From 60ebf7fcb7bfcef8a8e0cd52e737b082623ff109 Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Sat, 21 Apr 2018 18:00:30 -0700 Subject: perl: Security fix CVE-2017-12883 Affects: Perl < 5.24.3-rc1 and 5.26.x before 5.26.1-RC1 Signed-off-by: Armin Kuster Signed-off-by: Ross Burton --- .../perl/perl/CVE-2017-12883.patch | 44 ++++++++++++++++++++++ meta/recipes-devtools/perl/perl_5.24.1.bb | 1 + 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-devtools/perl/perl/CVE-2017-12883.patch diff --git a/meta/recipes-devtools/perl/perl/CVE-2017-12883.patch b/meta/recipes-devtools/perl/perl/CVE-2017-12883.patch new file mode 100644 index 0000000000..5c1805f9e7 --- /dev/null +++ b/meta/recipes-devtools/perl/perl/CVE-2017-12883.patch @@ -0,0 +1,44 @@ +From 40b3cdad3649334585cee8f4630ec9a025e62be6 Mon Sep 17 00:00:00 2001 +From: Karl Williamson +Date: Fri, 25 Aug 2017 11:33:58 -0600 +Subject: [PATCH] PATCH: [perl #131598] + +The cause of this is that the vFAIL macro uses RExC_parse, and that +variable has just been changed in preparation for code after the vFAIL. +The solution is to not change RExC_parse until after the vFAIL. + +This is a case where the macro hides stuff that can bite you. + +(cherry picked from commit 2be4edede4ae226e2eebd4eff28cedd2041f300f) + +Upstream-Status: Backport +CVE: CVE-2017-12833 +Signed-off-by: Armin Kuster + +--- + regcomp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +Index: perl-5.24.1/regcomp.c +=================================================================== +--- perl-5.24.1.orig/regcomp.c ++++ perl-5.24.1/regcomp.c +@@ -11918,14 +11918,16 @@ S_grok_bslash_N(pTHX_ RExC_state_t *pREx + } + sv_catpv(substitute_parse, ")"); + +- RExC_parse = RExC_start = RExC_adjusted_start = SvPV(substitute_parse, +- len); ++ len = SvCUR(substitute_parse); + + /* Don't allow empty number */ + if (len < (STRLEN) 8) { + RExC_parse = endbrace; + vFAIL("Invalid hexadecimal number in \\N{U+...}"); + } ++ ++ RExC_parse = RExC_start = RExC_adjusted_start ++ = SvPV_nolen(substitute_parse); + RExC_end = RExC_parse + len; + + /* The values are Unicode, and therefore not subject to recoding, but diff --git a/meta/recipes-devtools/perl/perl_5.24.1.bb b/meta/recipes-devtools/perl/perl_5.24.1.bb index 222dd88675..53a426289a 100644 --- a/meta/recipes-devtools/perl/perl_5.24.1.bb +++ b/meta/recipes-devtools/perl/perl_5.24.1.bb @@ -64,6 +64,7 @@ SRC_URI += " \ file://perl-fix-conflict-between-skip_all-and-END.patch \ file://perl-test-customized.patch \ file://perl-5.26.1-guard_old_libcrypt_fix.patch \ + file://CVE-2017-12883.patch \ " # Fix test case issues -- cgit 1.2.3-korg