[From nobody Wed May  6 13:23:05 2026
Received: (at submit) by bugs.debian.org; 6 Sep 2025 07:56:51 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-135.2 required=4.0 tests=BAYES_00,
 BODY_INCLUDES_CONTROL_AFFECTS,BODY_INCLUDES_CONTROL_REASSIGN,
 BODY_INCLUDES_PACKAGE,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,
 DKIM_VALID_AU,DKIM_VALID_EF,FROMDEVELOPER,HAS_PACKAGE,SPF_HELO_NONE,
 SPF_NONE,UNPARSEABLE_RELAY,USER_IN_DKIM_WELCOMELIST,
 WORD_WITHOUT_VOWELS autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 22; hammy, 150; neutral, 43; spammy,
 0. spammytokens:
 hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin,
 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311,
 0.000-+--H*RT:311, 0.000-+--H*RT:108
Return-path: <ntyni@debian.org>
Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:47352)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <ntyni@debian.org>) id 1uunn1-00G0NT-1R
 for submit@bugs.debian.org; Sat, 06 Sep 2025 07:56:51 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; 
 s=smtpauto.stravinsky;
 h=X-Debian-User:Content-Type:MIME-Version:Message-ID:
 Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:
 Content-Description:In-Reply-To:References;
 bh=zURt7vW6z32AmYlD2SzP2tqHYpYTwJeJzzkfUfpYoOA=; b=aOgWLorRUDRhDG24XLuI8HVsrU
 D6v9mINe1OQczlAoAnCyl4z0lSbS6B19GdoZyIGFbcPlqxDhiJAfnuS1EYHn10k8I0CtZoFm0fkle
 W24/apEL/sqFTrm30M6zGSVNMNWeHCiR2L65ikct67f25/KrhOSPoOm5k50d6WywD8Uyonh2UQ/KI
 wiF0gH6mfCgPkHlqXIoLK5FSjN9IMyboGr5DzYMVGiHEcqS/Ijo5Oqb5gdAZ8Yg4L9eBk2wWfEJYl
 EYGA/bxxPDxGyPR0qKh4bzgAHc4wQDR4fTRqXo7AlpiotCjNz8Xn4kKrcv7AIZZH6gfnvVS2xHxiA
 gfH7XFzQ==;
Received: from authenticated user by stravinsky.debian.org with esmtpsa
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.94.2) (envelope-from <ntyni@debian.org>) id 1uunmz-004hbw-OG
 for submit@bugs.debian.org; Sat, 06 Sep 2025 07:56:49 +0000
Date: Sat, 6 Sep 2025 10:56:48 +0300
From: Niko Tyni <ntyni@debian.org>
To: submit@bugs.debian.org
Subject: libpod-simple-perl: each on anonymous hash will always start from
 the beginning
Message-ID: <aLvpQAP3FoqmHdjg@birgitta.local.invalid>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Debian-User: ntyni
Delivered-To: submit@bugs.debian.org

Package: libpod-simple-perl
Version: 3.45-1
Severity: normal
Control: affects -1 libpod-webserver-perl
Control: clone -1 -2
Control: reassign -2 perl 5.40.1-6
Control: block -2 with -1

The Pod::Simple::HTMLBatch module in this package has suspicious code
that generates a warning at compile time:

 $ perl -w -e 'use Pod::Simple::HTMLBatch'
 each on anonymous hash will always start from the beginning at /usr/share/perl5/Pod/Simple/HTMLBatch.pm line 725.

The code in question reads like this:

  for (my ($outfile, $variation) = each %{{
      blkbluw => 'black_with_blue_on_white',
      whtpurk => 'white_with_purple_on_black',
      whtgrng => 'white_with_green_on_grey',
      grygrnw => 'grey_with_green_on_white',
  }}) { ... }

This looks like a real bug; compare:

  % perl -wE 'for (my ($k, $v) = each %{{a=>1,b=>2,c=>3}}) { say "$k: $v"}'
  each on anonymous hash will always start from the beginning at -e line 1.
  b: 2
  b: 2

The code seems to have been introduced somewhere between 3.35 and 3.40,
but I didn't look into it more closely.

Given it's been like this for quite a while, I suppose nothing much really
uses that code. It should probably still be fixed.

The bug is also present in the version bundled with Perl, but it needs to
be fixed in the separate package first (otherwise a buggy version would
override a fixed one on the Perl search path.) I'm cloning a separate
bug for src:perl.

This was noticed because Pod::Webserver uses the Pod::Simple::HTMLBatch
module, so using it generates the same warning. I'm therefore marking
the libpod-webserver-perl package as affected by this.

I understand libpod-webserver-perl now has a workaround for the resulting
autopkgtest failure; that can eventually be dropped once the bug is fixed.
-- 
Niko Tyni   ntyni@debian.org
]