Security Advisories (26)
CVE-2011-2728 (2012-12-21)

The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2013-1667 (2013-03-14)

The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.

CVE-2010-4777 (2014-02-10)

The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.

CVE-2010-1158 (2010-04-20)

Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.

CVE-2009-3626 (2009-10-29)

Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.

CVE-2008-1927 (2008-04-24)

Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing UTF8 characters. NOTE: this issue might only be present on certain operating systems.

CVE-2005-3962 (2005-12-01)

Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary code via format string specifiers with large values, which causes an integer wrap and leads to a buffer overflow, as demonstrated using format string vulnerabilities in Perl applications.

CVE-2007-5116 (2007-11-07)

Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.

CVE-2012-5195 (2012-12-18)

Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.

CVE-2016-2381 (2016-04-08)

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

CVE-2013-7422 (2015-08-16)

Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.

CVE-2011-1487 (2011-04-11)

The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2024-56406 (2025-04-13)

A heap buffer overflow vulnerability was discovered in Perl. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.    $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

NAME

Test::Harness - Run Perl standard test scripts with statistics

VERSION

Version 2.48

SYNOPSIS

use Test::Harness;

runtests(@test_files);

DESCRIPTION

STOP! If all you want to do is write a test script, consider using Test::Simple. Test::Harness is the module that reads the output from Test::Simple, Test::More and other modules based on Test::Builder. You don't need to know about Test::Harness to use those modules.

Test::Harness runs tests and expects output from the test in a certain format. That format is called TAP, the Test Anything Protocol. It is defined in Test::Harness::TAP.

Test::Harness::runtests(@tests) runs all the testscripts named as arguments and checks standard output for the expected strings in TAP format.

The prove utility is a thin wrapper around Test::Harness.

Taint mode

Test::Harness will honor the -T or -t in the #! line on your test files. So if you begin a test with:

#!perl -T

the test will be run with taint mode on.

Configuration variables.

These variables can be used to configure the behavior of Test::Harness. They are exported on request.

$Test::Harness::Verbose

The package variable $Test::Harness::Verbose is exportable and can be used to let runtests() display the standard output of the script without altering the behavior otherwise. The prove utility's -v flag will set this.

$Test::Harness::switches

The package variable $Test::Harness::switches is exportable and can be used to set perl command line options used for running the test script(s). The default value is -w. It overrides HARNESS_SWITCHES.

Failure

When tests fail, analyze the summary report:

t/base..............ok
t/nonumbers.........ok
t/ok................ok
t/test-harness......ok
t/waterloo..........dubious
        Test returned status 3 (wstat 768, 0x300)
DIED. FAILED tests 1, 3, 5, 7, 9, 11, 13, 15, 17, 19
        Failed 10/20 tests, 50.00% okay
Failed Test  Stat Wstat Total Fail  Failed  List of Failed
-----------------------------------------------------------------------
t/waterloo.t    3   768    20   10  50.00%  1 3 5 7 9 11 13 15 17 19
Failed 1/5 test scripts, 80.00% okay. 10/44 subtests failed, 77.27% okay.

Everything passed but t/waterloo.t. It failed 10 of 20 tests and exited with non-zero status indicating something dubious happened.

The columns in the summary report mean:

Failed Test

The test file which failed.

Stat

If the test exited with non-zero, this is its exit status.

Wstat

The wait status of the test.

Total

Total number of tests expected to run.

Fail

Number which failed, either from "not ok" or because they never ran.

Failed

Percentage of the total tests which failed.

List of Failed

A list of the tests which failed. Successive failures may be abbreviated (ie. 15-20 to indicate that tests 15, 16, 17, 18, 19 and 20 failed).

Functions

Test::Harness currently only has one function, here it is.

runtests
my $allok = runtests(@test_files);

This runs all the given @test_files and divines whether they passed or failed based on their output to STDOUT (details above). It prints out each individual test which failed along with a summary report and a how long it all took.

It returns true if everything was ok. Otherwise it will die() with one of the messages in the DIAGNOSTICS section.

EXPORT

&runtests is exported by Test::Harness by default.

$verbose, $switches and $debug are exported upon request.

DIAGNOSTICS

All tests successful.\nFiles=%d, Tests=%d, %s

If all tests are successful some statistics about the performance are printed.

FAILED tests %s\n\tFailed %d/%d tests, %.2f%% okay.

For any single script that has failing subtests statistics like the above are printed.

Test returned status %d (wstat %d)

Scripts that return a non-zero exit status, both $? >> 8 and $? are printed in a message similar to the above.

Failed 1 test, %.2f%% okay. %s
Failed %d/%d tests, %.2f%% okay. %s

If not all tests were successful, the script dies with one of the above messages.

FAILED--Further testing stopped: %s

If a single subtest decides that further testing will not make sense, the script dies with this message.

