Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-Sereal-Decoder for openSUSE:Factory checked in at 2023-04-20 16:26:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-Sereal-Decoder (Old) and /work/SRC/openSUSE:Factory/.perl-Sereal-Decoder.new.2023 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Sereal-Decoder" Thu Apr 20 16:26:03 2023 rev:14 rq:1080877 version:5.004 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-Sereal-Decoder/perl-Sereal-Decoder.changes 2023-02-16 16:56:26.722842955 +0100 +++ /work/SRC/openSUSE:Factory/.perl-Sereal-Decoder.new.2023/perl-Sereal-Decoder.changes 2023-04-20 16:26:06.378952925 +0200 @@ -1,0 +2,11 @@ +Thu Apr 20 03:09:34 UTC 2023 - Tina Müller <timueller+p...@suse.de> + +- updated to 5.004 + see /usr/share/doc/packages/perl-Sereal-Decoder/Changes + + 5.004 + * Fix thaw ordering for frozen objects. Nested THAW operations + now happen in the documented LIFO order. Thanks to Marco + Fontani for the report. + +------------------------------------------------------------------- Old: ---- Sereal-Decoder-5.003.tar.gz New: ---- Sereal-Decoder-5.004.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-Sereal-Decoder.spec ++++++ --- /var/tmp/diff_new_pack.86BwWV/_old 2023-04-20 16:26:06.834955077 +0200 +++ /var/tmp/diff_new_pack.86BwWV/_new 2023-04-20 16:26:06.838955096 +0200 @@ -18,7 +18,7 @@ %define cpan_name Sereal-Decoder Name: perl-Sereal-Decoder -Version: 5.003 +Version: 5.004 Release: 0 License: Artistic-1.0 OR GPL-1.0-or-later Summary: Binary serialization module for Perl (decoder part) ++++++ Sereal-Decoder-5.003.tar.gz -> Sereal-Decoder-5.004.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Sereal-Decoder-5.003/Changes new/Sereal-Decoder-5.004/Changes --- old/Sereal-Decoder-5.003/Changes 2023-02-08 03:33:19.000000000 +0100 +++ new/Sereal-Decoder-5.004/Changes 2023-04-19 11:00:33.000000000 +0200 @@ -5,6 +5,11 @@ * of the decoder before upgrading to version 5 of the * * encoder! * **************************************************************** +5.004 + * Fix thaw ordering for frozen objects. Nested THAW operations + now happen in the documented LIFO order. Thanks to Marco + Fontani for the report. + 5.003 * Production release of 5.002_001 and 5.002_002 * OpenBSD build fixes. Gracious thanks to Andrew Hewus Fresh diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Sereal-Decoder-5.003/MANIFEST new/Sereal-Decoder-5.004/MANIFEST --- old/Sereal-Decoder-5.003/MANIFEST 2023-02-08 03:35:19.000000000 +0100 +++ new/Sereal-Decoder-5.004/MANIFEST 2023-04-19 15:13:42.000000000 +0200 @@ -54,6 +54,7 @@ t/071_alias_reserealize.t t/080_set_readonly.t t/090_thaw.t +t/091_thaw_order.t t/110_nobless.t t/150_dec_exception.t t/155_zipbomb.t diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Sereal-Decoder-5.003/META.json new/Sereal-Decoder-5.004/META.json --- old/Sereal-Decoder-5.003/META.json 2023-02-08 03:35:19.000000000 +0100 +++ new/Sereal-Decoder-5.004/META.json 2023-04-19 15:13:42.000000000 +0200 @@ -4,7 +4,7 @@ "Steffen Mueller <smuel...@cpan.org>, Yves Orton <y...