/ 
perl-5.27.11
⭐ Starred 2013 / Math::BigInt::Calc
Security Advisories (13)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

CVE-2026-19487 (2026-08-13)

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: "ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.

CVE-2026-57432 (2026-07-13)

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

CVE-2026-8376 (2026-05-25)

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

CVE-2026-13221 (2026-07-13)

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

CVE-2026-4176 (2026-03-29)

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-6798 (2018-04-17)

An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

NAME

Math::BigInt::Calc - Pure Perl module to support Math::BigInt

SYNOPSIS

This library provides support for big integer calculations. It is not intended to be used by other modules. Other modules which support the same API (see below) can also be used to support Math::BigInt, like Math::BigInt::GMP and Math::BigInt::Pari.

DESCRIPTION

In this library, the numbers are represented in base B = 10**N, where N is the largest possible value that does not cause overflow in the intermediate computations. The base B elements are stored in an array, with the least significant element stored in array element zero. There are no leading zero elements, except a single zero element when the number is zero.

For instance, if B = 10000, the number 1234567890 is represented internally as [3456, 7890, 12].

THE Math::BigInt API

In order to allow for multiple big integer libraries, Math::BigInt was rewritten to use a plug-in library for core math routines. Any module which conforms to the API can be used by Math::BigInt by using this in your program:

use Math::BigInt lib => 'libname';

'libname' is either the long name, like 'Math::BigInt::Pari', or only the short version, like 'Pari'.

General Notes

A library only needs to deal with unsigned big integers. Testing of input parameter validity is done by the caller, so there is no need to worry about underflow (e.g., in _sub() and _dec()) nor about division by zero (e.g., in _div()) or similar cases.

For some methods, the first parameter can be modified. That includes the possibility that you return a reference to a completely different object instead. Although keeping the reference and just changing its contents is preferred over creating and returning a different reference.

Return values are always objects, strings, Perl scalars, or true/false for comparison routines.

API version 1

The following methods must be defined in order to support the use by Math::BigInt v1.70 or later.

API version

api_version()

Return API version as a Perl scalar, 1 for Math::BigInt v1.70, 2 for Math::BigInt v1.83.

Constructors

_new(STR)

Convert a string representing an unsigned decimal number to an object representing the same number. The input is normalize, i.e., it matches ^(0|[1-9]\d*)$.

_zero()

Return an object representing the number zero.

_one()

Return an object representing the number one.

_two()

Return an object representing the number two.

_ten()

Return an object representing the number ten.

_from_bin(STR)

Return an object given a string representing a binary number. The input has a '0b' prefix and matches the regular expression ^0[bB](0|1[01]*)$.

_from_oct(STR)

Return an object given a string representing an octal number. The input has a '0' prefix and matches the regular expression ^0[1-7]*$.

_from_hex(STR)

Return an object given a string representing a hexadecimal number. The input has a '0x' prefix and matches the regular expression ^0x(0|[1-9a-fA-F][\da-fA-F]*)$.

Mathematical functions

Each of these methods may modify the first input argument, except _bgcd(), which shall not modify any input argument, and _sub() which may modify the second input argument.

_add(OBJ1, OBJ2)

Returns the result of adding OBJ2 to OBJ1.

_mul(OBJ1, OBJ2)

Returns the result of multiplying OBJ2 and OBJ1.

_div(OBJ1, OBJ2)

Returns the result of dividing OBJ1 by OBJ2 and truncating the result to an integer.

_sub(OBJ1, OBJ2, FLAG)
_sub(OBJ1, OBJ2)

Returns the result of subtracting OBJ2 by OBJ1. If flag is false or omitted, OBJ1 might be modified. If flag is true, OBJ2 might be modified.

_dec(OBJ)

Decrement OBJ by one.

_inc(OBJ)

Increment OBJ by one.

_mod(OBJ1, OBJ2)

Return OBJ1 modulo OBJ2, i.e., the remainder after dividing OBJ1 by OBJ2.

_sqrt(OBJ)

Return the square root of the object, truncated to integer.

_root(OBJ, N)

Return Nth root of the object, truncated to int. N is >= 3.

_fac(OBJ)

Return factorial of object (1*2*3*4*...).

_pow(OBJ1, OBJ2)

Return OBJ1 to the power of OBJ2. By convention, 0**0 = 1.

_modinv(OBJ1, OBJ2)

Return modular multiplicative inverse, i.e., return OBJ3 so that

(OBJ3 * OBJ1) % OBJ2 = 1 % OBJ2

The result is returned as two arguments. If the modular multiplicative inverse does not exist, both arguments are undefined. Otherwise, the arguments are a number (object) and its sign ("+" or "-").

The output value, with its sign, must either be a positive value in the range 1,2,...,OBJ2-1 or the same value subtracted OBJ2. For instance, if the input arguments are objects representing the numbers 7 and 5, the method must either return an object representing the number 3 and a "+" sign, since (3*7) % 5 = 1 % 5, or an object representing the number 2 and "-" sign, since (-2*7) % 5 = 1 % 5.

_modpow(OBJ1, OBJ2, OBJ3)

Return modular exponentiation, (OBJ1 ** OBJ2) % OBJ3.

_rsft(OBJ, N, B)

Shift object N digits right in base B and return the resulting object. This is equivalent to performing integer division by B**N and discarding the remainder, except that it might be much faster, depending on how the number is represented internally.

For instance, if the object $obj represents the hexadecimal number 0xabcde, then $obj-_rsft(2, 16)> returns an object representing the number 0xabc. The "remainer", 0xde, is discarded and not returned.

