import perl-5.30.1-451.module+el8.3.0+6961+31ca2e7a

2020-07-10 01:42:11 +00:00 · 2020-07-10 01:42:11 +00:00 · 2eb1c59b01
commit 2eb1c59b01
parent a2a09f7784
5 changed files with 569 additions and 1 deletions
--- a/SOURCES/perl-5.30.1-study_chunk-avoid-mutating-regexp-program-within-GOS.patch
+++ b/SOURCES/perl-5.30.1-study_chunk-avoid-mutating-regexp-program-within-GOS.patch
@ -0,0 +1,306 @@
+From 783ddef8fc74b00cde72898c2c3228853dc82d91 Mon Sep 17 00:00:00 2001
+From: Hugo van der Sanden <hv@crypt.org>
+Date: Sat, 11 Apr 2020 14:10:24 +0100
+Subject: [PATCH] study_chunk: avoid mutating regexp program within GOSUB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+gh16947 and gh17743: studying GOSUB may restudy in an inner call
+(via a mix of recursion and enframing) something that an outer call
+is in the middle of looking at.  Let the outer frame deal with it.
+
+(CVE-2020-12723)
+
+(cherry picked from commit c4033e740bd18d9fbe3456a9db2ec2053cdc5271)
+Petr Písař: Ported to 5.30.1 from
+66bbb51b93253a3f87d11c2695cfb7bdb782184a.
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ embed.fnc  |  2 +-
+ embed.h    |  2 +-
+ proto.h    |  2 +-
+ regcomp.c  | 54 +++++++++++++++++++++++++++++++++++-------------------
+ t/re/pat.t | 26 +++++++++++++++++++++++++-
+ 5 files changed, 63 insertions(+), 23 deletions(-)
+
+diff --git a/embed.fnc b/embed.fnc
+index 1b9cf54..d0463e4 100644
+--- a/embed.fnc
+++ b/embed.fnc
+@@ -2482,7 +2482,7 @@ Es	|SSize_t|study_chunk	|NN RExC_state_t *pRExC_state \
+ 				|NULLOK struct scan_data_t *data \
+                                 |I32 stopparen|U32 recursed_depth \
+ 				|NULLOK regnode_ssc *and_withp \
+-				|U32 flags|U32 depth
+				|U32 flags|U32 depth|bool was_mutate_ok
+ Es	|void	|rck_elide_nothing|NN regnode *node
+ EsR	|SV *	|get_ANYOFM_contents|NN const regnode * n
+ EsRn	|U32	|add_data	|NN RExC_state_t* const pRExC_state \
+diff --git a/embed.h b/embed.h
+index cf44011..72c2a8e 100644
+--- a/embed.h
+++ b/embed.h
+@@ -1239,7 +1239,7 @@
+ #define ssc_is_cp_posixl_init	S_ssc_is_cp_posixl_init
+ #define ssc_or(a,b,c)		S_ssc_or(aTHX_ a,b,c)
+ #define ssc_union(a,b,c)	S_ssc_union(aTHX_ a,b,c)
+-#define study_chunk(a,b,c,d,e,f,g,h,i,j,k)	S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k)
+#define study_chunk(a,b,c,d,e,f,g,h,i,j,k,l)	S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k,l)
+ #  endif
+ #  if defined(PERL_IN_REGCOMP_C) || defined (PERL_IN_DUMP_C)
+ #define _invlist_dump(a,b,c,d)	Perl__invlist_dump(aTHX_ a,b,c,d)
+diff --git a/proto.h b/proto.h
+index ee74153..9a3ce27 100644
+--- a/proto.h
+++ b/proto.h
+@@ -5671,7 +5671,7 @@ PERL_STATIC_INLINE void	S_ssc_union(pTHX_ regnode_ssc *ssc, SV* const invlist, c
+ #define PERL_ARGS_ASSERT_SSC_UNION	\
+ 	assert(ssc); assert(invlist)
+ #endif
+-STATIC SSize_t	S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth);
+STATIC SSize_t	S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth, bool was_mutate_ok);
+ #define PERL_ARGS_ASSERT_STUDY_CHUNK	\
+ 	assert(pRExC_state); assert(scanp); assert(minlenp); assert(deltap); assert(last)
+ #endif
+diff --git a/regcomp.c b/regcomp.c
+index b101752..b9ea2a0 100644
+--- a/regcomp.c
+++ b/regcomp.c
+@@ -106,6 +106,7 @@ typedef struct scan_frame {
+     regnode *next_regnode;      /* next node to process when last is reached */
+     U32 prev_recursed_depth;
+     I32 stopparen;              /* what stopparen do we use */
+    bool in_gosub;              /* this or an outer frame is for GOSUB */
+ 
+     struct scan_frame *this_prev_frame; /* this previous frame */
+     struct scan_frame *prev_frame;      /* previous frame */
+@@ -4475,7 +4476,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ 			I32 stopparen,
+                         U32 recursed_depth,
+ 			regnode_ssc *and_withp,
+-			U32 flags, U32 depth)
+			U32 flags, U32 depth, bool was_mutate_ok)
+ 			/* scanp: Start here (read-write). */
+ 			/* deltap: Write maxlen-minlen here. */
+ 			/* last: Stop before this one. */
+@@ -4554,6 +4555,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+                                    node length to get a real minimum (because
+                                    the folded version may be shorter) */
+ 	bool unfolded_multi_char = FALSE;
+        /* avoid mutating ops if we are anywhere within the recursed or
+         * enframed handling for a GOSUB: the outermost level will handle it.
+         */
+        bool mutate_ok = was_mutate_ok && !(frame && frame->in_gosub);
+ 	/* Peephole optimizer: */
+         DEBUG_STUDYDATA("Peep", data, depth, is_inf);
+         DEBUG_PEEP("Peep", scan, depth, flags);
+@@ -4564,7 +4569,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+          * parsing code, as each (?:..) is handled by a different invocation of
+          * reg() -- Yves
+          */
+-        JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0);
+        if (mutate_ok)
+            JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0);
+ 
+         /* Follow the next-chain of the current node and optimize
+            away all the NOTHINGs from it.
+@@ -4596,7 +4602,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+             /* DEFINEP study_chunk() recursion */
+             (void)study_chunk(pRExC_state, &scan, &minlen,
+                               &deltanext, next, &data_fake, stopparen,
+-                              recursed_depth, NULL, f, depth+1);
+                              recursed_depth, NULL, f, depth+1, mutate_ok);
+ 
+             scan = next;
+         } else
+@@ -4664,7 +4670,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+                     /* recurse study_chunk() for each BRANCH in an alternation */
+ 		    minnext = study_chunk(pRExC_state, &scan, minlenp,
+                                       &deltanext, next, &data_fake, stopparen,
+-                                      recursed_depth, NULL, f, depth+1);
+                                      recursed_depth, NULL, f, depth+1,
+                                      mutate_ok);
+ 
+ 		    if (min1 > minnext)
+ 			min1 = minnext;
+@@ -4731,9 +4738,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ 		    }
+ 		}
+ 
+-                if (PERL_ENABLE_TRIE_OPTIMISATION &&
+-                        OP( startbranch ) == BRANCH )
+-                {
+                if (PERL_ENABLE_TRIE_OPTIMISATION
+                    && OP(startbranch) == BRANCH
+                    && mutate_ok
+                ) {
+ 		/* demq.