@cpan.org>" ], "dynamic_config" : 1, - "generated_by" : "ExtUtils::MakeMaker version 7.62, CPAN::Meta::Converter version 2.150010", + "generated_by" : "ExtUtils::MakeMaker version 7.70, CPAN::Meta::Converter version 2.150010", "license" : [ "perl_5" ], @@ -71,6 +71,6 @@ "url" : "git://github.com/Sereal/Sereal.git" } }, - "version" : "5.003", - "x_serialization_backend" : "JSON::PP version 4.06" + "version" : "5.004", + "x_serialization_backend" : "JSON::PP version 4.16" } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Sereal-Decoder-5.003/META.yml new/Sereal-Decoder-5.004/META.yml --- old/Sereal-Decoder-5.003/META.yml 2023-02-08 03:35:19.000000000 +0100 +++ new/Sereal-Decoder-5.004/META.yml 2023-04-19 15:13:42.000000000 +0200 @@ -19,7 +19,7 @@ Devel::CheckLib: '1.16' ExtUtils::MakeMaker: '7.0' dynamic_config: 1 -generated_by: 'ExtUtils::MakeMaker version 7.62, CPAN::Meta::Converter version 2.150010' +generated_by: 'ExtUtils::MakeMaker version 7.70, CPAN::Meta::Converter version 2.150010' license: perl meta-spec: url: http://module-build.sourceforge.net/META-spec-v1.4.html @@ -35,5 +35,5 @@ resources: bugtracker: https://github.com/Sereal/Sereal/issues repository: git://github.com/Sereal/Sereal.git -version: '5.003' +version: '5.004' x_serialization_backend: 'CPAN::Meta::YAML version 0.018' diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Sereal-Decoder-5.003/lib/Sereal/Decoder/Constants.pm new/Sereal-Decoder-5.004/lib/Sereal/Decoder/Constants.pm --- old/Sereal-Decoder-5.003/lib/Sereal/Decoder/Constants.pm 2023-02-08 03:31:59.000000000 +0100 +++ new/Sereal-Decoder-5.004/lib/Sereal/Decoder/Constants.pm 2023-04-19 11:00:33.000000000 +0200 @@ -4,7 +4,7 @@ require Exporter; our @ISA= qw(Exporter); -our $VERSION= '5.003'; +our $VERSION= '5.004'; our ( @EXPORT_OK, %DEFINE, %TAG_INFO_HASH, @TAG_INFO_ARRAY ); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Sereal-Decoder-5.003/lib/Sereal/Decoder.pm new/Sereal-Decoder-5.004/lib/Sereal/Decoder.pm --- old/Sereal-Decoder-5.003/lib/Sereal/Decoder.pm 2023-02-08 03:31:59.000000000 +0100 +++ new/Sereal-Decoder-5.004/lib/Sereal/Decoder.pm 2023-04-19 11:00:33.000000000 +0200 @@ -5,7 +5,7 @@ use Carp qw/croak/; use XSLoader; -our $VERSION= '5.003'; +our $VERSION= '5.004'; our $XS_VERSION= $VERSION; $VERSION= eval $VERSION; use Exporter 'import'; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Sereal-Decoder-5.003/srl_decoder.c new/Sereal-Decoder-5.004/srl_decoder.c --- old/Sereal-Decoder-5.003/srl_decoder.c 2023-02-01 05:15:51.000000000 +0100 +++ new/Sereal-Decoder-5.004/srl_decoder.c 2023-04-19 15:07:45.000000000 +0200 @@ -721,22 +721,6 @@ } STMT_END -/* register a newly seen frozen object for THAWing later. */ -SRL_STATIC_INLINE void -srl_track_frozen_object(pTHX_ srl_decoder_t *dec, HV *class_stash, SV *into) -{ - AV *info_av; - if (!dec->thaw_av) - SAFE_NEW_AV(dec->thaw_av); - - AV_PUSH(dec->thaw_av, into); - - if (!dec->ref_thawhash) - SAFE_PTABLE_NEW(dec->ref_thawhash); - - PTABLE_store(dec->ref_thawhash, (void *)SvRV(into), (void *)class_stash); -} - /* Fetch or register a reference to an already seen frozen object. * Called during deserialization (push=1) to handle duplicate references @@ -1669,10 +1653,32 @@ SRL_STATIC_INLINE void srl_read_frozen_object(pTHX_ srl_decoder_t *dec, HV *class_stash, SV *into) { - const unsigned char *fixup_pos= dec->buf.pos + 1; /* get the tag for the WHATEVER */ + + AV *info_av; + if (!dec->thaw_av) + SAFE_NEW_AV(dec->thaw_av); + + /* We do this BEFORE we call srl_read_single_value() so that + thaw_av contains the items in order of us seeing them in the serialized + dump. We will pop them off the list later on when we do the actual THAW. + Note that at the time we do this we haven't "filled out" the 'into' var + with the actual AV that is used for its frozen form. */ + + AV_PUSH(dec->thaw_av, into); + + /* now fill out into with the AV that represents the object */ srl_read_single_value(aTHX_ dec, into, NULL); - srl_track_frozen_object(aTHX_ dec, class_stash, into); + /* validate that we actually deparsed an AV */ + assert(SvROK(into) && SvTYPE(SvRV(into)) == SVt_PVAV); + + if (!dec->ref_thawhash) + SAFE_PTABLE_NEW(dec->ref_thawhash); + + /* we need to do this *after* we have called srl_read_single_value() as + we use the address of the AV that into references as the key to find the + class stash. */ + PTABLE_store(dec->ref_thawhash, (void *)SvRV(into), (void *)class_stash); } /* Invoke a THAW callback on the given class. Pass in the next item in the diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/Sereal-Decoder-5.003/t/091_thaw_order.t new/Sereal-Decoder-5.004/t/091_thaw_order.t --- old/Sereal-Decoder-5.003/t/091_thaw_order.t 1970-01-01 01:00:00.000000000 +0100 +++ new/Sereal-Decoder-5.004/t/091_thaw_order.t 2023-04-19 15:07:45.000000000 +0200 @@ -0,0 +1,132 @@ +#!/usr/bin/env perl +use warnings; +use strict; +use File::Spec; +use lib File::Spec->catdir(qw(t lib)); +BEGIN { + lib->import('lib') + if !-d 't'; +} +use Test::More; +use Sereal::TestSet qw(:all); +use Sereal::Decoder qw(decode_sereal); +use Data::Dumper qw(Dumper); + +if ( !have_encoder_and_decoder() ) { + plan skip_all => 'Did not find right version of encoder'; +} + +sub dd { + local $Data::Dumper::Indent = 0; + local $Data::Dumper::Terse = 1; + local $Data::Dumper::Sortkeys = 1; + return Data::Dumper::Dumper($_[0]); +} + +my @steps; +{ + package FooInside; + + sub new { + my ( $class, $attrs, @inside ) = @_; + $attrs ||= {}; + return bless { + attrs => { %$attrs }, + inside => { + map { $_ => $inside[$_] } 0..$#inside + }, + }, $class; + } + + sub FREEZE { + my ( $self, $serializer ) = @_; + + push @steps, 'FooInside::FREEZE(' . ::dd($self) . ')'; + return { + attrs => $self->{attrs}, + inside => [ + map { $self->{inside}{$_} } sort { $a <=> $b } keys %{$self->{inside}}, + ], + }; + } + + sub THAW { + my ( $class, $serializer, @data ) = @_; + + push @steps, 'FooInside::THAW(' . ::dd($data[0]) . ')'; + return $class->new( $data[0]->{attrs}, @{ $data[0]->{inside} || [] } ); + } +} + +{ + package FooOutside; + + sub new { + my ( $class, $attrs, @inside ) = @_; + $attrs ||= {}; + return bless { + attrs => { %$attrs }, + inside => { + map { $_ => $inside[$_] } 0..