_lsft(OBJ, N, B)

Shift the object N digits left in base B. This is equivalent to multiplying by B**N, except that it might be much faster, depending on how the number is represented internally.

_log_int(OBJ, B)

Return integer log of OBJ to base BASE. This method has two output arguments, the OBJECT and a STATUS. The STATUS is Perl scalar; it is 1 if OBJ is the exact result, 0 if the result was truncted to give OBJ, and undef if it is unknown whether OBJ is the exact result.

_gcd(OBJ1, OBJ2)

Return the greatest common divisor of OBJ1 and OBJ2.

Bitwise operators

Each of these methods may modify the first input argument.

_and(OBJ1, OBJ2)

Return bitwise and. If necessary, the smallest number is padded with leading zeros.

_or(OBJ1, OBJ2)

Return bitwise or. If necessary, the smallest number is padded with leading zeros.

_xor(OBJ1, OBJ2)

Return bitwise exclusive or. If necessary, the smallest number is padded with leading zeros.

Boolean operators

_is_zero(OBJ)

Returns a true value if OBJ is zero, and false value otherwise.

_is_one(OBJ)

Returns a true value if OBJ is one, and false value otherwise.

_is_two(OBJ)

Returns a true value if OBJ is two, and false value otherwise.

_is_ten(OBJ)

Returns a true value if OBJ is ten, and false value otherwise.

_is_even(OBJ)

Return a true value if OBJ is an even integer, and a false value otherwise.

_is_odd(OBJ)

Return a true value if OBJ is an even integer, and a false value otherwise.

_acmp(OBJ1, OBJ2)

Compare OBJ1 and OBJ2 and return -1, 0, or 1, if OBJ1 is less than, equal to, or larger than OBJ2, respectively.

String conversion

_str(OBJ)

Return a string representing the object. The returned string should have no leading zeros, i.e., it should match ^(0|[1-9]\d*)$.

_as_bin(OBJ)

Return the binary string representation of the number. The string must have a '0b' prefix.

_as_oct(OBJ)

Return the octal string representation of the number. The string must have a '0x' prefix.

Note: This method was required from Math::BigInt version 1.78, but the required API version number was not incremented, so there are older libraries that support API version 1, but do not support _as_oct().

_as_hex(OBJ)

Return the hexadecimal string representation of the number. The string must have a '0x' prefix.

Numeric conversion

_num(OBJ)

Given an object, return a Perl scalar number (int/float) representing this number.

Miscellaneous

_copy(OBJ)

Return a true copy of the object.

_len(OBJ)

Returns the number of the decimal digits in the number. The output is a Perl scalar.

_zeros(OBJ)

Return the number of trailing decimal zeros. The output is a Perl scalar.

_digit(OBJ, N)

Return the Nth digit as a Perl scalar. N is a Perl scalar, where zero refers to the rightmost (least significant) digit, and negative values count from the left (most significant digit). If $obj represents the number 123, then $obj-_digit(0)> is 3 and _digit(123, -1) is 1.

_check(OBJ)

Return a true value if the object is OK, and a false value otherwise. This is a check routine to test the internal state of the object for corruption.

API version 2

The following methods are required for an API version of 2 or greater.

Constructors

_1ex(N)

Return an object representing the number 10**N where N >= 0 is a Perl scalar.

Mathematical functions

_nok(OBJ1, OBJ2)

Return the binomial coefficient OBJ1 over OBJ1.

Miscellaneous

_alen(OBJ)

Return the approximate number of decimal digits of the object. The output is one Perl scalar.

API optional methods

The following methods are optional, and can be defined if the underlying lib has a fast way to do them. If undefined, Math::BigInt will use pure Perl (hence slow) fallback routines to emulate these:

Signed bitwise operators.

Each of these methods may modify the first input argument.

_signed_or(OBJ1, OBJ2, SIGN1, SIGN2)

Return the signed bitwise or.

_signed_and(OBJ1, OBJ2, SIGN1, SIGN2)

Return the signed bitwise and.

_signed_xor(OBJ1, OBJ2, SIGN1, SIGN2)

Return the signed bitwise exclusive or.

WRAP YOUR OWN

If you want to port your own favourite c-lib for big numbers to the Math::BigInt interface, you can take any of the already existing modules as a rough guideline. You should really wrap up the latest Math::BigInt and Math::BigFloat testsuites with your module, and replace in them any of the following:

use Math::BigInt;

by this:

use Math::BigInt lib => 'yourlib';

This way you ensure that your library really works 100% within Math::BigInt.

BUGS

Please report any bugs or feature requests to bug-math-bigint at rt.cpan.org, or through the web interface at https://rt.cpan.org/Ticket/Create.html?Queue=Math-BigInt (requires login). We will be notified, and then you'll automatically be notified of progress on your bug as I make changes.

SUPPORT

You can find documentation for this module with the perldoc command.

perldoc Math::BigInt::Calc

You can also look for information at:

LICENSE

This program is free software; you may redistribute it and/or modify it under the same terms as Perl itself.

AUTHORS

  • Original math code by Mark Biggar, rewritten by Tels http://bloodgate.com/ in late 2000.

  • Separated from BigInt and shaped API with the help of John Peacock.

  • Fixed, speed-up, streamlined and enhanced by Tels 2001 - 2007.

  • API documentation corrected and extended by Peter John Acklam, <pjacklam@online.no>

SEE ALSO

Math::BigInt, Math::BigFloat, Math::BigInt::GMP, Math::BigInt::FastCalc and Math::BigInt::Pari.