Security Advisories (26)
CVE-2011-2728 (2012-12-21)

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2013-1667 (2013-03-14)

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

CVE-2010-4777 (2014-02-10)

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

CVE-2010-1158 (2010-04-20)

Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.

CVE-2009-3626 (2009-10-29)

Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.

CVE-2008-1927 (2008-04-24)

Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.

CVE-2005-3962 (2005-12-01)

Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.

CVE-2007-5116 (2007-11-07)

Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.

CVE-2012-5195 (2012-12-18)

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2011-1487 (2011-04-11)

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2024-56406 (2025-04-13)

A heap buffer overflow vulnerability was discovered in Perl. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.    $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

NAME

OptreeCheck - check optrees as rendered by B::Concise

SYNOPSIS

OptreeCheck supports regression testing of perl's parser, optimizer, bytecode generator, via a single function: checkOptree(%args). It invokes B::Concise upon sample code, and checks that it 'agrees' with reference renderings.

 checkOptree (
   name   => "test-name',	# optional, (synth from others)

   # 2 kinds of code-under-test: must provide 1
   code   => sub {my $a},	# coderef, or source (wrapped and evald)
   prog   => 'sort @a',	# run in subprocess, aka -MO=Concise

   bcopts => '-exec',		# $opt or \@opts, passed to BC::compile
   # errs   => '.*',		# match against any emitted errs, -w warnings
   # skip => 1,		# skips test
   # todo => 'excuse',		# anticipated failures
   # fail => 1			# force fail (by redirecting result)
   # debug => 1,		# turns on regex debug for match test !!
   # retry => 1		# retry with debug on test failure

   expect => <<'EOT_EOT', expect_nt => <<'EONT_EONT' );
# 1  <;> nextstate(main 45 optree.t:23) v
# 2  <0> padsv[$a:45,46] M/LVINTRO
# 3  <1> leavesub[1 ref] K/REFC,1
EOT_EOT
# 1  <;> nextstate(main 45 optree.t:23) v
# 2  <0> padsv[$a:45,46] M/LVINTRO
# 3  <1> leavesub[1 ref] K/REFC,1
EONT_EONT

checkOptree(%in) Overview

optreeCheck() calls getRendering(), which runs code or prog through B::Concise, and captures its rendering.

It then calls mkCheckRex() to produce a regex which will match the expected rendering, and fail when it doesn't match.

Finally, it compares the 2; like($rendering,/$regex/,$testname).

checkOptree(%Args) API

Accepts %Args, with following requirements and actions:

Either code or prog must be present. prog is some source code, and is passed through via test.pl:runperl, to B::Concise like this: (bcopts are fixed up for cmdline)

'./perl -w -MO=Concise,$bcopts_massaged -e $src'

code is a subref, or $src, like above. If it's not a subref, it's treated like source-code, is wrapped as a subroutine, and is passed to B::Concise::compile().

$subref = eval "sub{$src}";
B::Concise::compile($subref).

expect and expect_nt are the reference optree renderings. Theyre required, except when the code/prog compilation fails.

I suppose I should also explain these more, but they seem obvious.

# prog   => 'sort @a',	# run in subprocess, aka -MO=Concise
# noanchors => 1,		# no /^$/.  needed for 1-liners like above

# skip => 1,		# skips test
# todo => 'excuse',		# anticipated failures
# fail => 1			# fails (by redirecting result)
# debug => 1,		# turns on regex debug for match test !!
# retry => 1		# retry with debug on test failure

Test Philosophy

2 platforms --> 2 reftexts: You want an accurate test, independent of which platform you're on. So, two refdata properties, 'expect' and 'expect_nt', carry renderings taken from threaded and non-threaded builds. This has several benefits:

1. native reference data allows closer matching by regex.
2. samples can be eyeballed to grok t-nt differences.
3. data can help to validate mkCheckRex() operation.
4. can develop regexes which accomodate t-nt differences.
5. can test with both native and cross+converted regexes.

Cross-testing (expect_nt on threaded, expect on non-threaded) exposes differences in B::Concise output, so mkCheckRex has code to do some cross-test manipulations. This area needs more work.

