/ 
perl-5.45.1
⭐ Starred 2013 / Porting/sync-with-cpan
Security Advisories (1)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

NAME

Porting/sync-with-cpan - Synchronize with CPAN distributions

SYNOPSIS

sh ./Configure
perl Porting/sync-with-cpan <module>

where module is the name it appears in the %Modules hash of Porting/Maintainers.pl

DESCRIPTION

Script to help out with syncing cpan distros.

Does the following:

  • Fetches the package list from CPAN. Finds the current version of the given package. [1]

  • Downloads the relevant tarball; unpacks the tarball. [1]

  • Clean out the old directory (git clean -dfx)

  • Moves the old directory out of the way, moves the new directory in place.

  • Restores any .gitignore file.

  • Removes files from @IGNORE and EXCLUDED

  • git add any new files.

  • git rm any files that are gone.

  • Remove the +x bit on files in t/

  • Remove the +x bit on files that don't have it enabled in the current dir

  • Restore files mentioned in CUSTOMIZED

  • Updates the contents of MANIFEST

  • Runs a make (assumes a configure has been run)

  • Cleans up

  • Runs tests for the package

  • Runs the porting tests

[1] If the --tarball option is given, then CPAN is not consulted. --tarball should be the path to the tarball; the version is extracted from the filename -- but can be overwritten by the --version option.

OPTIONS

--jobs N

When running make, pass a -jN option to it to enable parallel building.

Note that you can also set TEST_JOBS=N in the environment to enable parallel *testing* on top of parallel *building*.

--yes

Just continue at all places where we would normally ask for the user to hit enter or hit CTL-C, with the exception of cases related to CUSTOMIZED distributions, where this option will cause the update to exit immediately unless the --force option has also been used.

--force

Do things we normally would refuse to do.

--tarball

Use a predownloaded tarball and not one from CPAN. Example:

perl Porting/sync-with-cpan Text-Tabs+Wrap \
    --tarball /tmp/Text-Tabs+Wrap-2024.001.tar.gz \
    --yes
--version

Sync with a specific version, not the latest on CPAN.

--no-test
--nt

Do not run tests. This is helpful for bulk updates.

--help

Show help.

TODO

  • Optional, run a full test suite

  • Handle complicated FILES

This is an initial version; no attempt has been made yet to make this portable. It shells out instead of trying to find a Perl solution. In particular, it assumes git, perl, and make to be available.