mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-08-24 06:48:18 -07:00
6cf91f545e
* IUSE+RESTRICT for test aren't needed w/ >= EAPI 8 in perl-module.eclass * Move PATCHES to the end * Add bug link to patch Signed-off-by: Sam James <sam@gentoo.org>
54 lines
1.6 KiB
Diff
54 lines
1.6 KiB
Diff
https://security.metacpan.org/patches/B/Bytes-Random-Secure/0.29/CVE-2026-11625-r1.patch
|
|
https://bugs.gentoo.org/979426
|
|
|
|
From: Robert Rothenberg <perl@rhizomnic.com>
|
|
Date: Thu, 25 Jun 2026 14:43:11 +0100
|
|
Subject: [PATCH] Fix for CVE-2026-11625
|
|
|
|
--- a/lib/Bytes/Random/Secure.pm
|
|
+++ b/lib/Bytes/Random/Secure.pm
|
|
@@ -156,6 +156,7 @@ sub _build_attributes {
|
|
$self->{$arg} = exists $args->{$arg} ? $args->{$arg} : $default;
|
|
}
|
|
|
|
+ $self->{_pid} = $$;
|
|
$self->{_RNG} = undef; # Lazy initialization.
|
|
return $self;
|
|
}
|
|
@@ -171,6 +172,8 @@ sub _instantiate_rng {
|
|
my @seeds = $self->_generate_seed( %seed_opts );
|
|
$self->{_RNG} = Math::Random::ISAAC->new(@seeds);
|
|
|
|
+ $self->{_pid} = $$;
|
|
+
|
|
return $self->{_RNG};
|
|
}
|
|
|
|
@@ -224,7 +227,7 @@ sub bytes {
|
|
$bytes = defined $bytes ? $bytes : 0; # Default to zero bytes.
|
|
$self->_validate_int( $bytes ); # Throws on violation.
|
|
|
|
- $self->_instantiate_rng unless defined $self->{_RNG};
|
|
+ $self->_instantiate_rng unless $$ == $self->{_pid} && defined $self->{_RNG};
|
|
|
|
my $str = '';
|
|
|
|
@@ -302,7 +305,7 @@ sub _ranged_randoms {
|
|
$count = defined $count ? $count : 0;
|
|
|
|
# Lazily seed the RNG so we don't waste available strong entropy.
|
|
- $self->_instantiate_rng unless defined $self->{_RNG};
|
|
+ $self->_instantiate_rng unless $$ == $self->{_pid} && defined $self->{_RNG};
|
|
|
|
my $divisor = $self->_closest_divisor($range);
|
|
|
|
@@ -354,7 +357,7 @@ sub _closest_divisor {
|
|
|
|
sub irand {
|
|
my( $self ) = @_;
|
|
- $self->_instantiate_rng unless defined $self->{_RNG};
|
|
+ $self->_instantiate_rng unless $$ == $self->{_pid} && defined $self->{_RNG};
|
|
return $self->{_RNG}->irand;
|
|
}
|
|
|