mirror of
https://git.yoctoproject.org/poky
synced 2026-10-22 19:18:18 +00:00
Jaipaul Cheernam
f4fecd5a7b
This patch applies the upstream fix as referenced in [1], using the commit shown in [2]. [1] https://nvd.nist.gov/vuln/detail/CVE-2026-13221 [2] https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7 (From OE-Core rev: dd5aee19c57a18b1c403496190e832234afc3b4b) Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
76 lines
2.9 KiB
Diff
76 lines
2.9 KiB
Diff
From 03f74bbbd3a68350d926ee93d56ee4808c28c4c7 Mon Sep 17 00:00:00 2001
|
|
From: Karl Williamson <khw@cpan.org>
|
|
Date: Thu, 26 Mar 2026 10:13:49 -0600
|
|
Subject: [PATCH] regcomp_study: Don't create a trie that would overflow
|
|
|
|
This addresses GH #23388
|
|
|
|
The design of the trie compiling code is to batch extra long tries into
|
|
smaller chunks that fit into whatever limitations there are. However,
|
|
this ticket shows that that isn't always being done.
|
|
|
|
In this case, a bunch of branches that have TAIL operands can be
|
|
combined together, and the final TAIL is used. And the code requires
|
|
that the delta between the first branch and this final TAIL fit into a
|
|
16-bit field. That is the root cause of this bug.
|
|
|
|
I'm not familiar enough with the trie construction code to easily
|
|
understand why the final tail needs to be used here. So this patch
|
|
simply doesn't optimize a sequence of branches into a trie that would
|
|
overflow.
|
|
|
|
This could be revisited by someone who knows more about this than I, or
|
|
earlier in the development cycle.
|
|
|
|
CVE: CVE-2026-13221
|
|
Upstream-Status: Backport [https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7]
|
|
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
|
|
---
|
|
regcomp_study.c | 10 ++++++++++
|
|
t/re/pat_advanced.t | 9 +++++++++
|
|
2 files changed, 19 insertions(+)
|
|
|
|
diff --git a/regcomp_study.c b/regcomp_study.c
|
|
index db7ab3a409..a1b2c3d4e5 100644
|
|
--- a/regcomp_study.c
|
|
+++ b/regcomp_study.c
|
|
@@ -1933,6 +1933,16 @@ Perl_study_chunk(pTHX_
|
|
tail = regnext( tail );
|
|
}
|
|
|
|
+ /* The code below currently saves the difference from
|
|
+ * start to finish in a 16-bit field, causing
|
|
+ * GH #23388. This defeats the design of batching
|
|
+ * tries into chunks that each fit. khw thinks it is
|
|
+ * too late in the 5.44 cycle to relook at the design,
|
|
+ * so for now anyway, don't make a trie that would
|
|
+ * overflow */
|
|
+ if (tail - startbranch >= U16_MAX) {
|
|
+ continue;
|
|
+ }
|
|
|
|
DEBUG_TRIE_COMPILE_r({
|
|
regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state);
|
|
diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t
|
|
index 398680838d..c9e389ecb3 100644
|
|
--- a/t/re/pat_advanced.t
|
|
+++ b/t/re/pat_advanced.t
|
|
@@ -4898,6 +4898,15 @@ EOF_DEBUG_OUT
|
|
$x =~ s/^[\x{0301}\x{030C}]+//;
|
|
}
|
|
|
|
+ { # GH #23388
|
|
+ fresh_perl_is(<<~'PROG', , "", {}, "Avoid trie overflow");
|
|
+ my $x = join "|", "aaa".."mzz";
|
|
+ my $y = join "|", "naa".."zzz";
|
|
+ use re 'Debug';
|
|
+ "fnord" =~ m/(?:$x)|(?:$y)/;
|
|
+ PROG
|
|
+ }
|
|
+
|
|
|
|
# !!! NOTE that tests that aren't at all likely to crash perl should go
|
|
# a ways above, above these last ones. There's a comment there that, like
|
|
--
|
|
2.43.0
|