From 7bd05c676009cd9b21e4f0e9cfc56e05a403244b Mon Sep 17 00:00:00 2001
From: roy <yupeng@kylinos.cn>
Date: Tue, 9 Sep 2025 10:02:02 +0800
Subject: [PATCH] Fix CVE-2025-40928

---
 CVE-2025-40928.patch     | 47 ++++++++++++++++++++++++++++++++++++++++
 perl-Cpanel-JSON-XS.spec |  8 ++++++-
 2 files changed, 54 insertions(+), 1 deletion(-)
 create mode 100644 CVE-2025-40928.patch

diff --git a/CVE-2025-40928.patch b/CVE-2025-40928.patch
new file mode 100644
index 0000000..7f39cdc
--- /dev/null
+++ b/CVE-2025-40928.patch
@@ -0,0 +1,47 @@
+From 378236219eaa35742c3962ecbdee364903b0a1f2 Mon Sep 17 00:00:00 2001
+From: Marc Lehmann <schmorp@schmorp.de>
+Date: Sat, 6 Sep 2025 11:31:36 +0200
+Subject: [PATCH] fix json_atof_scan1 overflows
+
+with fuzzed overlong numbers. CVE-2025-40928
+Really the comparisons were wrong.
+---
+ XS.xs | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/XS.xs b/XS.xs
+index 9b1ce2b..2b9900f 100755
+--- a/XS.xs
++++ b/XS.xs
+@@ -710,16 +710,16 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
+   /* if we recurse too deep, skip all remaining digits */
+   /* to avoid a stack overflow attack */
+   if (UNLIKELY(--maxdepth <= 0))
+-    while (((U8)*s - '0') < 10)
++    while (*s >= '0' && *s <= '9')
+       ++s;
+ 
+   for (;;)
+     {
+-      U8 dig = (U8)*s - '0';
++      U8 dig = (U8)(*s - '0');
+ 
+       if (UNLIKELY(dig >= 10))
+         {
+-          if (dig == (U8)((U8)'.' - (U8)'0'))
++          if (dig == (U8)('.' - '0'))
+             {
+               ++s;
+               json_atof_scan1 (s, accum, expo, 1, maxdepth);
+@@ -739,7 +739,7 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth)
+               else if (*s == '+')
+                 ++s;
+ 
+-              while ((dig = (U8)*s - '0') < 10)
++              while (*s >= '0' && *s <= '9')
+                 exp2 = exp2 * 10 + *s++ - '0';
+ 
+               *expo += neg ? -exp2 : exp2;
+-- 
+2.20.1
+
diff --git a/perl-Cpanel-JSON-XS.spec b/perl-Cpanel-JSON-XS.spec
index a91f4a7..745cd78 100644
--- a/perl-Cpanel-JSON-XS.spec
+++ b/perl-Cpanel-JSON-XS.spec
@@ -1,12 +1,14 @@
 %global _empty_manifest_terminate_build 0
 Name:           perl-Cpanel-JSON-XS
 Version:        4.39
-Release:        2
+Release:        3
 Summary:        CPanel fork of JSON::XS, fast and correct serializing
 License:        GPL-1.0-or-later or Artistic-1.0-Perl
 Group:          Development/Libraries
 URL:            https://metacpan.org/release/Cpanel-JSON-XS/
 Source0:        https://cpan.metacpan.org/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-%{version}.tar.gz
+Patch0:         CVE-2025-40928.patch
+
 BuildRequires:  perl-generators
 BuildRequires:  perl(Carp)
 BuildRequires:  perl(Data::Dumper)
@@ -50,6 +52,7 @@ reach the latter goal it was written in C.
 
 %prep
 %setup -q -n Cpanel-JSON-XS-%{version}
+%patch -P 0 -p1
 
 
 %build
@@ -77,6 +80,9 @@ make test
 %{_mandir}/man?/*
 
 %changelog
+* Tue Sep 09 2025 Yu Peng <yupeng@kylinos.cn> - 4.39-3
+- Fix CVE-2025-40928
+
 * Sun Jan 19 2025 Funda Wang <fundawang@yeah.net> - 4.39-2
 - drop useless perl(:MODULE_COMPAT) requirement
 
-- 
Gitee