+ 
+                    Assuming this was/is a branch we are dealing with: 'scan'
+@@ -5188,6 +5196,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+                 newframe->stopparen = stopparen;
+                 newframe->prev_recursed_depth = recursed_depth;
+                 newframe->this_prev_frame= frame;
+                newframe->in_gosub = (
+                    (frame && frame->in_gosub) || OP(scan) == GOSUB
+                );
+ 
+                 DEBUG_STUDYDATA("frame-new", data, depth, is_inf);
+                 DEBUG_PEEP("fnew", scan, depth, flags);
+@@ -5345,7 +5356,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ 
+                 /* This temporary node can now be turned into EXACTFU, and
+                  * must, as regexec.c doesn't handle it */
+-                if (OP(next) == EXACTFU_S_EDGE) {
+                if (OP(next) == EXACTFU_S_EDGE && mutate_ok) {
+                     OP(next) = EXACTFU;
+                 }
+ 
+@@ -5353,8 +5364,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+                     &&   isALPHA_A(* STRING(next))
+                     && (         OP(next) == EXACTFAA
+                         || (     OP(next) == EXACTFU
+-                            && ! HAS_NONLATIN1_SIMPLE_FOLD_CLOSURE(* STRING(next)))))
+-                {
+                            && ! HAS_NONLATIN1_SIMPLE_FOLD_CLOSURE(* STRING(next))))
+                    &&   mutate_ok
+                ) {
+                     /* These differ in just one bit */
+                     U8 mask = ~ ('A' ^ 'a');
+ 
+@@ -5441,7 +5453,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+                                   (mincount == 0
+                                    ? (f & ~SCF_DO_SUBSTR)
+                                    : f)
+-                                  ,depth+1);
+                                  , depth+1, mutate_ok);
+ 
+ 		if (flags & SCF_DO_STCLASS)
+ 		    data->start_class = oclass;
+@@ -5507,7 +5519,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ 		if (  OP(oscan) == CURLYX && data
+ 		      && data->flags & SF_IN_PAR
+ 		      && !(data->flags & SF_HAS_EVAL)
+-		      && !deltanext && minnext == 1 ) {
+		      && !deltanext && minnext == 1
+                      && mutate_ok
+                ) {
+ 		    /* Try to optimize to CURLYN.  */
+ 		    regnode *nxt = NEXTOPER(oscan) + EXTRA_STEP_2ARGS;
+ 		    regnode * const nxt1 = nxt;
+@@ -5557,10 +5571,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ 		      && !(data->flags & SF_HAS_EVAL)
+ 		      && !deltanext	/* atom is fixed width */
+ 		      && minnext != 0	/* CURLYM can't handle zero width */
+-
+                          /* Nor characters whose fold at run-time may be
+                           * multi-character */
+                       && ! (RExC_seen & REG_UNFOLDED_MULTI_SEEN)
+                      && mutate_ok
+ 		) {
+ 		    /* XXXX How to optimize if data == 0? */
+ 		    /* Optimize to a simpler form.  */
+@@ -5613,7 +5627,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+                         /* recurse study_chunk() on optimised CURLYX => CURLYM */
+ 			study_chunk(pRExC_state, &nxt1, minlenp, &deltanext, nxt,
+                                     NULL, stopparen, recursed_depth, NULL, 0,
+-                                    depth+1);
+                                    depth+1, mutate_ok);
+ 		    }
+ 		    else
+ 			oscan->flags = 0;
+@@ -6018,7 +6032,8 @@ Perl_re_printf( aTHX_  "LHS=%" UVuf " RHS=%" UVuf "\n",
+                 /* recurse study_chunk() for lookahead body */
+                 minnext = study_chunk(pRExC_state, &nscan, minlenp, &deltanext,
+                                       last, &data_fake, stopparen,
+-                                      recursed_depth, NULL, f, depth+1);
+                                      recursed_depth, NULL, f, depth+1,
+                                      mutate_ok);
+                 if (scan->flags) {
+                     if (   deltanext < 0
+                         || deltanext > (I32) U8_MAX
+@@ -6123,7 +6138,7 @@ Perl_re_printf( aTHX_  "LHS=%" UVuf " RHS=%" UVuf "\n",
+                 *minnextp = study_chunk(pRExC_state, &nscan, minnextp,
+                                         &deltanext, last, &data_fake,
+                                         stopparen, recursed_depth, NULL,
+-                                        f, depth+1);
+                                        f, depth+1, mutate_ok);
+                 if (scan->flags) {
+                     assert(0);  /* This code has never been tested since this
+                                    is normally not compiled */
+@@ -6291,7 +6306,8 @@ Perl_re_printf( aTHX_  "LHS=%" UVuf " RHS=%" UVuf "\n",
+                         /* optimise study_chunk() for TRIE */
+                         minnext = study_chunk(pRExC_state, &scan, minlenp,
+                             &deltanext, (regnode *)nextbranch, &data_fake,
+-                            stopparen, recursed_depth, NULL, f, depth+1);
+                            stopparen, recursed_depth, NULL, f, depth+1,
+                            mutate_ok);
+                     }
+                     if (nextbranch && PL_regkind[OP(nextbranch)]==BRANCH)
+                         nextbranch= regnext((regnode*)nextbranch);
+@@ -8084,7 +8100,7 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count,
+             &data, -1, 0, NULL,
+             SCF_DO_SUBSTR | SCF_WHILEM_VISITED_POS | stclass_flag
+                           | (restudied ? SCF_TRIE_DOING_RESTUDY : 0),
+-            0);
+            0, TRUE);
+ 
+ 
+         CHECK_RESTUDY_GOTO_butfirst(LEAVE_with_name("study_chunk"));
+@@ -8213,7 +8229,7 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count,
+             SCF_DO_STCLASS_AND|SCF_WHILEM_VISITED_POS|(restudied
+                                                       ? SCF_TRIE_DOING_RESTUDY
+                                                       : 0),
+-            0);
+            0, TRUE);
+ 
+         CHECK_RESTUDY_GOTO_butfirst(NOOP);
+ 
+diff --git a/t/re/pat.t b/t/re/pat.t
+index 6a868f4..ba89a58 100644
+--- a/t/re/pat.t
+++ b/t/re/pat.t
+@@ -25,7 +25,7 @@ BEGIN {
+ skip_all('no re module') unless defined &DynaLoader::boot_DynaLoader;
+ skip_all_without_unicode_tables();
+ 
+-plan tests => 864;  # Update this when adding/deleting tests.
