/ 
perl-5.44.0
⭐ Starred 2013 / IPC::SysV
Security Advisories (1)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

NAME

IPC::SysV - System V IPC constants and system calls

SYNOPSIS

use IPC::SysV qw(IPC_STAT IPC_PRIVATE);

DESCRIPTION

IPC::SysV defines and conditionally exports all the constants defined in your system include files which are needed by the SysV IPC calls. Common ones include

IPC_CREAT IPC_EXCL IPC_NOWAIT IPC_PRIVATE IPC_RMID IPC_SET IPC_STAT
GETVAL SETVAL GETPID GETNCNT GETZCNT GETALL SETALL
SEM_A SEM_R SEM_UNDO
SHM_RDONLY SHM_RND SHMLBA

and auxiliary ones

S_IRUSR S_IWUSR S_IRWXU
S_IRGRP S_IWGRP S_IRWXG
S_IROTH S_IWOTH S_IRWXO

but your system might have more.

ftok( PATH )
ftok( PATH, ID )

Return a key based on PATH and ID, which can be used as a key for msgget, semget and shmget. See ftok(3).

If ID is omitted, it defaults to 1. If a single character is given for ID, the numeric value of that character is used.

shmat( ID, ADDR, FLAG )

Attach the shared memory segment identified by ID to the address space of the calling process. See shmat(2).

ADDR should be undef unless you really know what you're doing.

shmdt( ADDR )

Detach the shared memory segment located at the address specified by ADDR from the address space of the calling process. See shmdt(2).

memread( ADDR, VAR, POS, SIZE )

Reads SIZE bytes from a memory segment at ADDR starting at position POS. VAR must be a variable that will hold the data read. Returns true if successful, or false if there is an error. memread() taints the variable.

memwrite( ADDR, STRING, POS, SIZE )

Writes SIZE bytes from STRING to a memory segment at ADDR starting at position POS. If STRING is too long, only SIZE bytes are used; if STRING is too short, nulls are written to fill out SIZE bytes. Returns true if successful, or false if there is an error.

SEE ALSO

IPC::Msg, IPC::Semaphore, IPC::SharedMem, ftok(3), shmat(2), shmdt(2)

AUTHORS

Graham Barr <gbarr@pobox.com>, Jarkko Hietaniemi <jhi@iki.fi>, Marcus Holland-Moritz <mhx@cpan.org>

COPYRIGHT

Version 2.x, Copyright (C) 2007-2013, Marcus Holland-Moritz.

Version 1.x, Copyright (c) 1997, Graham Barr.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.