summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/perl/files/CVE-2020-10543.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/perl/files/CVE-2020-10543.patch')
-rw-r--r--meta/recipes-devtools/perl/files/CVE-2020-10543.patch36
1 files changed, 36 insertions, 0 deletions
diff --git a/meta/recipes-devtools/perl/files/CVE-2020-10543.patch b/meta/recipes-devtools/perl/files/CVE-2020-10543.patch
new file mode 100644
index 0000000000..36dff0aac9
--- /dev/null
+++ b/meta/recipes-devtools/perl/files/CVE-2020-10543.patch
@@ -0,0 +1,36 @@
1From 897d1f7fd515b828e4b198d8b8bef76c6faf03ed Mon Sep 17 00:00:00 2001
2From: John Lightsey <jd@cpanel.net>
3Date: Wed, 20 Nov 2019 20:02:45 -0600
4Subject: [PATCH] regcomp.c: Prevent integer overflow from nested regex
5 quantifiers.
6
7(CVE-2020-10543) On 32bit systems the size calculations for nested regular
8expression quantifiers could overflow causing heap memory corruption.
9
10Fixes: Perl/perl5-security#125
11(cherry picked from commit bfd31397db5dc1a5c5d3e0a1f753a4f89a736e71)
12
13Upstream-Status: Backport [https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed]
14CVE: CVE-2020-10543
15Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
16---
17 regcomp.c | 6 ++++++
18 1 file changed, 6 insertions(+)
19
20diff --git a/regcomp.c b/regcomp.c
21index 93c8d98fbb0..5f86be8086d 100644
22--- a/regcomp.c
23+++ b/regcomp.c
24@@ -5489,6 +5489,12 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
25 RExC_precomp)));
26 }
27
28+ if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext )
29+ || min >= SSize_t_MAX - minnext * mincount )
30+ {
31+ FAIL("Regexp out of space");
32+ }
33+
34 min += minnext * mincount;
35 is_inf_internal |= deltanext == SSize_t_MAX
36 || (maxcount == REG_INFTY && minnext + deltanext > 0);