From 49c18d4c91d5b49e0a7cbb8277f3149198004c36 Mon Sep 17 00:00:00 2001 From: Tony Cook Date: Tue, 12 May 2026 14:51:00 +1000 Subject: [PATCH 2/2] perl/perl-security#147: test against the actual character lengths (cherry picked from commit 5e7f119eb2bb1181be908701f22bf7068e722f1c) CVE: CVE-2026-8376 Upstream-Status: Backport [https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c] Signed-off-by: Theo Gaige (Schneider Electric) --- regcomp_study.c | 7 +++++++ t/re/pat_psycho.t | 1 - 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/regcomp_study.c b/regcomp_study.c index 9106452dd5..05f1b017b1 100644 --- a/regcomp_study.c +++ b/regcomp_study.c @@ -2770,6 +2770,13 @@ Perl_study_chunk(pTHX_ (U8 *) SvEND(data->last_found)) - (U8*)s; l -= old; + + if (l > 0 && + (mincount >= SSize_t_MAX / (SSize_t)l + || old > SSize_t_MAX - mincount * (SSize_t)l)) { + FAIL("Regexp out of space"); + } + /* Get the added string: */ last_str = newSVpvn_utf8(s + old, l, UTF); last_chrs = UTF ? utf8_length((U8*)(s + old), diff --git a/t/re/pat_psycho.t b/t/re/pat_psycho.t index 73a7992372..9fd764fd5e 100644 --- a/t/re/pat_psycho.t +++ b/t/re/pat_psycho.t @@ -216,7 +216,6 @@ EOF { # sec #147 $Config{ptrsize} == 4 or skip "these only fail on x32 and use too much memory on x64", 2; - local $::TODO = "This crashes"; # original case fresh_perl_like('/\x{10000}{1073741824}/', qr/Regexp out of space/, {}, "ssize_t overflow"); -- 2.43.0