Test Modes

One consequence of a single-function API is difficulty controlling test-mode. Ive chosen for now to use a package hash, %gOpts, to store test-state. These properties alter checkOptree() function, either short-circuiting to selftest, or running a loop that runs the testcase 2^N times, varying conditions each time. (current N is 2 only).

So Test-mode is controlled with cmdline args, also called options below. Run with 'help' to see the test-state, and how to change it.

selftest

This argument invokes runSelftest(), which tests a regex against the reference renderings that they're made from. Failure of a regex match its 'mold' is a strong indicator that mkCheckRex is buggy.

That said, selftest mode currently runs a cross-test too, they're not completely orthogonal yet. See below.

testmode=cross

Cross-testing is purposely creating a T-NT mismatch, looking at the fallout, and tweaking the regex to deal with it. Thus tests lead to 'provably' complete understanding of the differences.

The tweaking appears contrary to the 2-refs philosophy, but the tweaks will be made in conversion-specific code, which (will) handles T->NT and NT->T separately. The tweaking is incomplete.

A reasonable 1st step is to add tags to indicate when TonNT or NTonT is known to fail. This needs an option to force failure, so the test.pl reporting mechanics show results to aid the user.

testmode=native

This is normal mode. Other valid values are: native, cross, both.

checkOptree Notes

Accepts test code, renders its optree using B::Concise, and matches that rendering against a regex built from one of 2 reference-renderings %in data.

The regex is built by mkCheckRex(\%in), which scrubs %in data to remove match-irrelevancies, such as (args) and [args]. For example, it strips leading '# ', making it easy to cut-paste new tests into your test-file, run it, and cut-paste actual results into place. You then retest and reedit until all 'errors' are gone. (now make sure you haven't 'enshrined' a bug).

name: The test name. May be augmented by a label, which is built from important params, and which helps keep names in sync with whats being tested.'

mkCheckRex

mkCheckRex receives the full testcase object, and constructs a regex. 1st, it selects a reftxt from either the expect or expect_nt items.

Once selected, the reftext is massaged & converted into a Regex that accepts 'good' concise renderings, with appropriate input variations, but is otherwise as strict as possible. For example, it should *not* match when opcode flags change, or when optimizations convert an op to an ex-op.

selection is driven by platform mostly, but also by test-mode, which rather complicates the code. this is worsened by the potential need to make platform specific conversions on the reftext.

match criteria

Opcode arguments (text within braces) are disregarded for matching purposes. This loses some info in 'add[t5]', but greatly simplifys matching 'nextstate(main 22 (eval 10):1)'. Besides, we are testing for regressions, not for complete accuracy.

The regex is anchored by default, but can be suppressed with 'noanchors', allowing 1-liner tests to succeed if opcode is found.

TEST DEVELOPMENT SUPPORT

This optree regression testing framework needs tests in order to find bugs. To that end, OptreeCheck has support for developing new tests, according to the following model:

1. write a set of sample code into a single file, one per
   paragraph.  f_map and f_sort in ext/B/t/ are examples.

2. run OptreeCheck as a program on the file

  ./perl -Ilib ext/B/t/OptreeCheck.pm -w ext/B/t/f_map
  ./perl -Ilib ext/B/t/OptreeCheck.pm -w ext/B/t/f_sort

  gentest reads the sample code, runs each to generate a reference
  rendering, folds this rendering into an optreeCheck() statement,
  and prints it to stdout.

3. run the output file as above, redirect to files, then rerun on
   same build (for sanity check), and on thread-opposite build.  With
   editor in 1 window, and cmd in other, it's fairly easy to cut-paste
   the gots into the expects, easier than running step 2 on both
   builds then trying to sdiff them together.

TODO

There's a considerable amount of cruft in the whole arg-handling setup. I'll replace / strip it before 5.10

Treat %in as a test object, interwork better with Test::*

Refactor mkCheckRex() and selfTest() to isolate the selftest, crosstest, etc selection mechanics.

improve retry, retrydbg, esp. it's control of eval "use re debug". This seems to work part of the time, but isn't stable enough.

CAVEATS

This code is purely for testing core. While checkOptree feels flexible enough to be stable, the whole selftest framework is subject to change w/o notice.