CVS commit: [pkgsrc-2026Q2] pkgsrc/lang/perl5

Modified files:

Index: pkgsrc/lang/perl5/Makefile
diff -u pkgsrc/lang/perl5/Makefile:1.294.2.1 pkgsrc/lang/perl5/Makefile:1.294.2.2
--- pkgsrc/lang/perl5/Makefile:1.294.2.1	Thu Jul 16 21:08:19 2026
+++ pkgsrc/lang/perl5/Makefile	Sun Aug  9 19:00:14 2026
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.294.2.1 2026/07/16 21:08:19 maya Exp $
+# $NetBSD: Makefile,v 1.294.2.2 2026/08/09 19:00:14 bsiegert Exp $
 
 .include "license.mk"
 .include "Makefile.common"
 
 COMMENT=	Practical Extraction and Report Language
-PKGREVISION=	4
 
 CONFLICTS+=	perl-base-[0-9]* perl-thread-[0-9]*
 

Index: pkgsrc/lang/perl5/Makefile.common
diff -u pkgsrc/lang/perl5/Makefile.common:1.53 pkgsrc/lang/perl5/Makefile.common:1.53.2.1
--- pkgsrc/lang/perl5/Makefile.common:1.53	Mon Mar 30 08:57:15 2026
+++ pkgsrc/lang/perl5/Makefile.common	Sun Aug  9 19:00:14 2026
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile.common,v 1.53 2026/03/30 08:57:15 wiz Exp $
+# $NetBSD: Makefile.common,v 1.53.2.1 2026/08/09 19:00:14 bsiegert Exp $
 #
 # used by lang/perl5/Makefile
 # used by databases/p5-gdbm/Makefile
 
-DISTNAME=	perl-5.42.2
+DISTNAME=	perl-5.42.3
 CATEGORIES=	lang devel perl5
 MASTER_SITES=	${MASTER_SITE_PERL_CPAN:=../../authors/id/S/SH/SHAY/}
 DISTFILES+=	${DISTNAME}${EXTRACT_SUFX}

Index: pkgsrc/lang/perl5/distinfo
diff -u pkgsrc/lang/perl5/distinfo:1.199.2.1 pkgsrc/lang/perl5/distinfo:1.199.2.2
--- pkgsrc/lang/perl5/distinfo:1.199.2.1	Thu Jul 16 21:08:19 2026
+++ pkgsrc/lang/perl5/distinfo	Sun Aug  9 19:00:14 2026
@@ -1,20 +1,15 @@
-$NetBSD: distinfo,v 1.199.2.1 2026/07/16 21:08:19 maya Exp $
+$NetBSD: distinfo,v 1.199.2.2 2026/08/09 19:00:14 bsiegert Exp $
 
-BLAKE2s (perl-5.42.2.tar.gz) = a2e271ef18aa3cadeed75cf6bf48cfc30b8a9f6675053194f285cd13d97e0791
-SHA512 (perl-5.42.2.tar.gz) = c17925b1146270310fbefd82a98bd94532b499a547f5be005ece204918bfc0034e473a97df643925625a940209f81a65acdd99857b3b18911461571230262c0f
-Size (perl-5.42.2.tar.gz) = 20609653 bytes
+BLAKE2s (perl-5.42.3.tar.gz) = 6461575e459c71899bbe8176e689925098d28cdb22df113a54d058421d360bdb
+SHA512 (perl-5.42.3.tar.gz) = 13f969fae53deb47abacbb49b6d7440eabe696bfd81ed33bb797077db72be1e8c2e9a03c68f5dc9a1551783f35131b52773725800fd67f0160ccd318ba1360ba
+Size (perl-5.42.3.tar.gz) = 20619668 bytes
 SHA1 (patch-Configure) = 7e04b70aefcb66399679582a2f2e95306cf1e47b
 SHA1 (patch-Makefile.SH) = 56203aea57c429a94760f039a978463b8859b0a9
-SHA1 (patch-cpan_Archive-Tar_lib_Archive_Tar.pm) = af896b3c8770d03c851fe1022ed1348857b1b4cc
 SHA1 (patch-cpan_ExtUtils-MakeMaker_lib_ExtUtils_MM__BeOS.pm) = 79e5aeccfa272ca5ec08bffc616d8053ae90ac51
 SHA1 (patch-cpan_ExtUtils-MakeMaker_lib_ExtUtils_MM__Unix.pm) = 996556f221eb0c75c316315462bf6cea6746e030
 SHA1 (patch-cpan_ExtUtils-MakeMaker_t_MM__BeOS.t) = 9b0e7ab85fdab4887b1754599a8879bd7d9f36cc
-SHA1 (patch-cpan_Socket_Socket.xs) = 50613ed2966eb389a6816504d339a2a26276b90f
-SHA1 (patch-dist_Storable_Storable.xs) = 0bc5f182965fe58b91e085119a89ec8ca7b45994
 SHA1 (patch-hints_cygwin.sh) = 5e2e7179336c9bc085bd2e83d22755a235ea1a4a
 SHA1 (patch-hints_linux.sh) = 4baa8f80695687abb53d4f4e1830cf86db5b2bf7
 SHA1 (patch-hints_netbsd.sh) = cb498170c18f1f429eed9be245cd1df24c7ad628
 SHA1 (patch-hints_solaris__2.sh) = 83b20650435ea3b62314af6059f3d82c3dd6b0a2
 SHA1 (patch-installperl) = b129d64cc17b898b44fe6282b8b1df36e342d0ef
-SHA1 (patch-pp__pack.c) = 7217920ed766b126ee3db7f928bdbb889c83d363
-SHA1 (patch-regcomp__study.c) = d9705946924b1f941c6e25c095f54824cee01155

