/ 
perl-5.45.1
⭐ Starred 2013 / Tie::Handle
Security Advisories (1)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

NAME

Tie::Handle - base class definitions for tied handles

SYNOPSIS

package NewHandle;
require Tie::Handle;

@ISA = qw(Tie::Handle);

sub READ { ... }		# Provide a needed method
sub TIEHANDLE { ... }	# Overrides inherited method


package main;

tie *FH, 'NewHandle';

DESCRIPTION

This module provides some skeletal methods for handle-tying classes. See perltie for a list of the functions required in tying a handle to a package. The basic Tie::Handle package provides a new method, as well as methods TIEHANDLE, PRINT, PRINTF and GETC.

For developers wishing to write their own tied-handle classes, the methods are summarized below. The perltie section not only documents these, but has sample code as well:

TIEHANDLE classname, LIST

The method invoked by the command tie *glob, classname. Associates a new glob instance with the specified class. LIST would represent additional arguments (along the lines of AnyDBM_File and compatriots) needed to complete the association.

WRITE this, scalar, length, offset

Write length bytes of data from scalar starting at offset.

Print the values in LIST

PRINTF this, format, LIST

Print the values in LIST using format

READ this, scalar, length, offset

Read length bytes of data into scalar starting at offset.

READLINE this

Read a single line

GETC this

Get a single character

CLOSE this

Close the handle

OPEN this, filename

(Re-)open the handle

BINMODE this

Specify content is binary

EOF this

Test for end of file.

TELL this

Return position in the file.

SEEK this, offset, whence

Position the file.

Test for end of file.

DESTROY this

Free the storage associated with the tied handle referenced by this. This is rarely needed, as Perl manages its memory quite well. But the option exists, should a class wish to perform specific actions upon the destruction of an instance.

MORE INFORMATION

The perltie section contains an example of tying handles.

COMPATIBILITY

This version of Tie::Handle is neither related to nor compatible with the Tie::Handle (3.0) module available on CPAN. It was due to an accident that two modules with the same name appeared. The namespace clash has been cleared in favor of this module that comes with the perl core in September 2000 and accordingly the version number has been bumped up to 4.0.