mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-04 13:30:54 +00:00
Code Issues Projects Releases Wiki Activity

perl: Fix CVE-2026-19487

Browse Source 
Backport fix for CVE-2026-19487 - AHO-CORASICK regex engine bug

Includes 5 regression test cases in t/re/re_tests.

Tested by running re/pat.t on qemux86-64 target:
1267/1267 tests passed (only pre-existing TODOs as expected failures).

NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19487
Upstream-commit: https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb

(From OE-Core rev: 1453227f21f0cf3d769582dc10ca34f0169dd41d)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Jaipaul Cheernam authored and Paul Barker committed 2026-09-28 10:17:42 +01:00
1 parent 84ab51789d
commit a0abaaf8ec
2 files changed
+67
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta/recipes-devtools/perl/files/CVE-2026-19487.patch
+66
View File
@@ -0,0 +1,66 @@
From 46014ec220989897d7ea53ccc780cea767cc0862 Mon Sep 17 00:00:00 2001
From: Yves Orton <demerphq@gmail.com>
Date: Fri, 7 Feb 2025 10:06:10 +0100
Subject: [PATCH] regexec.c - Fix GH 22892 - AHO-CORASICK edge case issue
In some circumstances the AHO-CORASICK logic wasn't matching properly
when there were two possibilities whose proper prefix matches a proper
suffix of a third possibilty, and one of those possibilities was shorter
than the other.
This was because we were NOT resetting the 'failed' flag properly.
This bug must be rare because it took more than a decade for anyone
to notice.
This patch fixes the problem by resetting the failed flag after a
successful transition.
A good example of this problem is as follows:
"ABCDE" =~ m/ABCF|BCDE|C/
This should match 'BCDE' and not 'C'. Because of the flag issue we were
matching 'C' instead.
This fixes https://github.com/Perl/perl5/issues/22892
Note: t/re/re_tests hunk adjusted for 5.38.4 context (line numbers and
surrounding test data differ from upstream which targets a newer perl).
Upstream-Status: Backport [https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb]
CVE: CVE-2026-19487
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
regexec.c | 1 +
t/re/re_tests | 6 ++++++
2 files changed, 7 insertions(+)
diff --git a/regexec.c b/regexec.c
index e96b622..1eb59bb 100644
--- a/regexec.c
+++ b/regexec.c
@@ -3406,6 +3406,7 @@ S_find_byclass(pTHX_ regexp * prog, const regnode *c, char *s,
{
DEBUG_TRIE_EXECUTE_r(
Perl_re_printf( aTHX_ " - legal\n"));
+ failed = 0;
state = tmp;
break;
}
diff --git a/t/re/re_tests b/t/re/re_tests
index 10da625..eefa579 100644
--- a/t/re/re_tests
+++ b/t/re/re_tests
@@ -2157,6 +2157,12 @@ AB\s+\x{100} AB \x{100}X y - -
/^(xa|(?:[Z=])*\1a){2}$/ xa=xaaa n - - # GH 10073 - RT72020
/^(xa|(?:[Z=]|zzzz)*\1a){2}$/ xa=xaaa n - - # GH 10073 - RT72020
+ABCF|BCDE|C ABCDEX y $& BCDE - # GH 22892 - AHO-CORASICK bug
+ABCF|BCDE|C ABCDX y $& C - # GH 22892 - AHO-CORASICK bug
+ABCF|BCDE|C(G) ABCDE y $& BCDE - # GH 22892 - AHO-CORASICK bug
+ABCF|BCDE|C[Gg] ABCDE y $& BCDE - # GH 22892 - AHO-CORASICK bug
+ABCF|BCD[Ee]|C[Gg] ABCDE y $& BCDE - # GH 22892 - AHO-CORASICK bug
+
# Keep these lines at the end of the file
# pat string y/n/etc expr expected-expr skip-reason comment
# vim: softtabstop=0 noexpandtab
meta/recipes-devtools/perl/perl_5.38.4.bb
+1
View File
@@ -24,6 +24,7 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \
file://CVE-2026-57432-01.patch \
file://CVE-2026-57432-02.patch \
file://CVE-2025-40909.patch \
file://CVE-2026-19487.patch \
"
SRC_URI:append:class-native = " \
file://perl-configpm-switch.patch \