ENVIRONMENT VARIABLES THAT TEST::HARNESS SETS

Test::Harness sets these before executing the individual tests.

HARNESS_ACTIVE

This is set to a true value. It allows the tests to determine if they are being executed through the harness or by any other means.

HARNESS_VERSION

This is the version of Test::Harness.

ENVIRONMENT VARIABLES THAT AFFECT TEST::HARNESS

HARNESS_COLUMNS

This value will be used for the width of the terminal. If it is not set then it will default to COLUMNS. If this is not set, it will default to 80. Note that users of Bourne-sh based shells will need to export COLUMNS for this module to use that variable.

HARNESS_COMPILE_TEST

When true it will make harness attempt to compile the test using perlcc before running it.

NOTE This currently only works when sitting in the perl source directory!

HARNESS_DEBUG

If true, Test::Harness will print debugging information about itself as it runs the tests. This is different from HARNESS_VERBOSE, which prints the output from the test being run. Setting $Test::Harness::Debug will override this, or you can use the -d switch in the prove utility.

HARNESS_FILELEAK_IN_DIR

When set to the name of a directory, harness will check after each test whether new files appeared in that directory, and report them as

LEAKED FILES: scr.tmp 0 my.db

If relative, directory name is with respect to the current directory at the moment runtests() was called. Putting absolute path into HARNESS_FILELEAK_IN_DIR may give more predictable results.

HARNESS_IGNORE_EXITCODE

Makes harness ignore the exit status of child processes when defined.

HARNESS_NOTTY

When set to a true value, forces it to behave as though STDOUT were not a console. You may need to set this if you don't want harness to output more frequent progress messages using carriage returns. Some consoles may not handle carriage returns properly (which results in a somewhat messy output).

HARNESS_PERL

Usually your tests will be run by $^X, the currently-executing Perl. However, you may want to have it run by a different executable, such as a threading perl, or a different version.

If you're using the prove utility, you can use the --perl switch.

HARNESS_PERL_SWITCHES

Its value will be prepended to the switches used to invoke perl on each test. For example, setting HARNESS_PERL_SWITCHES to -W will run all tests with all warnings enabled.

HARNESS_VERBOSE

If true, Test::Harness will output the verbose results of running its tests. Setting $Test::Harness::verbose will override this, or you can use the -v switch in the prove utility.

EXAMPLE

Here's how Test::Harness tests itself

$ cd ~/src/devel/Test-Harness
$ perl -Mblib -e 'use Test::Harness qw(&runtests $verbose);
  $verbose=0; runtests @ARGV;' t/*.t
Using /home/schwern/src/devel/Test-Harness/blib
t/base..............ok
t/nonumbers.........ok
t/ok................ok
t/test-harness......ok
All tests successful.
Files=4, Tests=24, 2 wallclock secs ( 0.61 cusr + 0.41 csys = 1.02 CPU)

SEE ALSO

The included prove utility for running test scripts from the command line, Test and Test::Simple for writing test scripts, Benchmark for the underlying timing routines, and Devel::Cover for test coverage analysis.

TODO

Provide a way of running tests quietly (ie. no printing) for automated validation of tests. This will probably take the form of a version of runtests() which rather than printing its output returns raw data on the state of the tests. (Partially done in Test::Harness::Straps)

Document the format.

Fix HARNESS_COMPILE_TEST without breaking its core usage.

Figure a way to report test names in the failure summary.

Rework the test summary so long test names are not truncated as badly. (Partially done with new skip test styles)

Add option for coverage analysis.

Trap STDERR.

Implement Straps total_results()

Remember exit code

Completely redo the print summary code.

Implement Straps callbacks. (experimentally implemented)

Straps->analyze_file() not taint clean, don't know if it can be

Fix that damned VMS nit.

HARNESS_TODOFAIL to display TODO failures

Add a test for verbose.

Change internal list of test results to a hash.

Fix stats display when there's an overrun.

Fix so perls with spaces in the filename work.

Keeping whittling away at _run_all_tests()

Clean up how the summary is printed. Get rid of those damned formats.

BUGS

HARNESS_COMPILE_TEST currently assumes it's run from the Perl source directory.

Please use the CPAN bug ticketing system at http://rt.cpan.org/. You can also mail bugs, fixes and enhancements to <bug-test-harness at rt.cpan.org>.

AUTHORS

Either Tim Bunce or Andreas Koenig, we don't know. What we know for sure is, that it was inspired by Larry Wall's TEST script that came with perl distributions for ages. Numerous anonymous contributors exist. Andreas Koenig held the torch for many years, and then Michael G Schwern.

Current maintainer is Andy Lester <andy at petdance.com>.

COPYRIGHT

Copyright 2002-2005 by Michael G Schwern <schwern at pobox.com>, Andy Lester <andy at petdance.com>.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

See http://www.perl.com/perl/misc/Artistic.html.