From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
Subject: [PATCH] XML::Bare: advance stuck attribute-name state (infinite loop)

Infinite loop (CWE-835) in the hand-rolled C parser (parser.c), reached
by the default XML::Bare->new(text=>$xml)->parse on untrusted XML.

The `att_nameqsdone` state — reached after a single-quoted attribute
*name* — loops back to itself without advancing `cpos` on any character
other than `=` or NUL, spinning forever in C on malformed input. The
parser holds the interpreter for the duration of the call, so no
Perl-level signal (`alarm`, etc.) can interrupt it: a single request
pins a CPU indefinitely. Triggers: `<a ='c'>`, `<a b='''''''c'>`,
`<x y=''''''z'>`.

Fix: advance the cursor before looping, so the scan terminates at the
next `=` or at the NUL sentinel (already handled by the `case 0` branch).
--- a/parser.c
+++ b/parser.c
@@ -484,6 +485,7 @@
           cpos++;
           goto att_eq1;
       }
+      cpos++; // advance the cursor so malformed input (no '=' after a quoted attr name) cannot spin forever
       goto att_nameqsdone;
       
     att_eq1: