Brad Bishop | 316dfdd | 2018-06-25 12:45:53 -0400 | [diff] [blame] | 1 | From 40b3cdad3649334585cee8f4630ec9a025e62be6 Mon Sep 17 00:00:00 2001 |
| 2 | From: Karl Williamson <khw@cpan.org> |
| 3 | Date: Fri, 25 Aug 2017 11:33:58 -0600 |
| 4 | Subject: [PATCH] PATCH: [perl #131598] |
| 5 | |
| 6 | The cause of this is that the vFAIL macro uses RExC_parse, and that |
| 7 | variable has just been changed in preparation for code after the vFAIL. |
| 8 | The solution is to not change RExC_parse until after the vFAIL. |
| 9 | |
| 10 | This is a case where the macro hides stuff that can bite you. |
| 11 | |
| 12 | (cherry picked from commit 2be4edede4ae226e2eebd4eff28cedd2041f300f) |
| 13 | |
| 14 | Upstream-Status: Backport |
| 15 | CVE: CVE-2017-12833 |
| 16 | Signed-off-by: Armin Kuster <akuster@mvista.com> |
| 17 | |
| 18 | --- |
| 19 | regcomp.c | 6 ++++-- |
| 20 | 1 file changed, 4 insertions(+), 2 deletions(-) |
| 21 | |
| 22 | Index: perl-5.24.1/regcomp.c |
| 23 | =================================================================== |
| 24 | --- perl-5.24.1.orig/regcomp.c |
| 25 | +++ perl-5.24.1/regcomp.c |
| 26 | @@ -11918,14 +11918,16 @@ S_grok_bslash_N(pTHX_ RExC_state_t *pREx |
| 27 | } |
| 28 | sv_catpv(substitute_parse, ")"); |
| 29 | |
| 30 | - RExC_parse = RExC_start = RExC_adjusted_start = SvPV(substitute_parse, |
| 31 | - len); |
| 32 | + len = SvCUR(substitute_parse); |
| 33 | |
| 34 | /* Don't allow empty number */ |
| 35 | if (len < (STRLEN) 8) { |
| 36 | RExC_parse = endbrace; |
| 37 | vFAIL("Invalid hexadecimal number in \\N{U+...}"); |
| 38 | } |
| 39 | + |
| 40 | + RExC_parse = RExC_start = RExC_adjusted_start |
| 41 | + = SvPV_nolen(substitute_parse); |
| 42 | RExC_end = RExC_parse + len; |
| 43 | |
| 44 | /* The values are Unicode, and therefore not subject to recoding, but |