[rpms/perl-XML-Bare] f43: Include two security fixes for XML-Bare =< 0.53

[rpms/perl-XML-Bare] f43: Include two security fixes for XML-Bare =< 0.53

[Emmanuel Seyman]

A new commit has been pushed.

Repo   : rpms/perl-XML-Bare
Branch : f43
Commit : 19c0307e8198508687e284e9fb848e599c705333
Author : Emmanuel Seyman <emmanuel@seyman.fr>
Date   : 2026-08-30T11:28:15+02:00
Stats  : +106/-4 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/perl-XML-Bare/c/19c0307e8198508687e284e9fb848e599c705333?branch=f43

Log:
Include two security fixes for XML-Bare =< 0.53

---
diff --git a/CVE-2026-13401-r1.patch b/CVE-2026-13401-r1.patch
new file mode 100644
index 0000000..f478a50
--- /dev/null
+++ b/CVE-2026-13401-r1.patch
@@ -0,0 +1,26 @@
+From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
+Subject: [PATCH] XML::Bare: advance stuck attribute-name state (infinite loop)
+
+Infinite loop (CWE-835) in the hand-rolled C parser (parser.c), reached
+by the default XML::Bare->new(text=>$xml)->parse on untrusted XML.
+
+The `att_nameqsdone` state — reached after a single-quoted attribute
+*name* — loops back to itself without advancing `cpos` on any character
+other than `=` or NUL, spinning forever in C on malformed input. The
+parser holds the interpreter for the duration of the call, so no
+Perl-level signal (`alarm`, etc.) can interrupt it: a single request
+pins a CPU indefinitely. Triggers: `<a ='c'>`, `<a b='''''''c'>`,
+`<x y=''''''z'>`.
+
+Fix: advance the cursor before looping, so the scan terminates at the
+next `=` or at the NUL sentinel (already handled by the `case 0` branch).
+--- a/parser.c
++++ b/parser.c
+@@ -484,6 +485,7 @@
+           cpos++;
+           goto att_eq1;
+       }
++      cpos++; // advance the cursor so malformed input (no '=' after a quoted attr name) cannot spin forever
+       goto att_nameqsdone;
+       
+     att_eq1:

diff --git a/CVE-2026-57074-r1.patch b/CVE-2026-57074-r1.patch
new file mode 100644
index 0000000..29e382c
--- /dev/null
+++ b/CVE-2026-57074-r1.patch
@@ -0,0 +1,65 @@
+From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
+Subject: [PATCH] XML::Bare: bounds truncated fixed-advance lookahead (heap OOB read)
+
+Heap-buffer-overflow READ (CWE-125) in the hand-rolled C parser
+(parser.c), reached by the default XML::Bare->new(text=>$xml)->parse on
+untrusted XML.
+
+Several transitions advance `cpos` by a fixed amount past a recognised
+token without checking the buffer end, then dereference the new position:
+
+  - the `<![CDATA` match does `cpos += 9` after confirming only eight
+    bytes (`<![CDATA`), so a truncated tail such as `<![CDATA\0` steps
+    one byte past the NUL terminator;
+  - the three "self-closing tag" branches (name_x, name_gap, att_name)
+    do `cpos += 2` on the assumption that a `>` follows the `/`, so a
+    truncated tail such as `<a/\0` steps past the NUL.
+
+The subsequent `let = *cpos;` in val_1/val_x/cdata then reads out of
+bounds. Trigger: `<!-- c --><a/`.
+
+Fix: require the full `<![CDATA[` (nine bytes) before the `+= 9`, and
+only skip the assumed `>` when `*(cpos+1)` is non-NUL. Both changes are
+behaviour-preserving for well-formed input — real CDATA always carries
+the `[`, and a non-truncated self-close always has a byte after the `/`;
+they differ only on the truncated-tail case that previously overran the
+allocation.
+--- a/parser.c
++++ b/parser.c
+@@ -193,7 +193,8 @@
+                     *(cpos+4) == 'D' &&
+                     *(cpos+5) == 'A' &&
+                     *(cpos+6) == 'T' &&
+-                    *(cpos+7) == 'A'    ) {
++                    *(cpos+7) == 'A' &&
++                    *(cpos+8) == '['    ) { // require full "<![CDATA[" so cpos+=9 cannot skip past a truncated tail
+                   cpos += 9;
+                   curnode->type = 1;
+                   goto cdata;
+@@ -344,7 +345,7 @@
+           temp = nodec_addchildr( curnode, tagname, tagname_len );
+           temp->z = cpos +1 - xmlin;
+           tagname_len            = 0;
+-          cpos+=2;
++          if( *(cpos+1) ) cpos += 2; else cpos++; // skip assumed '>' only if not the NUL terminator
+           goto val_1;
+       }
+       
+@@ -368,7 +369,7 @@
+           curnode->z = cpos+1-xmlin;
+           curnode = curnode->parent;
+           if( !curnode ) goto done;
+-          cpos+=2; // am assuming next char is >
++          if( *(cpos+1) ) cpos += 2; else cpos++; // was: assume next char is > (skip past NUL on truncated tail)
+           goto val_1;
+         case '=':
+           cpos++;
+@@ -425,7 +426,7 @@
+           curnode->z = cpos+1-xmlin;
+           curnode = curnode->parent;
+           if( !curnode ) goto done;
+-          cpos += 2;
++          if( *(cpos+1) ) cpos += 2; else cpos++; // "/> assumed" — skip '>' only if present, not the NUL
+           goto val_1;
+         case ' ':
+           if( *(cpos+1) == '=' ) {

diff --git a/perl-XML-Bare.spec b/perl-XML-Bare.spec
index 4dad301..7e0b782 100644
--- a/perl-XML-Bare.spec
+++ b/perl-XML-Bare.spec
@@ -1,12 +1,20 @@
 Name:           perl-XML-Bare
 Version:        0.53
-Release:        43%{?dist}
+Release:        44%{?dist}
 Summary:        Minimal XML parser implemented via a C state engine
 License:        GPL-1.0-or-later OR Artistic-1.0-Perl
-URL:            https://metacpan.org/release/XML-Bare
+URL:            https://metacpan.org/dist/XML-Bare
 Source0:        https://cpan.metacpan.org/authors/id/C/CO/CODECHILD/XML-Bare-%{version}.tar.gz
+# https://rt.cpan.org/Ticket/Display.html?id=145653
 Patch0:         perl-XML-Bare-c99.patch
-Patch1: perl-XML-Bare-c99-2.patch
+# https://rt.cpan.org/Public/Bug/Display.html?id=151041
+Patch1:         perl-XML-Bare-c99-2.patch
+# https://github.com/nanoscopic/perl-XML-Bare/pull/1
+# https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-57074-r1.patch
+Patch2:         CVE-2026-57074-r1.patch
+# https://github.com/nanoscopic/perl-XML-Bare/pull/2
+# https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-13401-r1.patch
+Patch3:         CVE-2026-13401-r1.patch
 BuildRequires:  gcc
 BuildRequires:  make
 BuildRequires:  perl-devel
@@ -49,11 +57,14 @@ chmod 644 Bare.pm
 
 %files
 %doc Changes README
-%{perl_vendorarch}/auto/*
+%{perl_vendorarch}/auto/XML*
 %{perl_vendorarch}/XML*
 %{_mandir}/man3/XML*
 
 %changelog
+* Sun Aug 30 2026 Emmanuel Seyman <emmanuel@seyman.fr> - 0.53-47
+- Include two security fixes for XML-Bare =< 0.53
+
 * Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 0.53-43
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild