/ 
perl-5.44.0
⭐ Starred 2013 / Tie::RefHash
Security Advisories (1)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

NAME

Tie::RefHash - Use references as hash keys

VERSION

version 1.41

SYNOPSIS

require 5.004;
use Tie::RefHash;
tie HASHVARIABLE, 'Tie::RefHash', LIST;
tie HASHVARIABLE, 'Tie::RefHash::Nestable', LIST;

untie HASHVARIABLE;

DESCRIPTION

This module provides the ability to use references as hash keys if you first tie the hash variable to this module. Normally, only the keys of the tied hash itself are preserved as references; to use references as keys in hashes-of-hashes, use Tie::RefHash::Nestable, included as part of Tie::RefHash.

It is implemented using the standard perl TIEHASH interface. Please see the tie entry in perlfunc(1) and perltie(1) for more information.

The Nestable version works by looking for hash references being stored and converting them to tied hashes so that they too can have references as keys. This will happen without warning whenever you store a reference to one of your own hashes in the tied hash.

EXAMPLE

use Tie::RefHash;
tie %h, 'Tie::RefHash';
$a = [];
$b = {};
$c = \*main;
$d = \"gunk";
$e = sub { 'foo' };
%h = ($a => 1, $b => 2, $c => 3, $d => 4, $e => 5);
$a->[0] = 'foo';
$b->{foo} = 'bar';
for (keys %h) {
   print ref($_), "\n";
}

tie %h, 'Tie::RefHash::Nestable';
$h{$a}->{$b} = 1;
for (keys %h, keys %{$h{$a}}) {
   print ref($_), "\n";
}

THREAD SUPPORT

Tie::RefHash fully supports threading using the CLONE method.

STORABLE SUPPORT

Storable hooks are provided for semantically correct serialization and cloning of tied refhashes.

SEE ALSO

perl(1), perlfunc(1), perltie(1)

SUPPORT

Bugs may be submitted through the RT bug tracker (or bug-Tie-RefHash@rt.cpan.org).

AUTHORS

Gurusamy Sarathy <gsar@activestate.com>

Tie::RefHash::Nestable by Ed Avis <ed@membled.com>

CONTRIBUTORS

  • Yuval Kogman <nothingmuch@woobling.org>

  • Karen Etheridge <ether@cpan.org>

  • Florian Ragwitz <rafl@debian.org>

  • Lukas Mai <lukasmai.403@gmail.com>

  • Jerry D. Hedden <jdhedden@cpan.org>

  • tusooa <tusooa@kazv.moe>

COPYRIGHT AND LICENCE

This software is copyright (c) 2006 by יובל קוג'מן (Yuval Kogman) <nothingmuch@woobling.org>.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.