/ 
perl-5.45.1
⭐ Starred 2013 / installhtml
Security Advisories (1)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

NAME

installhtml - converts a collection of POD pages to HTML format.

SYNOPSIS

installhtml  [--help] [--podpath=<name>:...:<name>] [--podroot=<name>]
     [--htmldir=<name>] [--htmlroot=<name>]  [--norecurse] [--recurse]
     [--splithead=<name>,...,<name>]   [--splititem=<name>,...,<name>]
     [--ignore=<name>,...,<name>]  [--verbose]

DESCRIPTION

installhtml converts a collection of POD pages to a corresponding collection of HTML pages. This is used to convert the pod pages found in the perl distribution. (It is not intended as a general-purpose converter/installer of POD pages in HTML format. See Pod::Html.)

OPTIONS

--help help

Displays the usage.

--podroot POD search path base directory

The base directory to search for all .pod and .pm files to be converted. Default is current directory.

--podpath POD search path

The list of directories to search for .pod and .pm files to be converted. Default is 'podroot/lib'.

--recurse recurse on subdirectories

Whether or not to convert all .pm and .pod files found in subdirectories too. Default is to not recurse.

--htmldir HTML destination directory

The base directory which all HTML files will be written to. This should be a path relative to the filesystem, not the resulting URL.

--htmlroot URL base directory

The base directory which all resulting HTML files will be visible at in a URL. The default is '/'.

--splithead POD files to split on =head directive

Comma-separated list of pod files to split by the =head directive. The .pod suffix is optional. These files should have names specified relative to podroot.

--splititem POD files to split on =item directive

Comma-separated list of all pod files to split by the =item directive. The .pod suffix is optional. installhtml does not do the actual split, rather it invokes splitpod, a separate program in the Perl 5 core distribution, to do the dirty work. As with --splithead, these files should have names specified relative to podroot.

--splitpod Directory containing the splitpod program

The directory containing the splitpod program. The default is 'podroot/pod'.

--ignore files to be ignored

Comma-separated of files that shouldn't be installed, given relative to podroot.

--verbose verbose output

Self-explanatory.

EXAMPLE

The following command-line is an example of the one we use to convert perl documentation:

    ./installhtml --podpath=lib:ext:pod:vms   \
			--podroot=/usr/src/perl     \
			--htmldir=/perl/nmanual     \
			--htmlroot=/perl/nmanual    \
			--splithead=pod/perlipc     \
			--splititem=pod/perlfunc    \
			--recurse \
			--verbose

AUTHOR

Chris Hall <hallc@cs.colorado.edu>