From d3a60aef4ef346ef14eef59fc6ec31eb57e58557 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <[email protected]> Date: Thu, 21 Apr 2016 12:37:07 +0200 Subject: Fix CVE-2015-8853 (regexp matching hangs indefinitely on illegal UTF-8 input)
--- ...3-PATCH-perl-123562-Regexp-matching-hangs.patch | 107 +++++++++++++++++++++ perl.spec | 12 ++- 2 files changed, 118 insertions(+), 1 deletion(-) create mode 100644 perl-5.20.3-PATCH-perl-123562-Regexp-matching-hangs.patch diff --git a/perl-5.20.3-PATCH-perl-123562-Regexp-matching-hangs.patch b/perl-5.20.3-PATCH-perl-123562-Regexp-matching-hangs.patch new file mode 100644 index 0000000..f29f824 --- /dev/null +++ b/perl-5.20.3-PATCH-perl-123562-Regexp-matching-hangs.patch @@ -0,0 +1,107 @@ +From b39ae59113865155c41edd6781a4901d5171cf0c Mon Sep 17 00:00:00 2001 +From: Karl Williamson <[email protected]> +Date: Wed, 16 Sep 2015 14:34:31 -0600 +Subject: [PATCH] PATCH [perl #123562] Regexp-matching "hangs" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The regex engine got into an infinite loop because of the malformation. +It is trying to back-up over a sequence of UTF-8 continuation bytes. +But the character just before the sequence should be a start byte. If +not, there is a malformation. I added a test to croak if that isn't the +case so that it doesn't just infinitely loop. I did this also in the +similar areas of regexec.c. + +Comments long ago added to the code suggested that we check for +malformations in the vicinity of the new tests. But that was never +done. These new tests should be good enough to prevent looping, anyway. + +Petr Písař: Ported to 5.20.3. + +CVE-2015-8853 +<https://bugzilla.redhat.com/show_bug.cgi?id=1329107> + +Signed-off-by: Petr Písař <[email protected]> +--- + regexec.c | 12 ++++++++++++ + t/re/pat.t | 19 ++++++++++++++++++- + 2 files changed, 30 insertions(+), 1 deletion(-) + +diff --git a/regexec.c b/regexec.c +index 66f6e04..ee6705a 100644 +--- a/regexec.c ++++ b/regexec.c +@@ -7830,6 +7830,10 @@ S_reghop3(U8 *s, SSize_t off, const U8* lim) + if (UTF8_IS_CONTINUED(*s)) { + while (s > lim && UTF8_IS_CONTINUATION(*s)) + s--; ++ if (! UTF8_IS_START(*s)) { ++ dTHX; ++ Perl_croak(aTHX_ "Malformed UTF-8 character (fatal)"); ++ } + } + /* XXX could check well-formedness here */ + } +@@ -7856,6 +7860,10 @@ S_reghop4(U8 *s, SSize_t off, const U8* llim, const U8* rlim) + if (UTF8_IS_CONTINUED(*s)) { + while (s > llim && UTF8_IS_CONTINUATION(*s)) + s--; ++ if (! UTF8_IS_START(*s)) { ++ dTHX; ++ Perl_croak(aTHX_ "Malformed UTF-8 character (fatal)"); ++ } + } + /* XXX could check well-formedness here */ + } +@@ -7887,6 +7895,10 @@ S_reghopmaybe3(U8* s, SSize_t off, const U8* lim) + if (UTF8_IS_CONTINUED(*s)) { + while (s > lim && UTF8_IS_CONTINUATION(*s)) + s--; ++ if (! UTF8_IS_START(*s)) { ++ dTHX; ++ Perl_croak(aTHX_ "Malformed UTF-8 character (fatal)"); ++ } + } + /* XXX could check well-formedness here */ + } +diff --git a/t/re/pat.t b/t/re/pat.t +index 7965f4e..2fa6206 100644 +--- a/t/re/pat.t ++++ b/t/re/pat.t +@@ -20,7 +20,7 @@ BEGIN { + require './test.pl'; + } + +-plan tests => 726; # Update this when adding/deleting tests. ++plan tests => 727; # Update this when adding/deleting tests. + + run_tests() unless caller; + +@@ -1602,6 +1602,23 @@ EOP + ok(1, "did not crash"); + ok($match, "[bbb...] resolved as character class, not subscript"); + } ++ ++ { # Test that we handle some malformed UTF-8 without looping [perl ++ # #123562] ++ ++ my $code=' ++ BEGIN{require q(test.pl);} ++ use Encode qw(_utf8_on); ++ my $malformed = "a\x80\n"; ++ _utf8_on($malformed); ++ watchdog(3); ++ $malformed =~ /(\n\r|\r)$/; ++ print q(No infinite loop here!); ++ '; ++ fresh_perl_like($code, qr/Malformed UTF-8 character/, {}, ++ "test that we handle some UTF-8 malformations without looping" ); ++ } ++ + } # End of sub run_tests + + 1; +-- +2.5.5 + diff --git a/perl.spec b/perl.spec index 256ca51..2fcf0c8 100644 --- a/perl.spec +++ b/perl.spec @@ -30,7 +30,7 @@ Name: perl Version: %{perl_version} # release number must be even higher, because dual-lived modules will be broken otherwise -Release: 329%{?dist} +Release: 330%{?dist} Epoch: %{perl_epoch} Summary: Practical Extraction and Report Language Group: Development/Languages @@ -113,6 +113,10 @@ Patch29: perl-5.21.3-fix-debugger-y-command-scope-level.patch # in upstream after 5.23.8 Patch30: perl-5.23.8-remove-duplicate-environment-variables-from-environ.patch +# Fix CVE-2015-8853 (regexp matching hangs indefinitely on illegal UTF-8 +# input), bug #1329107, RT#123562, in upstream after 5.23.2 +Patch31: perl-5.20.3-PATCH-perl-123562-Regexp-matching-hangs.patch + # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048 Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch @@ -2053,6 +2057,7 @@ tarball from perl.org. %patch28 -p1 %patch29 -p1 %patch30 -p1 +%patch31 -p1 %patch200 -p1 %patch201 -p1 @@ -2076,6 +2081,7 @@ perl -x patchlevel.h \ 'Fedora Patch28: Use stronger algorithm needed for FIPS in t/op/taint.t (RT#123338)' \ 'Fedora Patch29: Fix debugger y command scope level' \ 'Fedora Patch30: Fix CVE-2016-2381 (ambiguous environment variables handling)' \ + 'Fedora Patch31: Fix CVE-2015-8853 (regexp matching hangs on illegal UTF-8)' \ 'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \ 'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \ %{nil} @@ -3929,6 +3935,10 @@ sed \ # Old changelog entries are preserved in CVS. %changelog +* Thu Apr 21 2016 Petr Pisar <[email protected]> - 4:5.20.3-330 +- Fix CVE-2015-8853 (regexp matching hangs indefinitely on illegal UTF-8 + input) (bug #1329107) + * Wed Mar 02 2016 Petr Pisar <[email protected]> - 4:5.20.3-329 - Fix CVE-2016-2381 (ambiguous environment variables handling) (bug #1313702) -- cgit v0.12 http://pkgs.fedoraproject.org/cgit/perl.git/commit/?h=f22&id=d3a60aef4ef346ef14eef59fc6ec31eb57e58557 -- Fedora Extras Perl SIG http://www.fedoraproject.org/wiki/Extras/SIGs/Perl perl-devel mailing list [email protected] http://lists.fedoraproject.org/admin/lists/[email protected]
