/ 
perl-5.44.0
⭐ Starred 2013 / TAP::Formatter::Session
Security Advisories (1)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

NAME

TAP::Formatter::Session - Abstract base class for harness output delegate

VERSION

Version 3.52

METHODS

Class Methods

new

my %args = (
   formatter => $self,
)
my $harness = TAP::Formatter::Console::Session->new( \%args );

The constructor returns a new TAP::Formatter::Console::Session object.

  • formatter

  • parser

  • name

  • show_count

Output test preamble

result

Called by the harness for each line of TAP it receives.

close_test

Called to close a test session.

clear_for_close

Called by close_test to clear the line showing test progress, or the parallel test ruler, prior to printing the final test result.

time_report

Return a formatted string about the elapsed (wall-clock) time and about the consumed CPU time.