head 1.3; access; symbols pkgsrc-2026Q2:1.1.0.4 pkgsrc-2026Q2-base:1.1 pkgsrc-2026Q1:1.1.0.2; locks; strict; comment @ * @; 1.3 date 2026.07.16.18.57.37; author wiz; state dead; branches; next 1.2; commitid cnixJgiQyaTQwUNG; 1.2 date 2026.07.13.18.44.25; author wiz; state Exp; branches; next 1.1; commitid SD9vpQgMTdG6ywNG; 1.1 date 2026.05.27.22.28.20; author wiz; state Exp; branches 1.1.2.1 1.1.4.1; next ; commitid JYUFKGwor6sIivHG; 1.1.2.1 date 2026.05.27.22.28.20; author maya; state dead; branches; next 1.1.2.2; commitid 7Lex1JUIlSbPTaJG; 1.1.2.2 date 2026.06.09.22.30.58; author maya; state Exp; branches; next ; commitid 7Lex1JUIlSbPTaJG; 1.1.4.1 date 2026.07.16.21.08.19; author maya; state Exp; branches; next ; commitid ypKysGhYF2bJfVNG; desc @@ 1.3 log @perl: update to 5.44.0. Core Enhancements Named Parameters in Signatures Multi-variable foreach can now use aliased references Enhanced operation of regular expression patterns under /xx Unicode 17.0 is supported New source of entropy for PRNG seeding Security CVE-2026-8376 - Buffer overflow in Perl_study_chunk CVE-2026-57432 - Buffer overflow in S_measure_struct CVE-2026-13221 - Regex trie 16-bit field overflow Incompatible Changes Unicode rules are now fully enforced on identifier and regular expression group names. More details at https://metacpan.org/dist/perl/changes @ text @$NetBSD: patch-regcomp__study.c,v 1.2 2026/07/13 18:44:25 wiz Exp $ Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch Perl/perl-security#147: test against the actual character lengths https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c --- regcomp_study.c.orig 2026-01-18 17:50:04.000000000 +0000 +++ regcomp_study.c @@@@ -1841,6 +1841,16 @@@@ Perl_study_chunk(pTHX_ tail = regnext( tail ); } + /* The code below currently saves the difference from + * start to finish in a 16-bit field, causing + * GH #23388. This defeats the design of batching + * tries into chunks that each fit. khw thinks it is + * too late in the 5.44 cycle to relook at the design, + * so for now anyway, don't make a trie that would + * overflow */ + if (tail - startbranch >= U16_MAX) { + continue; + } DEBUG_TRIE_COMPILE_r({ regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state); @@@@ -2770,6 +2780,13 @@@@ Perl_study_chunk(pTHX_ (U8 *) SvEND(data->last_found)) - (U8*)s; l -= old; + + if (l > 0 && + (mincount >= SSize_t_MAX / (SSize_t)l + || old > SSize_t_MAX - mincount * (SSize_t)l)) { + FAIL("Regexp out of space"); + } + /* Get the added string: */ last_str = newSVpvn_utf8(s + old, l, UTF); last_chrs = UTF ? utf8_length((U8*)(s + old), @ 1.2 log @perl: fix CVE-2026-13221, CVE-2026-57432, CVE-2026-57433. Bump PKGREVISION. @ text @d1 1 a1 1 $NetBSD: patch-regcomp__study.c,v 1.1 2026/05/27 22:28:20 wiz Exp $ @ 1.1 log @perl: apply upstream security fix for regex on 32-bit systems. Bump PKGREVISION. @ text @d1 6 a6 1 $NetBSD$ d13 18 a30 1 @@@@ -2770,6 +2770,13 @@@@ Perl_study_chunk(pTHX_ @ 1.1.4.1 log @Pullup ticket #7182 - requested by taca lang/perl5: Security fix Revisions pulled up: - lang/perl5/Makefile 1.295 - lang/perl5/distinfo 1.200 - lang/perl5/patches/patch-dist_Storable_Storable.xs 1.1 - lang/perl5/patches/patch-pp__pack.c 1.1 - lang/perl5/patches/patch-regcomp__study.c 1.2 --- Module Name: pkgsrc Committed By: wiz Date: Mon Jul 13 18:44:25 UTC 2026 Modified Files: pkgsrc/lang/perl5: Makefile distinfo pkgsrc/lang/perl5/patches: patch-regcomp__study.c Added Files: pkgsrc/lang/perl5/patches: patch-dist_Storable_Storable.xs patch-pp__pack.c Log Message: perl: fix CVE-2026-13221, CVE-2026-57432, CVE-2026-57433. Bump PKGREVISION. @ text @a2 5 Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch d8 1 a8 18 @@@@ -1841,6 +1841,16 @@@@ Perl_study_chunk(pTHX_ tail = regnext( tail ); } + /* The code below currently saves the difference from + * start to finish in a 16-bit field, causing + * GH #23388. This defeats the design of batching + * tries into chunks that each fit. khw thinks it is + * too late in the 5.44 cycle to relook at the design, + * so for now anyway, don't make a trie that would + * overflow */ + if (tail - startbranch >= U16_MAX) { + continue; + } DEBUG_TRIE_COMPILE_r({ regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state); @@@@ -2770,6 +2780,13 @@@@ Perl_study_chunk(pTHX_ @ 1.1.2.1 log @file patch-regcomp__study.c was added on branch pkgsrc-2026Q1 on 2026-06-09 22:30:58 +0000 @ text @d1 21 @ 1.1.2.2 log @Pullup ticket #7132 - requested by taca lang/perl5: Security fix Revisions pulled up: - lang/perl5/Makefile 1.292-1.293 - lang/perl5/distinfo 1.197-1.198 - lang/perl5/patches/patch-cpan_Archive-Tar_lib_Archive_Tar.pm 1.1 - lang/perl5/patches/patch-regcomp__study.c 1.1 --- Module Name: pkgsrc Committed By: wiz Date: Wed May 27 22:28:20 UTC 2026 Modified Files: pkgsrc/lang/perl5: Makefile distinfo Added Files: pkgsrc/lang/perl5/patches: patch-regcomp__study.c Log Message: perl: apply upstream security fix for regex on 32-bit systems. Bump PKGREVISION. --- Module Name: pkgsrc Committed By: wiz Date: Wed May 27 22:35:30 UTC 2026 Modified Files: pkgsrc/lang/perl5: Makefile distinfo Added Files: pkgsrc/lang/perl5/patches: patch-cpan_Archive-Tar_lib_Archive_Tar.pm Log Message: perl: fix security problem in Archive::Tar Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header Bump PKGREVISION. @ text @a0 21 $NetBSD: patch-regcomp__study.c,v 1.1 2026/05/27 22:28:20 wiz Exp $ Perl/perl-security#147: test against the actual character lengths https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c --- regcomp_study.c.orig 2026-01-18 17:50:04.000000000 +0000 +++ regcomp_study.c @@@@ -2770,6 +2770,13 @@@@ Perl_study_chunk(pTHX_ (U8 *) SvEND(data->last_found)) - (U8*)s; l -= old; + + if (l > 0 && + (mincount >= SSize_t_MAX / (SSize_t)l + || old > SSize_t_MAX - mincount * (SSize_t)l)) { + FAIL("Regexp out of space"); + } + /* Get the added string: */ last_str = newSVpvn_utf8(s + old, l, UTF); last_chrs = UTF ? utf8_length((U8*)(s + old), @