[AutoPR- Security] Patch bison for CVE-2026-56390, CVE-2026-56389 [MEDIUM]

[azurelinux-security]

Auto Patch bison for CVE-2026-56390, CVE-2026-56389.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1171279&view=results

CVE-2026-56390 : Single Patch Backporter Pipeline Run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1171289&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

• Auto Patch bison for CVE-2026-56390 (MEDIUM), CVE-2026-56389 (MEDIUM).

Change Log

• CVE-2026-56390
• CVE-2026-56389

Does this affect the toolchain?

YES/NO

Associated issues

• N/A

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-56390
• https://nvd.nist.gov/vuln/detail/CVE-2026-56389

Test Methodology

• Pipeline build id: Buddy Build URL

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Kanishk-Bansal]

use autosetup -p1

[v-aaditya]

Buddy Build has been triggered and it has passed.

[v-swapsahu]

Patch analysis
CVE-2026-56389:
The AI-generated patch matches the upstream fix exactly.

• print_html() no longer reads the xsltproc binary path from the attacker-controllable %define tool.xsltproc grammar directive; it is now hardcoded to "xsltproc", resolved via PATH.

CVE-2026-56390:
Backported: Yes
The patch aligns with the upstream fix, with a minor modification.

• It adds valid_output_file_name() and applies it to both the %header and %output directives in src/parse-gram.y. This functionally matches the security-relevant part of the upstream commit.

Upstream changes not required for this backport:

• THANKS — only adds a contributor-credit line for the reporter. No functional/security relevance; safe to omit.
• src/parse-gram.h — the diff there is only a regenerated YYBISON_VERSION banner and copyright-year bump (no functional code). The actual fix logic (handle_header, valid_output_file_name) lives entirely in parse-gram.c, which is patched here. Safe to omit.

Suggested Fix-ups

1. Stale yyrline[] table in parse-gram.c
   The yyrline[] array (used only for bison's own --trace=parse / YYDEBUG diagnostics on this bootstrap parser) still has the old line numbers. This is purely cosmetic and doesn't affect parsing correctness, but should be corrected for consistency and debuggability.

2. Indentation inconsistency in the new %output handler
   The braces are correctly balanced and the code is functionally correct as-is.

3. License-check CI failure (pre-existing, unrelated to the CVE fix, but currently blocking this PR)

bison-3.8.2-*.rpm fails the license-check gate with: duplicated license files: /usr/share/doc/bison/COPYING
This is a pre-existing bison.spec defect.
Suggested fix:

         _%license COPYING
          %exclude %{_docdir}/%{name}/COPYING_

5. Consider %autosetup instead of manual %setup + %patch

           _%prep
           %autosetup -p1_