From e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7 Mon Sep 17 00:00:00 2001 From: "Paul \"LeoNerd\" Evans" Date: Sat, 9 May 2026 16:47:14 +0100 Subject: [PATCH] Storable.xs: Avoid signed int overflow when unpacking a list of hook data items Upstream-Status: Backport [https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7] CVE: CVE-2026-57433 Signed-off-by: Vijay Anusuri --- dist/Storable/Storable.xs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/dist/Storable/Storable.xs b/dist/Storable/Storable.xs index 3930db6..62a1a6d 100644 --- a/dist/Storable/Storable.xs +++ b/dist/Storable/Storable.xs @@ -5035,7 +5035,10 @@ static SV *retrieve_hook_common(pTHX_ stcxt_t *cxt, const char *cname, int large } else GETMARK(len3); - if (len3) { + if (len3 == I32_MAX) + /* If len3 is exactly I32_MAX it will upset av_extend below */ + CROAK(("Invalid count of hook data items")); + else if (len3) { av = newAV(); av_extend(av, len3 + 1); /* Leave room for [0] */ AvFILLp(av) = len3; /* About to be filled anyway */ -- 2.43.0