/ 
perl-5.42.2
⭐ Starred 2013 / ptar
Security Advisories (1)
CVE-2026-8376 (2026-05-25)

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

NAME

ptar - a tar-like program written in perl

DESCRIPTION

ptar is a small, tar look-alike program that uses the perl module Archive::Tar to extract, create and list tar archives.

SYNOPSIS

ptar -c [-v] [-z] [-C] [-f ARCHIVE_FILE | -] FILE FILE ...
ptar -c [-v] [-z] [-C] [-T index | -] [-f ARCHIVE_FILE | -]
ptar -x [-v] [-z] [-f ARCHIVE_FILE | -]
ptar -t [-z] [-f ARCHIVE_FILE | -]
ptar -h

OPTIONS

c   Create ARCHIVE_FILE or STDOUT (-) from FILE
x   Extract from ARCHIVE_FILE or STDIN (-)
t   List the contents of ARCHIVE_FILE or STDIN (-)
f   Name of the ARCHIVE_FILE to use. Default is './default.tar'
z   Read/Write zlib compressed ARCHIVE_FILE (not always available)
v   Print filenames as they are added or extracted from ARCHIVE_FILE
h   Prints this help message
C   CPAN mode - drop 022 from permissions
T   get names to create from file

SEE ALSO

tar(1), Archive::Tar.