Index: pkgsrc/lang/perl5/patches/patch-cpan_Archive-Tar_lib_Archive_Tar.pm
diff -u pkgsrc/lang/perl5/patches/patch-cpan_Archive-Tar_lib_Archive_Tar.pm:1.1 pkgsrc/lang/perl5/patches/patch-cpan_Archive-Tar_lib_Archive_Tar.pm:1.1.4.1
--- pkgsrc/lang/perl5/patches/patch-cpan_Archive-Tar_lib_Archive_Tar.pm:1.1	Wed May 27 22:35:30 2026
+++ pkgsrc/lang/perl5/patches/patch-cpan_Archive-Tar_lib_Archive_Tar.pm	Sun Aug  9 19:00:15 2026
@@ -1,54 +0,0 @@
-$NetBSD: patch-cpan_Archive-Tar_lib_Archive_Tar.pm,v 1.1 2026/05/27 22:35:30 wiz Exp $
-
-Archive::Tar versions before 3.10 for Perl allow memory exhaustion via
-attacker controlled entry size field in tar header.
-https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch
-
---- cpan/Archive-Tar/lib/Archive/Tar.pm.orig	2026-01-18 16:32:21.000000000 +0000
-+++ cpan/Archive-Tar/lib/Archive/Tar.pm
-@@ -24,7 +24,7 @@ use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLI
- use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLINK $CHOWN $CHMOD
-             $DO_NOT_USE_PREFIX $HAS_PERLIO $HAS_IO_STRING $SAME_PERMISSIONS
-             $INSECURE_EXTRACT_MODE $ZERO_PAD_NUMBERS @ISA @EXPORT $RESOLVE_SYMLINK
--            $EXTRACT_BLOCK_SIZE
-+            $EXTRACT_BLOCK_SIZE $MAX_FILE_SIZE
-          ];
- 
- @ISA                    = qw[Exporter];
-@@ -41,6 +41,7 @@ $EXTRACT_BLOCK_SIZE     = 1024 * 1024 * 1024;
- $ZERO_PAD_NUMBERS       = 0;
- $RESOLVE_SYMLINK        = $ENV{'PERL5_AT_RESOLVE_SYMLINK'} || 'speed';
- $EXTRACT_BLOCK_SIZE     = 1024 * 1024 * 1024;
-+$MAX_FILE_SIZE          = 1024 * 1024 * 1024;
- 
- BEGIN {
-     use Config;
-@@ -444,6 +445,14 @@ sub _read_tar {
- 
-             my $block = BLOCK_SIZE->( $entry->size );
- 
-+            if ( $MAX_FILE_SIZE && $entry->size > $MAX_FILE_SIZE ) {
-+                $self->_error( qq[Entry '] . $entry->full_path .
-+                    qq[' declared size ] . $entry->size .
-+                    qq[ bytes exceeds \$Archive::Tar::MAX_FILE_SIZE ] .
-+                    qq[($MAX_FILE_SIZE); refusing to allocate] );
-+                next LOOP;
-+            }
-+
-             $data = $entry->get_content_by_ref;
- 
- 	    my $skip = 0;
-@@ -2186,6 +2195,13 @@ extraction may fail with an error.
- cannot be arbitrarily large since some operating systems limit the number of
- bytes that can be written in one call to C<write(2)>, so if this is too large,
- extraction may fail with an error.
-+
-+=head2 $Archive::Tar::MAX_FILE_SIZE
-+
-+This variable holds an upper bound on the per-entry declared size that
-+C<Archive::Tar> will accept when reading an archive. Entries whose header
-+claims a larger size are refused with an error before any read allocation.
-+Defaults to 1 GiB. Set to 0 to disable the cap.
- 
- =cut
- 

Index: pkgsrc/lang/perl5/patches/patch-cpan_Socket_Socket.xs
diff -u pkgsrc/lang/perl5/patches/patch-cpan_Socket_Socket.xs:1.3 pkgsrc/lang/perl5/patches/patch-cpan_Socket_Socket.xs:1.3.2.1
--- pkgsrc/lang/perl5/patches/patch-cpan_Socket_Socket.xs:1.3	Tue Jun 16 07:12:10 2026
+++ pkgsrc/lang/perl5/patches/patch-cpan_Socket_Socket.xs	Sun Aug  9 19:00:15 2026
@@ -1,144 +0,0 @@
-$NetBSD: patch-cpan_Socket_Socket.xs,v 1.3 2026/06/16 07:12:10 wiz Exp $
-
-Pull security fix from 2.041
-
-[BUGFIXES]
-* Fix reuse of `STRLEN len` variable in pack_ip_mreq_source()
-
-https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch
-
---- cpan/Socket/Socket.xs.orig	2026-01-18 17:50:03.000000000 +0000
-+++ cpan/Socket/Socket.xs
-@@ -1272,26 +1272,35 @@ pack_ip_mreq(multiaddr, interface=&PL_sv_undef)
-         struct ip_mreq mreq;
-         char * multiaddrbytes;
-         char * interfacebytes;
--        STRLEN len;
--        if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
--            croak("Wide character in %s", "Socket::pack_ip_mreq");
--        multiaddrbytes = SvPVbyte(multiaddr, len);
--        if (len != sizeof(mreq.imr_multiaddr))
--            croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
--                    "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr));
-+
-+        {
-+            if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
-+                croak("Wide character in %s", "Socket::pack_ip_mreq");
-+
-+            STRLEN len;
-+            multiaddrbytes = SvPVbyte(multiaddr, len);
-+            if (len != sizeof(mreq.imr_multiaddr))
-+                croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
-+                        "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr));
-+        }
-+
-         Zero(&mreq, sizeof(mreq), char);
-         Copy(multiaddrbytes, &mreq.imr_multiaddr, sizeof(mreq.imr_multiaddr), char);
-         if(SvOK(interface)) {
-             if (DO_UTF8(interface) && !sv_utf8_downgrade(interface, 1))
-                 croak("Wide character in %s", "Socket::pack_ip_mreq");
-+
-+            STRLEN len;
-             interfacebytes = SvPVbyte(interface, len);
-             if (len != sizeof(mreq.imr_interface))
-                 croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
-                         "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_interface));
-+
-             Copy(interfacebytes, &mreq.imr_interface, sizeof(mreq.imr_interface), char);
-         }
-         else
-             mreq.imr_interface.s_addr = INADDR_ANY;
-+
-         ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq)));
- #else
-         not_here("pack_ip_mreq");
-@@ -1331,25 +1340,38 @@ pack_ip_mreq_source(multiaddr, source, interface=&PL_s
-         char * multiaddrbytes;
-         char * sourcebytes;
-         char * interfacebytes;
--        STRLEN len;
--        if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
--            croak("Wide character in %s", "Socket::pack_ip_mreq_source");
--        multiaddrbytes = SvPVbyte(multiaddr, len);
--        if (len != sizeof(mreq.imr_multiaddr))
--            croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
--                    "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr));
--        if (DO_UTF8(source) && !sv_utf8_downgrade(source, 1))
--            croak("Wide character in %s", "Socket::pack_ip_mreq_source");
--        if (len != sizeof(mreq.imr_sourceaddr))
--            croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
--                    "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_sourceaddr));
--        sourcebytes = SvPVbyte(source, len);
-+
-+        {
-+            if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
-+                croak("Wide character in %s", "Socket::pack_ip_mreq_source");
-+
-+            STRLEN len;
-+            multiaddrbytes = SvPVbyte(multiaddr, len);
-+            if (len != sizeof(mreq.imr_multiaddr))
-+                croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
-+                        "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_multiaddr));
-+        }
-+
-+        {
-+            if (DO_UTF8(source) && !sv_utf8_downgrade(source, 1))
-+                croak("Wide character in %s", "Socket::pack_ip_mreq_source");
-+
-+            STRLEN len;
-+            sourcebytes = SvPVbyte(source, len);
-+            if (len != sizeof(mreq.imr_sourceaddr))
-+                croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
-+                        "Socket::pack_ip_mreq", (UV)len, (UV)sizeof(mreq.imr_sourceaddr));
-+        }
-+
-         Zero(&mreq, sizeof(mreq), char);
-         Copy(multiaddrbytes, &mreq.imr_multiaddr, sizeof(mreq.imr_multiaddr), char);
-         Copy(sourcebytes, &mreq.imr_sourceaddr, sizeof(mreq.imr_sourceaddr), char);
-+
-         if(SvOK(interface)) {
-             if (DO_UTF8(interface) && !sv_utf8_downgrade(interface, 1))
-                 croak("Wide character in %s", "Socket::pack_ip_mreq");
-+
-+            STRLEN len;
-             interfacebytes = SvPVbyte(interface, len);
-             if (len != sizeof(mreq.imr_interface))
-                 croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
-@@ -1358,6 +1380,7 @@ pack_ip_mreq_source(multiaddr, source, interface=&PL_s
-         }
-         else
-             mreq.imr_interface.s_addr = INADDR_ANY;
-+
-         ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq)));
- #else
-         PERL_UNUSED_VAR(multiaddr);
-@@ -1398,16 +1421,22 @@ pack_ipv6_mreq(multiaddr, ifindex)
- #ifdef HAS_IPV6_MREQ
-         struct ipv6_mreq mreq;
-         char * multiaddrbytes;
--        STRLEN len;
--        if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
--            croak("Wide character in %s", "Socket::pack_ipv6_mreq");
--        multiaddrbytes = SvPVbyte(multiaddr, len);
--        if (len != sizeof(mreq.ipv6mr_multiaddr))
--            croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
--                    "Socket::pack_ipv6_mreq", (UV)len, (UV)sizeof(mreq.ipv6mr_multiaddr));
-+
-+        {
-+            if (DO_UTF8(multiaddr) && !sv_utf8_downgrade(multiaddr, 1))
-+                croak("Wide character in %s", "Socket::pack_ipv6_mreq");
-+
-+            STRLEN len;
-+            multiaddrbytes = SvPVbyte(multiaddr, len);
-+            if (len != sizeof(mreq.ipv6mr_multiaddr))
-+                croak("Bad arg length %s, length is %" UVuf ", should be %" UVuf,
-+                        "Socket::pack_ipv6_mreq", (UV)len, (UV)sizeof(mreq.ipv6mr_multiaddr));
-+        }
-+
-         Zero(&mreq, sizeof(mreq), char);
-         Copy(multiaddrbytes, &mreq.ipv6mr_multiaddr, sizeof(mreq.ipv6mr_multiaddr), char);
-         mreq.ipv6mr_interface = ifindex;
-+
-         ST(0) = sv_2mortal(newSVpvn((char *)&mreq, sizeof(mreq)));
- #else
-         PERL_UNUSED_VAR(multiaddr);

