/ 
perl-5.44.0
⭐ Starred 2013 / module-version.t
Security Advisories (1)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

NAME

module-version.t - Check or update versions of Perl modules

SYNOPSIS

module-version.t [--update]

REQUIREMENTS

Perl 5.12 or later, the Perl6::Slurp module, and the JSON::PP Perl module, both of which are available from CPAN. JSON::PP is also included in Perl core in Perl 5.14 and later.

DESCRIPTION

This script has a dual purpose as either a test script or a utility script. The intent is to assist with maintaining consistent versions in a Perl distribution, supporting both the package keyword syntax introduced in Perl 5.12 or the older explicit setting of a $VERSION variable.

As a test, it reads the current version of a package from the MYMETA.json file in the current directory (which should be the root of the distribution) and then looks for any Perl modules in lib. If it finds any, it checks that the version number of the Perl module matches the version number of the package from the MYMETA.json file. These test results are reported with Test::More, suitable for any TAP harness.

As a utility script, when run with the --update option, it similarly finds all Perl modules in lib and then rewrites their version setting to match the version of the package as determined from the MYMETA.json file.

OPTIONS

-u, --update

Rather than test the Perl modules for the correct version, update all Perl modules found in the tree under lib to the current version from the MYMETA.json file.

AUTHOR

Russ Allbery <eagle@eyrie.org>

COPYRIGHT AND LICENSE

Copyright 2013-2014 The Board of Trustees of the Leland Stanford Junior University

Copyright 2014-2016, 2019-2021, 2024 Russ Allbery <eagle@eyrie.org>

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

SEE ALSO

This module is maintained in the rra-c-util package. The current version is available from https://www.eyrie.org/~eagle/software/rra-c-util/.