In perl.git, the branch blead has been updated <http://perl5.git.perl.org/perl.git/commitdiff/26fb2318c4fffb51517349273992c3b9514d0d67?hp=856bb39c27416e4cb179e60a2b67ab0810baf7c3>
- Log ----------------------------------------------------------------- commit 26fb2318c4fffb51517349273992c3b9514d0d67 Author: Tony Cook <[email protected]> Date: Mon Aug 29 15:04:55 2016 +1000 (perl #129085) avoid memcmp() past the end of a string When a match is anchored against the start of a string, the regexp can be compiled to include a fixed string match against a fixed offset in the string. In some cases, where the matched against string included UTF-8 before the fixed offset, this could result in attempting a memcmp() which overlaps the end of the string and potentially past the end of the allocated memory. ----------------------------------------------------------------------- Summary of changes: regexec.c | 5 +++-- t/re/pat_rt_report.t | 9 ++++++++- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/regexec.c b/regexec.c index 1d8e33a..aca490e 100644 --- a/regexec.c +++ b/regexec.c @@ -813,8 +813,9 @@ Perl_re_intuit_start(pTHX_ /* Now should match s[0..slen-2] */ slen--; } - if (slen && (*SvPVX_const(check) != *s - || (slen > 1 && memNE(SvPVX_const(check), s, slen)))) + if (slen && (strend - s < slen + || *SvPVX_const(check) != *s + || (slen > 1 && (memNE(SvPVX_const(check), s, slen))))) { DEBUG_EXECUTE_r(Perl_re_printf( aTHX_ " String not equal...\n")); diff --git a/t/re/pat_rt_report.t b/t/re/pat_rt_report.t index addb3e2..bee1b19 100644 --- a/t/re/pat_rt_report.t +++ b/t/re/pat_rt_report.t @@ -20,7 +20,7 @@ use warnings; use 5.010; use Config; -plan tests => 2501; # Update this when adding/deleting tests. +plan tests => 2502; # Update this when adding/deleting tests. run_tests() unless caller; @@ -1123,6 +1123,13 @@ EOP ok($s !~ /00000?\x80\x80\x80/, "RT #129012"); } + { + # RT #129085 heap-buffer-overflow Perl_re_intuit_start + # this did fail under ASAN, but didn't under valgrind + my $s = "\x{f2}\x{140}\x{fe}\x{ff}\x{ff}\x{ff}"; + ok($s !~ /^0000.\34500\376\377\377\377/, "RT #129085"); + } + } # End of sub run_tests 1; -- Perl5 Master Repository