$#inside + }, + }, $class; + } + + + sub FREEZE { + my ( $self, $serializer ) = @_; + + push @steps, 'FooOutside::FREEZE(' . ::dd($self) . ')'; + return { + attrs => $self->{attrs}, + inside => [ + map { $self->{inside}{$_} } sort { $a <=> $b } keys %{$self->{inside}}, + ], + }; + } + + sub THAW { + my ( $class, $serializer, @data ) = @_; + + push @steps, 'FooOutside::THAW(' . ::dd($data[0]) . ')'; + return $class->new( $data[0]->{attrs}, @{ $data[0]->{inside} || [] } ); + } +} + +my $struct = + FooOutside->new( + # Attrs + { + attr1 => 'foobar', + bar => FooInside->new({}, 'should_be_first'), + }, + FooInside->new({}, 'second/not_frozen', 'third/not_frozen'), + FooOutside->new({}, FooInside->new({}, 'fourth/inner')), + ); + +my $srl = Sereal::Encoder::encode_sereal($struct, { freeze_callbacks => 1, canonical => 1 }); +my $dec = decode_sereal($srl); + + +is_deeply(\@steps, [ + "FooOutside::FREEZE(bless( {'attrs' => {'attr1' => 'foobar','bar' => bless( {'attrs' => {},'inside' => {'0' => 'should_be_first'}}, 'FooInside' )},'inside' => {'0' => bless( {'attrs' => {},'inside' => {'0' => 'second/not_frozen','1' => 'third/not_frozen'}}, 'FooInside' ),'1' => bless( {'attrs' => {},'inside' => {'0' => bless( {'attrs' => {},'inside' => {'0' => 'fourth/inner'}}, 'FooInside' )}}, 'FooOutside' )}}, 'FooOutside' ))", + "FooInside::FREEZE(bless( {'attrs' => {},'inside' => {'0' => 'should_be_first'}}, 'FooInside' ))", + "FooInside::FREEZE(bless( {'attrs' => {},'inside' => {'0' => 'second/not_frozen','1' => 'third/not_frozen'}}, 'FooInside' ))", + "FooOutside::FREEZE(bless( {'attrs' => {},'inside' => {'0' => bless( {'attrs' => {},'inside' => {'0' => 'fourth/inner'}}, 'FooInside' )}}, 'FooOutside' ))", + "FooInside::FREEZE(bless( {'attrs' => {},'inside' => {'0' => 'fourth/inner'}}, 'FooInside' ))", + "FooInside::THAW({'attrs' => {},'inside' => ['fourth/inner']})", + "FooOutside::THAW({'attrs' => {},'inside' => [bless( {'attrs' => {},'inside' => {'0' => 'fourth/inner'}}, 'FooInside' )]})", + "FooInside::THAW({'attrs' => {},'inside' => ['second/not_frozen','third/not_frozen']})", + "FooInside::THAW({'attrs' => {},'inside' => ['should_be_first']})", + "FooOutside::THAW({'attrs' => {'attr1' => 'foobar','bar' => bless( {'attrs' => {},'inside' => {'0' => 'should_be_first'}}, 'FooInside' )},'inside' => [bless( {'attrs' => {},'inside' => {'0' => 'second/not_frozen','1' => 'third/not_frozen'}}, 'FooInside' ),bless( {'attrs' => {},'inside' => {'0' => bless( {'attrs' => {},'inside' => {'0' => 'fourth/inner'}}, 'FooInside' )}}, 'FooOutside' )]})" + ], "freeze/thaw sequence for nested objects was as expected") or do { + if ($ENV{DUMP_STEPS}) { + local $Data::Dumper::Useqq = 1; + print Dumper(\@steps),"\n"; + } +}; + +is_deeply( $dec, $struct, "And the final structures match according to is_deeply()"); +is( dd($dec), dd($struct), "And the final structures match according to Dumper"); + +done_testing;