/ 
perl-5.43.9
⭐ Starred 2013 / B::Op_private
Security Advisories (3)
CVE-2026-13221 (2026-07-13)

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

CVE-2026-57432 (2026-07-13)

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

CVE-2026-8376 (2026-05-25)

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

NAME

B::Op_private - OP op_private flag definitions

SYNOPSIS

use B::Op_private;

# flag details for bit 7 of OP_AELEM's op_private:
my $name  = $B::Op_private::bits{aelem}{7}; # OPpLVAL_INTRO
my $value = $B::Op_private::defines{$name}; # 128
my $label = $B::Op_private::labels{$name};  # LVINTRO

# the bit field at bits 5..6 of OP_AELEM's op_private:
my $bf  = $B::Op_private::bits{aelem}{6};
my $mask = $bf->{bitmask}; # etc

DESCRIPTION

This module provides four global hashes:

%B::Op_private::bits
%B::Op_private::defines
%B::Op_private::labels
%B::Op_private::ops_using

which contain information about the per-op meanings of the bits in the op_private field.

%bits

This is indexed by op name and then bit number (0..7). For single bit flags, it returns the name of the define (if any) for that bit:

$B::Op_private::bits{aelem}{7} eq 'OPpLVAL_INTRO';

For bit fields, it returns a hash ref containing details about the field. The same reference will be returned for all bit positions that make up the bit field; so for example these both return the same hash ref:

$bitfield = $B::Op_private::bits{aelem}{5};
$bitfield = $B::Op_private::bits{aelem}{6};

The general format of this hash ref is

{
    # The bit range and mask; these are always present.
    bitmin        => 5,
    bitmax        => 6,
    bitmask       => 0x60,

    # (The remaining keys are optional)

    # The names of any defines that were requested:
    mask_def      => 'OPpFOO_MASK',
    baseshift_def => 'OPpFOO_SHIFT',
    bitcount_def  => 'OPpFOO_BITS',

    # If present, Concise etc will display the value with a 'FOO='
    # prefix. If it equals '-', then Concise will treat the bit
    # field as raw bits and not try to interpret it.
    label         => 'FOO',

    # If present, specifies the names of some defines and the
    # display labels that are used to assign meaning to particu-
    # lar integer values within the bit field; e.g. 3 is dis-
    # played as 'C'.
    enum          => [ qw(
                         1   OPpFOO_A  A
                         2   OPpFOO_B  B
                         3   OPpFOO_C  C
                     )],

};

%defines

This gives the value of every OPp define, e.g.

$B::Op_private::defines{OPpLVAL_INTRO} == 128;

%labels

This gives the short display label for each define, as used by B::Concise and perl -Dx, e.g.

$B::Op_private::labels{OPpLVAL_INTRO} eq 'LVINTRO';

If the label equals '-', then Concise will treat the bit as a raw bit and not try to display it symbolically.

%ops_using

For each define, this gives a reference to an array of op names that use the flag.

@ops_using_lvintro = @{ $B::Op_private::ops_using{OPp_LVAL_INTRO} };