+plan tests => 868;  # Update this when adding/deleting tests.
+ 
+ run_tests() unless caller;
+ 
+@@ -2115,6 +2115,30 @@ x{0c!}\;\;îçÿ /0f/!F/;îçÿù\Qxÿÿÿÿù`x{0c!};ù\Q
+         like(runperl(prog => "$s", stderr => 1), qr/Unmatched \(/);
+    }
+ 
+    # gh16947: test regexp corruption (GOSUB)
+    {
+        fresh_perl_is(q{
+            'xy' =~ /x(?0)|x(?|y|y)/ && print 'ok'
+        }, 'ok', {}, 'gh16947: test regexp corruption (GOSUB)');
+    }
+    # gh16947: test fix doesn't break SUSPEND
+    {
+        fresh_perl_is(q{ 'sx' =~ m{ss++}i; print 'ok' },
+                'ok', {}, "gh16947: test fix doesn't break SUSPEND");
+    }
+
+    # gh17743: more regexp corruption via GOSUB
+    {
+        fresh_perl_is(q{
+            "0" =~ /((0(?0)|000(?|0000|0000)(?0))|)/; print "ok"
+        }, 'ok', {}, 'gh17743: test regexp corruption (1)');
+
+        fresh_perl_is(q{
+            "000000000000" =~ /(0(())(0((?0)())|000(?|\x{ef}\x{bf}\x{bd}|\x{ef}\x{bf}\x{bd}))|)/;
+            print "ok"
+        }, 'ok', {}, 'gh17743: test regexp corruption (2)');
+    }
+
+ } # End of sub run_tests
+ 
+ 1;
+-- 
+2.25.4
+
--- a/SOURCES/perl-5.30.2-regcomp-use-long-jumps-if-there-is-any-possibility-o.patch
+++ b/SOURCES/perl-5.30.2-regcomp-use-long-jumps-if-there-is-any-possibility-o.patch
@ -0,0 +1,39 @@
+From 3295b48defa0f8570114877b063fe546dd348b3c Mon Sep 17 00:00:00 2001
+From: Karl Williamson <khw@cpan.org>
+Date: Thu, 20 Feb 2020 17:49:36 +0000
+Subject: [PATCH 2/2] regcomp: use long jumps if there is any possibility of
+ overflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(CVE-2020-10878) Be conservative for backporting, we'll aim to do
+something more aggressive for bleadperl.
+
+(cherry picked from commit 9d7759db46f3b31b1d3f79c44266b6ba42a47fc6)
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ regcomp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/regcomp.c b/regcomp.c
+index 4ba2980db6..73c35a6702 100644
+--- a/regcomp.c
+++ b/regcomp.c
+@@ -7762,6 +7762,13 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count,
+ 
+         /* We have that number in RExC_npar */
+         RExC_total_parens = RExC_npar;
+
+        /* XXX For backporting, use long jumps if there is any possibility of
+         * overflow */
+        if (RExC_size > U16_MAX && ! RExC_use_BRANCHJ) {
+            RExC_use_BRANCHJ = TRUE;
+            flags |= RESTART_PARSE;
+        }
+     }
+     else if (! MUST_RESTART(flags)) {
+ 	ReREFCNT_dec(Rx);
+-- 
+2.25.4
+
--- a/SOURCES/perl-5.30.2-regcomp.c-Prevent-integer-overflow-from-nested-regex.patch
+++ b/SOURCES/perl-5.30.2-regcomp.c-Prevent-integer-overflow-from-nested-regex.patch
@ -0,0 +1,39 @@
+From 897d1f7fd515b828e4b198d8b8bef76c6faf03ed Mon Sep 17 00:00:00 2001
+From: John Lightsey <jd@cpanel.net>
+Date: Wed, 20 Nov 2019 20:02:45 -0600
+Subject: [PATCH] regcomp.c: Prevent integer overflow from nested regex
+ quantifiers.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(CVE-2020-10543) On 32bit systems the size calculations for nested regular
+expression quantifiers could overflow causing heap memory corruption.
