| From 49c18d4c91d5b49e0a7cbb8277f3149198004c36 Mon Sep 17 00:00:00 2001 |
| From: Tony Cook <tony@develop-help.com> |
| Date: Tue, 12 May 2026 14:51:00 +1000 |
| Subject: [PATCH 2/2] perl/perl-security#147: test against the actual character |
| lengths |
| |
| (cherry picked from commit 5e7f119eb2bb1181be908701f22bf7068e722f1c) |
| |
| CVE: CVE-2026-8376 |
| Upstream-Status: Backport [https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c] |
| Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> |
| --- |
| regcomp_study.c | 7 +++++++ |
| t/re/pat_psycho.t | 1 - |
| 2 files changed, 7 insertions(+), 1 deletion(-) |
| |
| diff --git a/regcomp_study.c b/regcomp_study.c |
| index 9106452dd5..05f1b017b1 100644 |
| --- a/regcomp_study.c |
| +++ b/regcomp_study.c |
| @@ -2770,6 +2770,13 @@ Perl_study_chunk(pTHX_ |
| (U8 *) SvEND(data->last_found)) |
| - (U8*)s; |
| l -= old; |
| + |
| + if (l > 0 && |
| + (mincount >= SSize_t_MAX / (SSize_t)l |
| + || old > SSize_t_MAX - mincount * (SSize_t)l)) { |
| + FAIL("Regexp out of space"); |
| + } |
| + |
| /* Get the added string: */ |
| last_str = newSVpvn_utf8(s + old, l, UTF); |
| last_chrs = UTF ? utf8_length((U8*)(s + old), |
| diff --git a/t/re/pat_psycho.t b/t/re/pat_psycho.t |
| index 73a7992372..9fd764fd5e 100644 |
| --- a/t/re/pat_psycho.t |
| +++ b/t/re/pat_psycho.t |
| @@ -216,7 +216,6 @@ EOF |
| { # sec #147 |
| $Config{ptrsize} == 4 |
| or skip "these only fail on x32 and use too much memory on x64", 2; |
| - local $::TODO = "This crashes"; |
| # original case |
| fresh_perl_like('/\x{10000}{1073741824}/', |
| qr/Regexp out of space/, {}, "ssize_t overflow"); |
| -- |
| 2.43.0 |
| |