Index: pkgsrc/lang/perl5/patches/patch-dist_Storable_Storable.xs
diff -u pkgsrc/lang/perl5/patches/patch-dist_Storable_Storable.xs:1.2.2.2 pkgsrc/lang/perl5/patches/patch-dist_Storable_Storable.xs:1.2.2.3
--- pkgsrc/lang/perl5/patches/patch-dist_Storable_Storable.xs:1.2.2.2	Thu Jul 16 21:08:19 2026
+++ pkgsrc/lang/perl5/patches/patch-dist_Storable_Storable.xs	Sun Aug  9 19:00:15 2026
@@ -1,20 +0,0 @@
-$NetBSD: patch-dist_Storable_Storable.xs,v 1.2.2.2 2026/07/16 21:08:19 maya Exp $
-
-Storable versions before 3.41 for Perl have a signed integer overflow
-when deserializing a crafted SX_HOOK record
-https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch
-
---- dist/Storable/Storable.xs.orig	2026-01-18 17:50:04.000000000 +0000
-+++ dist/Storable/Storable.xs
-@@ -5035,7 +5035,10 @@ static SV *retrieve_hook_common(pTHX_ stcxt_t *cxt, co
-         }
-         else
-             GETMARK(len3);
--        if (len3) {
-+        if (len3 == I32_MAX)
-+            /* If len3 is exactly I32_MAX it will upset av_extend below */
-+            CROAK(("Invalid count of hook data items"));
-+        else if (len3) {
-             av = newAV();
-             av_extend(av, len3 + 1);    /* Leave room for [0] */
-             AvFILLp(av) = len3;         /* About to be filled anyway */
Index: pkgsrc/lang/perl5/patches/patch-pp__pack.c
diff -u pkgsrc/lang/perl5/patches/patch-pp__pack.c:1.2.2.2 pkgsrc/lang/perl5/patches/patch-pp__pack.c:1.2.2.3
--- pkgsrc/lang/perl5/patches/patch-pp__pack.c:1.2.2.2	Thu Jul 16 21:08:19 2026
+++ pkgsrc/lang/perl5/patches/patch-pp__pack.c	Sun Aug  9 19:00:15 2026
@@ -1,36 +0,0 @@
-$NetBSD: patch-pp__pack.c,v 1.2.2.2 2026/07/16 21:08:19 maya Exp $
-
-Perl versions through 5.43.10 have an integer overflow in
-S_measure_struct leading to an out-of-bounds heap read in pack and
-unpack
-https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
-https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch
-
---- pp_pack.c.orig	2026-01-18 17:50:04.000000000 +0000
-+++ pp_pack.c
-@@ -513,12 +513,12 @@ S_measure_struct(pTHX_ tempsym_t* symptr)
-                 break;
-             case 'B':
-             case 'b':
--                len = (len + 7)/8;
-+                len = (len / 8) + !!(len % 8);
-                 size = 1;
-                 break;
-             case 'H':
-             case 'h':
--                len = (len + 1)/2;
-+                len = (len / 2) + !!(len % 2);
-                 size = 1;
-                 break;
- 
-@@ -528,6 +528,10 @@ S_measure_struct(pTHX_ tempsym_t* symptr)
-                 break;
-             }
-         }
-+        if ((size > 0) &&
-+                ((len > SSize_t_MAX / size) ||         /* detect overflow of len * size */
-+                 (len * size > SSize_t_MAX - total)))  /* detect overflow of total + len * size */
-+            croak("Pack template structure size is too large");
-         total += len * size;
-     }
-     return total;