+
+Fixes: Perl/perl5-security#125
+(cherry picked from commit bfd31397db5dc1a5c5d3e0a1f753a4f89a736e71)
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ regcomp.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/regcomp.c b/regcomp.c
+index 93c8d98fbb..5f86be8086 100644
+--- a/regcomp.c
+++ b/regcomp.c
+@@ -5489,6 +5489,12 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ 				  RExC_precomp)));
+                 }
+ 
+                if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext )
+                    || min >= SSize_t_MAX - minnext * mincount )
+                {
+                    FAIL("Regexp out of space");
+                }
+
+ 		min += minnext * mincount;
+ 		is_inf_internal |= deltanext == SSize_t_MAX
+                          || (maxcount == REG_INFTY && minnext + deltanext > 0);
+-- 
+2.25.4
+
--- a/SOURCES/perl-5.30.2-study_chunk-extract-rck_elide_nothing.patch
+++ b/SOURCES/perl-5.30.2-study_chunk-extract-rck_elide_nothing.patch
@ -0,0 +1,155 @@
+From 0a320d753fe7fca03df259a4dfd8e641e51edaa8 Mon Sep 17 00:00:00 2001
+From: Hugo van der Sanden <hv@crypt.org>
+Date: Tue, 18 Feb 2020 13:51:16 +0000
+Subject: [PATCH 1/2] study_chunk: extract rck_elide_nothing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(CVE-2020-10878)
+
+(cherry picked from commit 93dee06613d4e1428fb10905ce1c3c96f53113dc)
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ embed.fnc |  1 +
+ embed.h   |  1 +
+ proto.h   |  3 +++
+ regcomp.c | 70 ++++++++++++++++++++++++++++++++++---------------------
+ 4 files changed, 48 insertions(+), 27 deletions(-)
+
+diff --git a/embed.fnc b/embed.fnc
+index aedb4baef1..d7cd04d3fc 100644
+--- a/embed.fnc
+++ b/embed.fnc
+@@ -2481,6 +2481,7 @@ Es	|SSize_t|study_chunk	|NN RExC_state_t *pRExC_state \
+                                 |I32 stopparen|U32 recursed_depth \
+ 				|NULLOK regnode_ssc *and_withp \
+ 				|U32 flags|U32 depth
+Es	|void	|rck_elide_nothing|NN regnode *node
+ EsR	|SV *	|get_ANYOFM_contents|NN const regnode * n
+ EsRn	|U32	|add_data	|NN RExC_state_t* const pRExC_state \
+ 				|NN const char* const s|const U32 n
+diff --git a/embed.h b/embed.h
+index 75c91f77f4..356a8b98d9 100644
+--- a/embed.h
+++ b/embed.h
+@@ -1208,6 +1208,7 @@
+ #define parse_lparen_question_flags(a)	S_parse_lparen_question_flags(aTHX_ a)
+ #define parse_uniprop_string(a,b,c,d,e,f,g,h,i)	Perl_parse_uniprop_string(aTHX_ a,b,c,d,e,f,g,h,i)
+ #define populate_ANYOF_from_invlist(a,b)	S_populate_ANYOF_from_invlist(aTHX_ a,b)
+#define rck_elide_nothing(a)	S_rck_elide_nothing(aTHX_ a)
+ #define reg(a,b,c,d)		S_reg(aTHX_ a,b,c,d)
+ #define reg2Lanode(a,b,c,d)	S_reg2Lanode(aTHX_ a,b,c,d)
+ #define reg_node(a,b)		S_reg_node(aTHX_ a,b)
+diff --git a/proto.h b/proto.h
+index 141ddbaee6..f316fe134e 100644
+--- a/proto.h
+++ b/proto.h
+@@ -5543,6 +5543,9 @@ PERL_CALLCONV SV *	Perl_parse_uniprop_string(pTHX_ const char * const name, cons
+ STATIC void	S_populate_ANYOF_from_invlist(pTHX_ regnode *node, SV** invlist_ptr);
+ #define PERL_ARGS_ASSERT_POPULATE_ANYOF_FROM_INVLIST	\
+ 	assert(node); assert(invlist_ptr)
+STATIC void	S_rck_elide_nothing(pTHX_ regnode *node);
+#define PERL_ARGS_ASSERT_RCK_ELIDE_NOTHING	\
+	assert(node)
+ PERL_STATIC_NO_RET void	S_re_croak2(pTHX_ bool utf8, const char* pat1, const char* pat2, ...)
