From c33285d9879aa7ebfef856f379ddc758b3d56f67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Fri, 20 Jan 2017 09:33:57 +0100 Subject: [PATCH] Fix a buffer overflow in split in scalar context --- ...it-scalar-context-stack-overflow-fix.patch | 62 +++++++++++++++++++ perl.spec | 11 +++- 2 files changed, 72 insertions(+), 1 deletion(-) create mode 100644 perl-5.24.1-perl-130262-split-scalar-context-stack-overflow-fix.patch diff --git a/perl-5.24.1-perl-130262-split-scalar-context-stack-overflow-fix.patch b/perl-5.24.1-perl-130262-split-scalar-context-stack-overflow-fix.patch new file mode 100644 index 0000000..e250a0a --- /dev/null +++ b/perl-5.24.1-perl-130262-split-scalar-context-stack-overflow-fix.patch @@ -0,0 +1,62 @@ +From 2bcb4a5888b1c26ee11bc447cc02b42290c707af Mon Sep 17 00:00:00 2001 +From: Tony Cook +Date: Mon, 5 Dec 2016 11:48:14 +1100 +Subject: [PATCH] (perl #130262) split scalar context stack overflow fix +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Ported to 5.14.1: + +commit 02c161ef974f8f1efbb5632f741c1164adb6ca75 +Author: Tony Cook +Date: Mon Dec 5 11:48:14 2016 +1100 + + (perl #130262) split scalar context stack overflow fix + + pp_split didn't ensure there was space for its return value + in scalar context. + +Signed-off-by: Petr Písař +--- + pp.c | 2 +- + t/op/split.t | 6 +++++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/pp.c b/pp.c +index 70345ce..334b353 100644 +--- a/pp.c ++++ b/pp.c +@@ -6259,7 +6259,7 @@ PP(pp_split) + } + + GETTARGET; +- PUSHi(iters); ++ XPUSHi(iters); + RETURN; + } + +diff --git a/t/op/split.t b/t/op/split.t +index b7846a1..3e08841 100644 +--- a/t/op/split.t ++++ b/t/op/split.t +@@ -7,7 +7,7 @@ BEGIN { + set_up_inc('../lib'); + } + +-plan tests => 133; ++plan tests => 134; + + $FS = ':'; + +@@ -534,3 +534,7 @@ is "@a", '1 2 3', 'assignment to split-to-array (stacked)'; + ok eval { $a[0] = 'a'; 1; }, "array split filling AvARRAY: assign 0"; + is "@a", "a b", "array split filling AvARRAY: result"; + } ++ ++fresh_perl_is(<<'CODE', '', {}, "scalar split stack overflow"); ++map{int"";split//.0>60for"0000000000000000"}split// for"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" ++CODE +-- +2.7.4 + diff --git a/perl.spec b/perl.spec index 344e247..237296e 100644 --- a/perl.spec +++ b/perl.spec @@ -28,7 +28,7 @@ Name: perl Version: %{perl_version} # release number must be even higher, because dual-lived modules will be broken otherwise -Release: 385%{?dist} +Release: 386%{?dist} Epoch: %{perl_epoch} Summary: Practical Extraction and Report Language Group: Development/Languages @@ -236,6 +236,10 @@ Patch64: perl-5.24.0-perl-129788-IO-Poll-fix-memory-leak.patch # Fix regular expression matching, RT#130307, in upstream after 5.25.7 Patch65: perl-5.25.7-perl-130307-Correctly-unwind-on-cache-hit.patch +# Fix a buffer overflow in split in scalar context, RT#130262, +# in upstream after 5.25.8 +Patch66: perl-5.24.1-perl-130262-split-scalar-context-stack-overflow-fix.patch + # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048 Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch @@ -2925,6 +2929,7 @@ Perl extension for Version Objects %patch63 -p1 %patch64 -p1 %patch65 -p1 +%patch66 -p1 %patch200 -p1 %patch201 -p1 @@ -2979,6 +2984,7 @@ perl -x patchlevel.h \ 'Fedora Patch63: Fix a crash in optimized evaluation of "or ((0) x 0))" (RT#130247)' \ 'Fedora Patch64: Fix a memory leak in IO::Poll (RT#129788)' \ 'Fedora Patch65: Fix regular expression matching (RT#130307)' \ + 'Fedora Patch66: Fix a buffer overflow in split in scalar context (RT#130262)' \ 'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \ 'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \ %{nil} @@ -5255,6 +5261,9 @@ popd # Old changelog entries are preserved in CVS. %changelog +* Fri Jan 20 2017 Petr Pisar - 4:5.24.1-386 +- Fix a buffer overflow in split in scalar context (RT#130262) + * Mon Jan 16 2017 Jitka Plesnikova - 4:5.24.1-385 - 5.24.1 bump (see for release notes)