Index: pkgsrc/lang/perl5/patches/patch-regcomp__study.c
diff -u pkgsrc/lang/perl5/patches/patch-regcomp__study.c:1.1.4.1 pkgsrc/lang/perl5/patches/patch-regcomp__study.c:1.1.4.2
--- pkgsrc/lang/perl5/patches/patch-regcomp__study.c:1.1.4.1	Thu Jul 16 21:08:19 2026
+++ pkgsrc/lang/perl5/patches/patch-regcomp__study.c	Sun Aug  9 19:00:15 2026
@@ -1,43 +0,0 @@
-$NetBSD: patch-regcomp__study.c,v 1.1.4.1 2026/07/16 21:08:19 maya Exp $
-
-Perl versions through 5.43.9 produce silently incorrect regular
-expression matches when an alternation of more than 65535 fixed string
-branches is compiled into a trie in Perl_study_chunk
-https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch
-
-Perl/perl-security#147: test against the actual character lengths
-https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c
-
---- regcomp_study.c.orig	2026-01-18 17:50:04.000000000 +0000
-+++ regcomp_study.c
-@@ -1841,6 +1841,16 @@ Perl_study_chunk(pTHX_
-                             tail = regnext( tail );
-                         }
- 
-+                        /* The code below currently saves the difference from
-+                         * start to finish in a 16-bit field, causing
-+                         * GH #23388.  This defeats the design of batching
-+                         * tries into chunks that each fit.  khw thinks it is
-+                         * too late in the 5.44 cycle to relook at the design,
-+                         * so for now anyway, don't make a trie that would
-+                         * overflow */
-+                        if (tail - startbranch >= U16_MAX) {
-+                            continue;
-+                        }
- 
-                         DEBUG_TRIE_COMPILE_r({
-                             regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state);
-@@ -2770,6 +2780,13 @@ Perl_study_chunk(pTHX_
-                                                (U8 *) SvEND(data->last_found))
-                                 - (U8*)s;
-                         l -= old;
-+
-+                        if (l > 0 &&
-+                            (mincount >= SSize_t_MAX / (SSize_t)l
-+                             || old > SSize_t_MAX - mincount * (SSize_t)l)) {
-+                            FAIL("Regexp out of space");
-+                        }
-+
-                         /* Get the added string: */
-                         last_str = newSVpvn_utf8(s  + old, l, UTF);
-                         last_chrs = UTF ? utf8_length((U8*)(s + old),