/ 
perl-5.42.0
⭐ Starred 2013 / TAP::Parser::ResultFactory
Security Advisories (2)
CVE-2026-8376 (2026-05-25)

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

CVE-2026-4176 (2026-03-29)

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

NAME

TAP::Parser::ResultFactory - Factory for creating TAP::Parser output objects

SYNOPSIS

use TAP::Parser::ResultFactory;
my $token   = {...};
my $factory = TAP::Parser::ResultFactory->new;
my $result  = $factory->make_result( $token );

VERSION

Version 3.50

DESCRIPTION

This is a simple factory class which returns a TAP::Parser::Result subclass representing the current bit of test data from TAP (usually a single line). It is used primarily by TAP::Parser::Grammar. Unless you're subclassing, you probably won't need to use this module directly.

METHODS

Class Methods

new

Creates a new factory class. Note: You currently don't need to instantiate a factory in order to use it.

make_result

Returns an instance the appropriate class for the test token passed in.

my $result = TAP::Parser::ResultFactory->make_result($token);

Can also be called as an instance method.

class_for

Takes one argument: $type. Returns the class for this $type, or croaks with an error.

register_type

Takes two arguments: $type, $class

This lets you override an existing type with your own custom type, or register a completely new type, eg:

# create a custom result type:
package MyResult;
use strict;
use base 'TAP::Parser::Result';

# register with the factory:
TAP::Parser::ResultFactory->register_type( 'my_type' => __PACKAGE__ );

# use it:
my $r = TAP::Parser::ResultFactory->( { type => 'my_type' } );

Your custom type should then be picked up automatically by the TAP::Parser.

SUBCLASSING

Please see "SUBCLASSING" in TAP::Parser for a subclassing overview.

There are a few things to bear in mind when creating your own ResultFactory:

  1. The factory itself is never instantiated (this may change in the future). This means that _initialize is never called.

  2. TAP::Parser::Result->new is never called, $tokens are reblessed. This will change in a future version!

  3. TAP::Parser::Result subclasses will register themselves with TAP::Parser::ResultFactory directly:

    package MyFooResult;
TAP::Parser::ResultFactory->register_type( foo => __PACKAGE__ );

    Of course, it's up to you to decide whether or not to ignore them.

Example

package MyResultFactory;

use strict;

use MyResult;

use base 'TAP::Parser::ResultFactory';

# force all results to be 'MyResult'
sub class_for {
  return 'MyResult';
}

1;

SEE ALSO

TAP::Parser, TAP::Parser::Result, TAP::Parser::Grammar