From a0abaaf8ecd7168289f692477e2ba1353f5fae4e Mon Sep 17 00:00:00 2001 From: Jaipaul Cheernam Date: Mon, 31 Aug 2026 16:44:26 +0200 Subject: [PATCH] perl: Fix CVE-2026-19487 Backport fix for CVE-2026-19487 - AHO-CORASICK regex engine bug Includes 5 regression test cases in t/re/re_tests. Tested by running re/pat.t on qemux86-64 target: 1267/1267 tests passed (only pre-existing TODOs as expected failures). NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19487 Upstream-commit: https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb (From OE-Core rev: 1453227f21f0cf3d769582dc10ca34f0169dd41d) Signed-off-by: Jaipaul Cheernam Signed-off-by: Yoann Congal Signed-off-by: Paul Barker --- .../perl/files/CVE-2026-19487.patch | 66 +++++++++++++++++++ meta/recipes-devtools/perl/perl_5.38.4.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-19487.patch diff --git a/meta/recipes-devtools/perl/files/CVE-2026-19487.patch b/meta/recipes-devtools/perl/files/CVE-2026-19487.patch new file mode 100644 index 0000000000..86feedcda4 --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2026-19487.patch @@ -0,0 +1,66 @@ +From 46014ec220989897d7ea53ccc780cea767cc0862 Mon Sep 17 00:00:00 2001 +From: Yves Orton +Date: Fri, 7 Feb 2025 10:06:10 +0100 +Subject: [PATCH] regexec.c - Fix GH 22892 - AHO-CORASICK edge case issue + +In some circumstances the AHO-CORASICK logic wasn't matching properly +when there were two possibilities whose proper prefix matches a proper +suffix of a third possibilty, and one of those possibilities was shorter +than the other. + +This was because we were NOT resetting the 'failed' flag properly. +This bug must be rare because it took more than a decade for anyone +to notice. + +This patch fixes the problem by resetting the failed flag after a +successful transition. + +A good example of this problem is as follows: + + "ABCDE" =~ m/ABCF|BCDE|C/ + +This should match 'BCDE' and not 'C'. Because of the flag issue we were +matching 'C' instead. + +This fixes https://github.com/Perl/perl5/issues/22892 + +Note: t/re/re_tests hunk adjusted for 5.38.4 context (line numbers and +surrounding test data differ from upstream which targets a newer perl). + +Upstream-Status: Backport [https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb] +CVE: CVE-2026-19487 +Signed-off-by: Jaipaul Cheernam +--- + regexec.c | 1 + + t/re/re_tests | 6 ++++++ + 2 files changed, 7 insertions(+) + +diff --git a/regexec.c b/regexec.c +index e96b622..1eb59bb 100644 +--- a/regexec.c ++++ b/regexec.c +@@ -3406,6 +3406,7 @@ S_find_byclass(pTHX_ regexp * prog, const regnode *c, char *s, + { + DEBUG_TRIE_EXECUTE_r( + Perl_re_printf( aTHX_ " - legal\n")); ++ failed = 0; + state = tmp; + break; + } +diff --git a/t/re/re_tests b/t/re/re_tests +index 10da625..eefa579 100644 +--- a/t/re/re_tests ++++ b/t/re/re_tests +@@ -2157,6 +2157,12 @@ AB\s+\x{100} AB \x{100}X y - - + /^(xa|(?:[Z=])*\1a){2}$/ xa=xaaa n - - # GH 10073 - RT72020 + /^(xa|(?:[Z=]|zzzz)*\1a){2}$/ xa=xaaa n - - # GH 10073 - RT72020 + ++ABCF|BCDE|C ABCDEX y $& BCDE - # GH 22892 - AHO-CORASICK bug ++ABCF|BCDE|C ABCDX y $& C - # GH 22892 - AHO-CORASICK bug ++ABCF|BCDE|C(G) ABCDE y $& BCDE - # GH 22892 - AHO-CORASICK bug ++ABCF|BCDE|C[Gg] ABCDE y $& BCDE - # GH 22892 - AHO-CORASICK bug ++ABCF|BCD[Ee]|C[Gg] ABCDE y $& BCDE - # GH 22892 - AHO-CORASICK bug ++ + # Keep these lines at the end of the file + # pat string y/n/etc expr expected-expr skip-reason comment + # vim: softtabstop=0 noexpandtab diff --git a/meta/recipes-devtools/perl/perl_5.38.4.bb b/meta/recipes-devtools/perl/perl_5.38.4.bb index b86c58f540..8ce5d3f5d0 100644 --- a/meta/recipes-devtools/perl/perl_5.38.4.bb +++ b/meta/recipes-devtools/perl/perl_5.38.4.bb @@ -24,6 +24,7 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ file://CVE-2026-57432-01.patch \ file://CVE-2026-57432-02.patch \ file://CVE-2025-40909.patch \ + file://CVE-2026-19487.patch \ " SRC_URI:append:class-native = " \ file://perl-configpm-switch.patch \