+ 			__attribute__noreturn__;
+ #define PERL_ARGS_ASSERT_RE_CROAK2	\
+diff --git a/regcomp.c b/regcomp.c
+index 5f86be8086..4ba2980db6 100644
+--- a/regcomp.c
+++ b/regcomp.c
+@@ -4450,6 +4450,44 @@ S_unwind_scan_frames(pTHX_ const void *p)
+     } while (f);
+ }
+ 
+/* Follow the next-chain of the current node and optimize away
+   all the NOTHINGs from it.
+ */
+STATIC void
+S_rck_elide_nothing(pTHX_ regnode *node)
+{
+    dVAR;
+
+    PERL_ARGS_ASSERT_RCK_ELIDE_NOTHING;
+
+    if (OP(node) != CURLYX) {
+        const int max = (reg_off_by_arg[OP(node)]
+                        ? I32_MAX
+                          /* I32 may be smaller than U16 on CRAYs! */
+                        : (I32_MAX < U16_MAX ? I32_MAX : U16_MAX));
+        int off = (reg_off_by_arg[OP(node)] ? ARG(node) : NEXT_OFF(node));
+        int noff;
+        regnode *n = node;
+
+        /* Skip NOTHING and LONGJMP. */
+        while (
+            (n = regnext(n))
+            && (
+                (PL_regkind[OP(n)] == NOTHING && (noff = NEXT_OFF(n)))
+                || ((OP(n) == LONGJMP) && (noff = ARG(n)))
+            )
+            && off + noff < max
+        ) {
+            off += noff;
+        }
+        if (reg_off_by_arg[OP(node)])
+            ARG(node) = off;
+        else
+            NEXT_OFF(node) = off;
+    }
+    return;
+}
+
+ /* the return from this sub is the minimum length that could possibly match */
+ STATIC SSize_t
+ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+@@ -4550,28 +4588,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+          */
+         JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0);
+ 
+-	/* Follow the next-chain of the current node and optimize
+-	   away all the NOTHINGs from it.  */
+-	if (OP(scan) != CURLYX) {
+-	    const int max = (reg_off_by_arg[OP(scan)]
+-		       ? I32_MAX
+-		       /* I32 may be smaller than U16 on CRAYs! */
+-		       : (I32_MAX < U16_MAX ? I32_MAX : U16_MAX));
+-	    int off = (reg_off_by_arg[OP(scan)] ? ARG(scan) : NEXT_OFF(scan));
+-	    int noff;
+-	    regnode *n = scan;
+-
+-	    /* Skip NOTHING and LONGJMP. */
+-	    while ((n = regnext(n))
+-		   && ((PL_regkind[OP(n)] == NOTHING && (noff = NEXT_OFF(n)))
+-		       || ((OP(n) == LONGJMP) && (noff = ARG(n))))
+-		   && off + noff < max)
+-		off += noff;
+-	    if (reg_off_by_arg[OP(scan)])
+-		ARG(scan) = off;
+-	    else
+-		NEXT_OFF(scan) = off;
+-	}
+        /* Follow the next-chain of the current node and optimize
+           away all the NOTHINGs from it.
