/ 
ExtUtils-Typemaps-Default-1.06
Security Advisories (1)
CVE-2026-107794 (2026-10-10)

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.

Changes for version 1.06

  • Address CVE-2026-107373: Using "std::string( SvPV_nolen( $arg ), SvCUR( $arg ) );" adds a potential security issue since in C++ the evaluation of argument order depends on the compiler. If the SV is not stringified (for example, if it's an IV, NV or a reference) then this can abort or segfault. The fix applied is to split into multiple statements: STRLEN len; const char *pv = SvPV($arg, len); $var = std::string(pv, len);
    • If you depend on this module, please update your minimum version requirement to 1.06.
  • Do not depend on dev release version of ExtUtils::Typemaps anymore.
  • Updated author contact info.

Modules

ExtUtils::Typemap::Basic
A set of typemaps for simple types
ExtUtils::Typemap::Default
A set of useful typemaps
ExtUtils::Typemap::ObjectMap
A set of typemaps for opaque C/C++ objects
ExtUtils::Typemap::STL
A set of useful typemaps for STL
ExtUtils::Typemap::STL::String
A set of typemaps for STL std::strings
ExtUtils::Typemap::STL::Vector
A set of typemaps for STL std::vectors
ExtUtils::Typemaps::Basic
A set of typemaps for simple types
ExtUtils::Typemaps::Default
A set of useful typemaps
ExtUtils::Typemaps::ObjectMap
A set of typemaps for opaque C/C++ objects
ExtUtils::Typemaps::STL
A set of useful typemaps for STL
ExtUtils::Typemaps::STL::List
A set of typemaps for STL std::lists
ExtUtils::Typemaps::STL::String
A set of typemaps for STL std::strings
ExtUtils::Typemaps::STL::Vector
A set of typemaps for STL std::vectors

Other files