Mock Version: 6.2 Mock Version: 6.2 Mock Version: 6.2 ENTER ['do_with_status'](['bash', '--login', '-c', '/usr/bin/rpmbuild -bs --noclean --target x86_64 --nodeps /builddir/build/SPECS/perl-Cpanel-JSON-XS.spec'], chrootPath='/var/lib/mock/dist-an23-build-560212-90493/root'env={'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;\\007"', 'PS1': ' \\s-\\v\\$ ', 'LANG': 'C.UTF-8'}shell=Falselogger=timeout=86400uid=989gid=135user='mockbuild'unshare_net=TrueprintOutput=Falsenspawn_args=['--capability=cap_ipc_lock']) Executing command: ['bash', '--login', '-c', '/usr/bin/rpmbuild -bs --noclean --target x86_64 --nodeps /builddir/build/SPECS/perl-Cpanel-JSON-XS.spec'] with env {'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;\\007"', 'PS1': ' \\s-\\v\\$ ', 'LANG': 'C.UTF-8'} and shell False Building target platforms: x86_64 Building for target x86_64 setting SOURCE_DATE_EPOCH=1785542400 Wrote: /builddir/build/SRPMS/perl-Cpanel-JSON-XS-4.40-3.an23.src.rpm Child return code was: 0 ENTER ['do_with_status'](['bash', '--login', '-c', '/usr/bin/rpmbuild -bb --noclean --target x86_64 --nodeps /builddir/build/SPECS/perl-Cpanel-JSON-XS.spec'], chrootPath='/var/lib/mock/dist-an23-build-560212-90493/root'env={'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;\\007"', 'PS1': ' \\s-\\v\\$ ', 'LANG': 'C.UTF-8'}shell=Falselogger=timeout=86400uid=989gid=135user='mockbuild'unshare_net=TrueprintOutput=Falsenspawn_args=['--capability=cap_ipc_lock']) Executing command: ['bash', '--login', '-c', '/usr/bin/rpmbuild -bb --noclean --target x86_64 --nodeps /builddir/build/SPECS/perl-Cpanel-JSON-XS.spec'] with env {'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;\\007"', 'PS1': ' \\s-\\v\\$ ', 'LANG': 'C.UTF-8'} and shell False Building target platforms: x86_64 Building for target x86_64 setting SOURCE_DATE_EPOCH=1785542400 Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.ncMNUQ + umask 022 + cd /builddir/build/BUILD + cd /builddir/build/BUILD + rm -rf Cpanel-JSON-XS-4.40 + /usr/lib/rpm/rpmuncompress -x /builddir/build/SOURCES/Cpanel-JSON-XS-4.40.tar.gz + STATUS=0 + '[' 0 -ne 0 ']' + cd Cpanel-JSON-XS-4.40 + /usr/bin/chmod -Rf a+rX,u+w,g-w,o-w . + /usr/lib/rpm/rpmuncompress /builddir/build/SOURCES/Cpanel-JSON-XS-4.20-signature.patch + /usr/bin/patch -p0 -s --fuzz=0 --no-backup-if-mismatch -f + /usr/lib/rpm/rpmuncompress /builddir/build/SOURCES/fix-CVE-2026-9334.patch + /usr/bin/patch -p0 -s --fuzz=0 --no-backup-if-mismatch -f + /usr/lib/rpm/rpmuncompress /builddir/build/SOURCES/fix-CVE-2026-9516.patch + /usr/bin/patch -p0 -s --fuzz=0 --no-backup-if-mismatch -f The text leading up to this was: -------------------------- |From dfe1b41a36caba51dc12a2917fe50285d1ffaa7b Mon Sep 17 00:00:00 2001 |From: Paul Johnson |Date: Tue, 26 May 2026 00:50:23 +0200 |Subject: [PATCH] BOM-shift PV-corruption SIGABRT (CVE-2026-9516) | |decode_json() in XS.xs:4504-4577 strips a leading UTF-8 BOM by mutating the |caller's input SV in place: | | offset = 3; | SvPV_set(string, SvPVX_mutable (string) + 3); | SvCUR_set(string, len - 3); | |It then compensates at the end of the normal return path: | | if (UNLIKELY(offset)) { | SvPV_set(string, SvPVX_mutable (string) - offset); | SvCUR_set(string, len); | } | |Three call_sv sites between the mutation and the restore can croak past it: |filter_json_single_key_object (XS.xs:4175), filter_json_object (XS.xs:4202), and |THAW under allow_tags (XS.xs:4292). When any of these callbacks throws an |exception, control unwinds past the restore and the caller's SV is left with |SvPVX pointing 3 bytes into the original allocation and SvCUR reduced by 3. The |corruption is silent until the SV is freed; the next free() of that SV passes a |mid-chunk pointer to the allocator and the process aborts (SIGABRT, exit 134). |Reproducer: | | perl -MCpanel::JSON::XS -E ' | my $s = pack("H*", "efbbbf7b7d"); | my $j = Cpanel::JSON::XS->new->filter_json_object(sub { die "boom\n" }); | eval { $j->decode($s) }; | undef $s | ' | # exit 134 (128 + SIGABRT) | |"efbbbf7b7d" is EF BB BF (UTF-8 BOM) + 7B 7D ({}). | |Impact: reliable denial-of-service against any caller of decode() whose filter |callback can die or croak on invalid input, via a 5-byte attacker-controlled |payload. |--- | XS.xs | 15 ++++----------- | t/31_bom.t | 49 ++++++++++++++++++++++++++++++++++++++++++++++++- | 2 files changed, 52 insertions(+), 12 deletions(-) | |diff --git a/XS.xs b/XS.xs |index 7e6b4f2..6340056 100755 |--- a/XS.xs |+++ b/XS.xs -------------------------- No file to patch. Skipping patch. 4 out of 4 hunks ignored The text leading up to this was: -------------------------- |diff --git a/t/31_bom.t b/t/31_bom.t |index de174b5..daf4163 100644 |--- a/t/31_bom.t |+++ b/t/31_bom.t -------------------------- No file to patch. Skipping patch. 2 out of 2 hunks ignored RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.ncMNUQ (%prep) Bad exit status from /var/tmp/rpm-tmp.ncMNUQ (%prep) Child return code was: 1 EXCEPTION: [Error("Command failed: \n # bash --login -c '/usr/bin/rpmbuild -bb --noclean --target x86_64 --nodeps /builddir/build/SPECS/perl-Cpanel-JSON-XS.spec'\n", 1)] Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/mockbuild/trace_decorator.py", line 93, in trace result = func(*args, **kw) File "/usr/lib/python3.6/site-packages/mockbuild/util.py", line 610, in do_with_status raise exception.Error("Command failed: \n # %s\n%s" % (cmd_pretty(command, env), output), child.returncode) mockbuild.exception.Error: Command failed: # bash --login -c '/usr/bin/rpmbuild -bb --noclean --target x86_64 --nodeps /builddir/build/SPECS/perl-Cpanel-JSON-XS.spec'