+         */
+        rck_elide_nothing(scan);
+ 
+ 	/* The principal pseudo-switch.  Cannot be a switch, since we
+ 	   look into several different things.  */
+@@ -5745,11 +5765,7 @@ Perl_re_printf( aTHX_  "LHS=%" UVuf " RHS=%" UVuf "\n",
+ 		if (data && (fl & SF_HAS_EVAL))
+ 		    data->flags |= SF_HAS_EVAL;
+ 	      optimize_curly_tail:
+-		if (OP(oscan) != CURLYX) {
+-		    while (PL_regkind[OP(next = regnext(oscan))] == NOTHING
+-			   && NEXT_OFF(next))
+-			NEXT_OFF(oscan) += NEXT_OFF(next);
+-		}
+		rck_elide_nothing(oscan);
+ 		continue;
+ 
+ 	    default:
+-- 
+2.25.4
+
--- a/SPECS/perl.spec
+++ b/SPECS/perl.spec
@ -85,7 +85,7 @@ License:        GPL+ or Artistic
 Epoch:          %{perl_epoch}
 Version:        %{perl_version}
 # release number must be even higher, because dual-lived modules will be broken otherwise
-Release:        450%{?dist}
+Release:        451%{?dist}
 Summary:        Practical Extraction and Report Language
 Url:            https://www.perl.org/
 Source0:        https://www.cpan.org/src/5.0/perl-%{perl_version}.tar.xz
@ -296,6 +296,19 @@ Patch72:        perl-5.31.5-Adapt-Configure-to-GCC-version-10.patch
 # GH#17218, in upsream after 5.31.5
 Patch73:        perl-5.31.5-PATCH-gh-17218-memory-leak.patch

+# Fix CVE-2020-10543 (an integer overflow from nested regex quantifiers),
+# bug #1837975, in upstream 5.30.3
+Patch74:        perl-5.30.2-regcomp.c-Prevent-integer-overflow-from-nested-regex.patch
+
+# Fix CVE-2020-10878 (a corruption of a state of a compiled regular expression
+# due to an integer overflow), bug #1837988, in upstream 5.30.3
+Patch75:        perl-5.30.2-study_chunk-extract-rck_elide_nothing.patch
+Patch76:        perl-5.30.2-regcomp-use-long-jumps-if-there-is-any-possibility-o.patch
+
+# Fix CVE-2020-12723 (a corruption of a state of a compiled regular expression
+# due to recursive calls), bug #1838000, in upstream 5.30.3
+Patch77:        perl-5.30.1-study_chunk-avoid-mutating-regexp-program-within-GOS.patch
+
 # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
 Patch200:       perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch

@ -2890,6 +2903,10 @@ rm -rf .git # Perl tests examine a git repository
 %patch71 -p1
 %patch72 -p1
 %patch73 -p1
+%patch74 -p1
+%patch75 -p1
+%patch76 -p1
+%patch77 -p1
 %patch200 -p1
 %patch201 -p1

@ -2958,6 +2975,10 @@ perl -x patchlevel.h \
    'Fedora Patch71: Fix a buffer overread when parsing a number (GH#17279)' \
    'Fedora Patch72: Fix GCC 10 version detection (GH#17295)' \
    'Fedora Patch73: Fix a memory leak when compiling a regular expression with a non-word class (GH#17218)' \
+    'Fedora Patch74: Fix CVE-2020-10543 (an integer overflow from nested regex quantifiers)' \
+    'Fedora Patch75: Fix CVE-2020-10878 (a corruption of a state of a compiled regular expression due to an integer overflow)' \
+    'Fedora Patch76: Fix CVE-2020-10878 (a corruption of a state of a compiled regular expression due to an integer overflow)' \
+    'Fedora Patch77: Fix CVE-2020-12723 (a corruption of a state of a compiled regular expression due to recursive calls)' \
    'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \
    'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
    %{nil}
@ -5203,6 +5224,14 @@ popd

 # Old changelog entries are preserved in CVS.
 %changelog
+* Fri Jun 05 2020 Petr Pisar <ppisar@redhat.com> - 4:5.30.1-451
+- Fix CVE-2020-10543 (an integer overflow from nested regex quantifiers)
+  (bug #1837975)
+- Fix CVE-2020-10878 (a corruption of a state of a compiled regular expression
+  due to an integer overflow) (bug #1837988)
+- Fix CVE-2020-12723 (a corruption of a state of a compiled regular expression
+  due to recursive calls) (bug #1838000)
+
 * Fri Mar 13 2020 Petr Pisar <ppisar@redhat.com> - 4:5.30.1-450
 - Fix shebangs (bug #1813199)