2186,6 +2195,13 @@@@ extraction may fail with an error. cannot be arbitrarily large since some operating systems limit the number of bytes that can be written in one call to C, so if this is too large, extraction may fail with an error. + +=head2 $Archive::Tar::MAX_FILE_SIZE + +This variable holds an upper bound on the per-entry declared size that +C will accept when reading an archive. Entries whose header +claims a larger size are refused with an error before any read allocation. +Defaults to 1 GiB. Set to 0 to disable the cap. =cut @