In perl.git, the branch blead has been updated <https://perl5.git.perl.org/perl.git/commitdiff/abc1d81d7169b55539b1137fcb120d065f696eb7?hp=58e4a4676d898b44a54a55a7062b3bb087afa275>
- Log ----------------------------------------------------------------- commit abc1d81d7169b55539b1137fcb120d065f696eb7 Author: Karl Williamson <[email protected]> Date: Mon Sep 11 17:24:00 2017 -0600 locale.c: Avoid potential read beyond buffer end I noticed this flaw by code reading; I doubt that it's exploitable. foldEQ assumes that both operands are at least as long as its length parameter. In this case, it's possible that the codeset returned by nl_langinfo is shorter than 5, in which case, it would try to access the extra characters in the heap. Real codesets tend to be longer than this, so an attacker would likely have to install a locale with a made-up codeset whose name is shorter. Even the C locale is longer: "ANSI_X3.4-1968" ----------------------------------------------------------------------- Summary of changes: locale.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/locale.c b/locale.c index b2eaf4c418..a2985f7457 100644 --- a/locale.c +++ b/locale.c @@ -3018,8 +3018,10 @@ Perl__is_cur_LC_category_utf8(pTHX_ int category) Safefree(save_ctype_locale); } - is_utf8 = foldEQ(codeset, STR_WITH_LEN("UTF-8")) - || foldEQ(codeset, STR_WITH_LEN("UTF8")); + is_utf8 = ( ( strlen(codeset) == STRLENs("UTF-8") + && foldEQ(codeset, STR_WITH_LEN("UTF-8"))) + || ( strlen(codeset) == STRLENs("UTF8") + && foldEQ(codeset, STR_WITH_LEN("UTF8")))); DEBUG_L(PerlIO_printf(Perl_debug_log, "\tnllanginfo returned CODESET '%s'; ?UTF8 locale=%d\n", -- Perl5 Master Repository
