Hi Yoann, Please ignore this series.
I just saw the fixes for CVE-2026-13221 , CVE-2026-57432 in the wrynose-nut branch. I will send v2 patch for CVE-2026-57433 . Thanks & Regards, Vijay On Thu, Aug 27, 2026 at 1:05 PM Vijay Anusuri via lists.openembedded.org <[email protected]> wrote: > Pick patch according to [2] > > [1] https://nvd.nist.gov/vuln/detail/cve-2026-13221 > [2] https://security-tracker.debian.org/tracker/CVE-2026-13221 > > Signed-off-by: Vijay Anusuri <[email protected]> > --- > .../perl/files/CVE-2026-13221.patch | 76 +++++++++++++++++++ > meta/recipes-devtools/perl/perl_5.42.0.bb | 1 + > 2 files changed, 77 insertions(+) > create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-13221.patch > > diff --git a/meta/recipes-devtools/perl/files/CVE-2026-13221.patch > b/meta/recipes-devtools/perl/files/CVE-2026-13221.patch > new file mode 100644 > index 0000000000..211aabd7ef > --- /dev/null > +++ b/meta/recipes-devtools/perl/files/CVE-2026-13221.patch > @@ -0,0 +1,76 @@ > +From 03f74bbbd3a68350d926ee93d56ee4808c28c4c7 Mon Sep 17 00:00:00 2001 > +From: Karl Williamson <[email protected]> > +Date: Thu, 26 Mar 2026 10:13:49 -0600 > +Subject: [PATCH] regcomp_study: Don't create a trie that would overflow > + > +This addresses GH #23388 > + > +The design of the trie compiling code is to batch extra long tries into > +smaller chunks that fit into whatever limitations there are. However, > +this ticket shows that that isn't always being done. > + > +In this case, a bunch of branches that have TAIL operands can be > +combined together, and the final TAIL is used. And the code requires > +that the delta between the first branch and this final TAIL fit into a > +16-bit field. That is the root cause of this bug. > + > +I'm not familiar enough with the trie construction code to easily > +understand why the final tail needs to be used here. So this patch > +simply doesn't optimize a sequence of branches into a trie that would > +overflow. > + > +This could be revisited by someone who knows more about this than I, or > +earlier in the development cycle. > + > +Upstream-Status: Backport [ > https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7 > ] > +CVE: CVE-2026-13221 > +Signed-off-by: Vijay Anusuri <[email protected]> > +--- > + regcomp_study.c | 10 ++++++++++ > + t/re/pat_advanced.t | 9 +++++++++ > + 2 files changed, 19 insertions(+) > + > +diff --git a/regcomp_study.c b/regcomp_study.c > +index 05f1b01..644fbfe 100644 > +--- a/regcomp_study.c > ++++ b/regcomp_study.c > +@@ -1841,6 +1841,16 @@ Perl_study_chunk(pTHX_ > + tail = regnext( tail ); > + } > + > ++ /* The code below currently saves the difference > from > ++ * start to finish in a 16-bit field, causing > ++ * GH #23388. This defeats the design of batching > ++ * tries into chunks that each fit. khw thinks it > is > ++ * too late in the 5.44 cycle to relook at the > design, > ++ * so for now anyway, don't make a trie that would > ++ * overflow */ > ++ if (tail - startbranch >= U16_MAX) { > ++ continue; > ++ } > + > + DEBUG_TRIE_COMPILE_r({ > + regprop(RExC_rx, RExC_mysv, tail, NULL, > pRExC_state); > +diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t > +index 4d62f62..a3460fc 100644 > +--- a/t/re/pat_advanced.t > ++++ b/t/re/pat_advanced.t > +@@ -2713,6 +2713,15 @@ EOF_DEBUG_OUT > + $x =~ s/^[\x{0301}\x{030C}]+//; > + } > + > ++ { # GH #23388 > ++ fresh_perl_is(<<~'PROG', , "", {}, "Avoid trie overflow"); > ++ my $x = join "|", "aaa".."mzz"; > ++ my $y = join "|", "naa".."zzz"; > ++ use re 'Debug'; > ++ "fnord" =~ m/(?:$x)|(?:$y)/; > ++ PROG > ++ } > ++ > + > + # !!! NOTE that tests that aren't at all likely to crash perl should > go > + # a ways above, above these last ones. There's a comment there > that, like > +-- > +2.43.0 > + > diff --git a/meta/recipes-devtools/perl/perl_5.42.0.bb > b/meta/recipes-devtools/perl/perl_5.42.0.bb > index 1833b7a352..1a3451b747 100644 > --- a/meta/recipes-devtools/perl/perl_5.42.0.bb > +++ b/meta/recipes-devtools/perl/perl_5.42.0.bb > @@ -18,6 +18,7 @@ SRC_URI = " > https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ > > file://0001-cpan-Sys-Syslog-Makefile.PL-Fix-_PATH_LOG-for-determ.patch \ > file://CVE-2026-8376-01.patch \ > file://CVE-2026-8376-02.patch \ > + file://CVE-2026-13221.patch \ > " > SRC_URI:append:class-native = " \ > file://perl-configpm-switch.patch \ > -- > 2.43.0 > > > > >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244470): https://lists.openembedded.org/g/openembedded-core/message/244470 Mute This Topic: https://lists.openembedded.org/mt/120953088/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
