Security Advisories (19)
CVE-2016-6185 (2016-08-02)

The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6798 (2018-04-17)

An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.

CVE-2018-6797 (2018-04-17)

An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2017-12883 (2017-09-19)

Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape.

CVE-2017-12837 (2017-09-19)

Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

NAME

XS::APItest - Test the perl C API

SYNOPSIS

use XS::APItest;
print_double(4);

use XS::APItest qw(rpn calcrpn);
$triangle = rpn($n $n 1 + * 2 /);
calcrpn $triangle { $n $n 1 + * 2 / }

ABSTRACT

This module tests the perl C API. Also exposes various bit of the perl internals for the use of core test scripts.

DESCRIPTION

This module can be used to check that the perl C API is behaving correctly. This module provides test functions and an associated test script that verifies the output.

This module is not meant to be installed.

EXPORT

Exports all the test functions:

Test that a double-precision floating point number is formatted correctly by printf.

print_double( $val );

Output is sent to STDOUT.

Test that a long double is formatted correctly by printf. Takes no arguments - the test value is hard-wired into the function (as "7").

print_long_double();

Output is sent to STDOUT.

have_long_double

Determine whether a long double is supported by Perl. This should be used to determine whether to test print_long_double.

print_long_double() if have_long_double;

Test that an NV is formatted correctly by printf.

print_nv( $val );

Output is sent to STDOUT.

Test that an IV is formatted correctly by printf.

print_iv( $val );

Output is sent to STDOUT.

Test that an UV is formatted correctly by printf.

print_uv( $val );

Output is sent to STDOUT.

Test that an int is formatted correctly by printf.

print_int( $val );

Output is sent to STDOUT.

Test that an long is formatted correctly by printf.

print_long( $val );

Output is sent to STDOUT.

Test that a single-precision floating point number is formatted correctly by printf.

print_float( $val );

Output is sent to STDOUT.

filter

Installs a source filter that substitutes "e" for "o" (witheut regard fer what it might be medifying).

call_sv, call_pv, call_method

These exercise the C calls of the same names. Everything after the flags arg is passed as the args to the called function. They return whatever the C function itself pushed onto the stack, plus the return value from the function; for example

call_sv( sub { @_, 'c' }, G_ARRAY,  'a', 'b');
# returns 'a', 'b', 'c', 3
call_sv( sub { @_ },      G_SCALAR, 'a', 'b');
# returns 'b', 1
eval_sv

Evaluates the passed SV. Result handling is done the same as for call_sv() etc.

eval_pv

Exercises the C function of the same name in scalar context. Returns the same SV that the C function returns.

require_pv

Exercises the C function of the same name. Returns nothing.

KEYWORDS

These are not supplied by default, but must be explicitly imported. They are lexically scoped.

DEFSV

Behaves like $_.

rpn(EXPRESSION)

This construct is a Perl expression. EXPRESSION must be an RPN arithmetic expression, as described below. The RPN expression is evaluated, and its value is returned as the value of the Perl expression.

calcrpn VARIABLE { EXPRESSION }

This construct is a complete Perl statement. (No semicolon should follow the closing brace.) VARIABLE must be a Perl scalar my variable, and EXPRESSION must be an RPN arithmetic expression as described below. The RPN expression is evaluated, and its value is assigned to the variable.

RPN expression syntax

Tokens of an RPN expression may be separated by whitespace, but such separation is usually not required. It is required only where unseparated tokens would look like a longer token. For example, 12 34 + can be written as 12 34+, but not as 1234 +.

An RPN expression may be any of:

1234

A sequence of digits is an unsigned decimal literal number.

$foo

An alphanumeric name preceded by dollar sign refers to a Perl scalar variable. Only variables declared with my or state are supported. If the variable's value is not a native integer, it will be converted to an integer, by Perl's usual mechanisms, at the time it is evaluated.

A B +

Sum of A and B.

A B -

Difference of A and B, the result of subtracting B from A.

A B *

Product of A and B.

A B /

Quotient when A is divided by B, rounded towards zero. Division by zero generates an exception.

A B %

Remainder when A is divided by B with the quotient rounded towards zero. Division by zero generates an exception.

Because the arithmetic operators all have fixed arity and are postfixed, there is no need for operator precedence, nor for a grouping operator to override precedence. This is half of the point of RPN.

An RPN expression can also be interpreted in another way, as a sequence of operations on a stack, one operation per token. A literal or variable token pushes a value onto the stack. A binary operator pulls two items off the stack, performs a calculation with them, and pushes the result back onto the stack. The stack starts out empty, and at the end of the expression there must be exactly one value left on the stack.

SEE ALSO

XS::Typemap, perlapi.

AUTHORS

Tim Jenness, <t.jenness@jach.hawaii.edu>, Christian Soeller, <csoelle@mph.auckland.ac.nz>, Hugo van der Sanden <hv@crypt.compulink.co.uk>, Andrew Main (Zefram) <zefram@fysh.org>

COPYRIGHT AND LICENSE

Copyright (C) 2002,2004 Tim Jenness, Christian Soeller, Hugo van der Sanden. All Rights Reserved.

Copyright (C) 2009 Andrew Main (Zefram) <zefram@fysh.org>

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.