/ 
perl-5.13.2
⭐ Starred 2013
/ OS2::DLL
Security Advisories (20)
CVE-2011-2728 (2012-12-21)

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2013-1667 (2013-03-14)

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

CVE-2010-4777 (2014-02-10)

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

CVE-2012-5195 (2012-12-18)

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2011-1487 (2011-04-11)

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

NAME

OS2::DLL - access to DLLs with REXX calling convention.

NOTE

When you use this module, the REXX variable pool is not available.

See documentation of OS2::REXX module if you need the variable pool.

SYNOPSIS

use OS2::DLL;
$emx_dll = OS2::DLL->module('emx');
$emx_version = $emx_dll->emx_revision();
$func_emx_version = $emx_dll->wrapper_REXX('#128'); # emx_revision
$emx_version = $func_emx_version->();

DESCRIPTION

"Create a DLL handle"

$dll = OS2::DLL->module( NAME [, WHERE] );

Loads an OS/2 module NAME, looking in directories WHERE (adding the extension .dll), if the DLL is not found there, loads in the usual OS/2 way (via LIBPATH and other settings). Croaks with a verbose report on failure.

The DLL is not unloaded when the return value is destroyed.

Create a DLL handle (looking in some strange locations)

$dll = OS2::DLL->new( NAME [, WHERE] );

Same as module|"Create a DLL handle", but in addition to WHERE, looks in environment paths PERL5REXX, PERLREXX, PATH (provided for backward compatibility).

Loads DLL by name

$dll = load OS2::DLL NAME [, WHERE];

Same as new|"Create a DLL handle (looking in some strange locations)", but returns DLL object reference, or undef on failure (in this case one can get the reason via DynaLoader::dl_error()) (provided for backward compatibility).

Check for functions (optional):

BOOL = $dll->find(NAME [, NAME [, ...]]);

Returns true if all functions are available. As a side effect, creates a REXX wrapper with the specified name in the package constructed by the name of the DLL so that the next call to $dll->NAME() will pick up the cached method.

Create a Perl wrapper (optional):

$func = $dll->wrapper_REXX(NAME);

Returns a reference to a Perl function wrapper for the entry point NAME in the DLL. Similar to the OS/2 API, the NAME may be "#123" - in this case the ordinal is loaded. Croaks with a meaningful error message if NAME does not exists (although the message for the case when the name is an ordinal may be confusing).

Call external function with REXX calling convention:

$ret_string = $dll->function_name(arguments);

Returns the return string if the REXX return code is 0, else undef. Dies with error message if the function is not available. On the first call resolves the name in the DLL and caches the Perl wrapper; future calls go through the wrapper.

Unless used inside REXX environment (see OS2::REXX), the REXX runtime environment (variable pool, queue etc.) is not available to the called function.

Inspecting the module

$module->handle
$module->fullname

Return the (integer) handle and full path name of a loaded DLL.

TODO: the module name (whatever is specified in the LIBRARY statement of .def file when linking) via OS2::Proc.

$module->has_f32($name)

Returns the address of a 32-bit entry point with name $name, or 0 if none found. (Keep in mind that some entry points may be 16-bit, and some may have capitalized names comparing to callable-from-C counterparts.) Name of the form #197 will find entry point with ordinal 197.

libPath_find($name [, $flags])

Looks for the DLL $name on BEGINLIBPATH, LIBPATH, ENDLIBPATH if bits 0x1, 0x2, 0x4 of $flags are set correspondingly. If called with no arguments, looks on all 3 locations. Returns the full name of the found file. DLL is not loaded.

$name has .dll appended unless it already has an extension.

Low-level API

Call a _System linkage function via a pointer

If a function takes up to 20 ULONGs and returns ULONG:

$res = call20( $pointer, $arg0, $arg1, ...);
Same for packed arguments:
$res = call20_p( $pointer, pack 'L20', $arg0, $arg1, ...);
Same for regparm(3) function:
$res = call20_rp3( $pointer, $arg0, $arg1, ...);
Same for packed arguments and regparm(3) function
$res = call20_rp3_p( $pointer, pack 'L20', $arg0, $arg1, ...);
Same for a function which returns non-0 and sets system-error on error
call20_Dos( $msg, $pointer, $arg0, $arg1, ...); # die("$msg: $^E") if error

[Good for Dos* API - and rare Win* calls.]

Same for a function which returns 0 and sets WinLastError() on error
$res = call20_Win( $msg, $pointer, $arg0, $arg1, ...);
# would die("$msg: $^E") if error

[Good for most of Win* API.]

Same for a function which returns 0 and sets WinLastError() on error but 0 is also a valid return
$res = call20_Win_0OK( $msg, $pointer, $arg0, $arg1, ...);
# would die("$msg: $^E") if error

[Good for some of Win* API.]

As previous, but without die()
$res = call20_Win_0OK_survive( $pointer, $arg0, $arg1, ...);
if ($res == 0 and $^E) {	# Do error processing here
}

[Good for some of Win* API.]

ENVIRONMENT

If PERL_REXX_DEBUG is set, emits debugging output. Looks for DLLs in PERL5REXX, PERLREXX, PATH.

AUTHOR

Extracted by Ilya Zakharevich perl-module-OS2-DLL@ilyaz.org from OS2::REXX written by Andreas Kaiser ak@ananke.s.bawue.de.