diff --git a/perl-5.40.2-CVE-2026-13221.patch b/perl-5.40.2-CVE-2026-13221.patch new file mode 100644 index 0000000..eb25dd6 --- /dev/null +++ b/perl-5.40.2-CVE-2026-13221.patch @@ -0,0 +1,68 @@ +From dee6dd8b65bd8059a24e0beab1e2b057ee40fce0 Mon Sep 17 00:00:00 2001 +From: Karl Williamson +Date: Thu, 26 Mar 2026 10:13:49 -0600 +Subject: [PATCH] regcomp_study: Don't create a trie that would overflow + +This addresses GH #23388 + +The design of the trie compiling code is to batch extra long tries into +smaller chunks that fit into whatever limitations there are. However, +this ticket shows that that isn't always being done. + +In this case, a bunch of branches that have TAIL operands can be +combined together, and the final TAIL is used. And the code requires +that the delta between the first branch and this final TAIL fit into a +16-bit field. That is the root cause of this bug. + +I'm not familiar enough with the trie construction code to easily +understand why the final tail needs to be used here. So this patch +simply doesn't optimize a sequence of branches into a trie that would +overflow. + +This could be revisited by someone who knows more about this than I, or +earlier in the development cycle. +--- + regcomp_study.c | 10 ++++++++++ + t/re/pat_advanced.t | 8 ++++++++ + 2 files changed, 18 insertions(+) + +diff --git a/regcomp_study.c b/regcomp_study.c +index 6f41860cac..43d8dbe385 100644 +--- a/regcomp_study.c ++++ b/regcomp_study.c +@@ -1840,6 +1840,16 @@ Perl_study_chunk(pTHX_ + tail = regnext( tail ); + } + ++ /* The code below currently saves the difference from ++ * start to finish in a 16-bit field, causing ++ * GH #23388. This defeats the design of batching ++ * tries into chunks that each fit. khw thinks it is ++ * too late in the 5.44 cycle to relook at the design, ++ * so for now anyway, don't make a trie that would ++ * overflow */ ++ if (tail - startbranch >= U16_MAX) { ++ continue; ++ } + + DEBUG_TRIE_COMPILE_r({ + regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state); +diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t +index 4d62f62c90..28f869ebc4 100644 +--- a/t/re/pat_advanced.t ++++ b/t/re/pat_advanced.t +@@ -2713,6 +2713,14 @@ EOF_DEBUG_OUT + $x =~ s/^[\x{0301}\x{030C}]+//; + } + ++ { # GH #23388 ++ fresh_perl_is(<<~'PROG', , "", {}, "Avoid trie overflow"); ++ my $x = join "|", "aaa".."mzz"; ++ my $y = join "|", "naa".."zzz"; ++ use re 'Debug'; ++ "fnord" =~ m/(?:$x)|(?:$y)/; ++ PROG ++ } + + # !!! NOTE that tests that aren't at all likely to crash perl should go + # a ways above, above these last ones. There's a comment there that, like diff --git a/perl.spec b/perl.spec index f700162..4c0739a 100644 --- a/perl.spec +++ b/perl.spec @@ -117,7 +117,7 @@ License: GPL-1.0-or-later OR Artistic-1.0-Perl Epoch: %{perl_epoch} Version: %{perl_version} # release number must be even higher, because dual-lived modules will be broken otherwise -Release: 514%{?dist} +Release: 515%{?dist} Summary: Practical Extraction and Report Language Url: https://www.perl.org/ Source0: https://www.cpan.org/src/5.0/perl-%{perl_version}.tar.xz @@ -187,6 +187,10 @@ Patch13: perl-5.28.0-Pass-CFLAGS-to-dtrace.patch Patch14: perl-5.42.0-CVE-2025-40909-Clone-dirhandles-without-fchdir.patch Patch15: perl-5.42.0-Use-PerlLIO_dup_cloexec-in-Perl_dirp_dup-to-set-O_CL.patch +# Fix CVE-2026-13221 - regcomp_study: Don't create a trie that would overflow +# https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7 +Patch16: perl-5.40.2-CVE-2026-13221.patch + # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048 Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch @@ -4245,6 +4249,7 @@ you're not running VMS, this module does nothing. %patch -P13 -p1 %patch -P14 -p1 %patch -P15 -p1 +%patch -P16 -p1 %patch -P200 -p1 %patch -P201 -p1 %patch -P202 -p1 @@ -4267,6 +4272,7 @@ perl -x patchlevel.h \ 'Fedora Patch12: Link XS modules to pthread library to fix linking with -z defs' \ 'Fedora Patch13: Pass the correct CFLAGS to dtrace' \ 'Fedora Patch14: Fix CVE-2025-40909' \ + 'Fedora Patch16: Fix CVE-2026-13221' \ 'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \ 'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \ 'Fedora Patch202: Add definition of OPTIMIZE to .ph files' \ @@ -7294,6 +7300,10 @@ ln -s /app/bin/perl %{buildroot}/usr/bin/perl # Old changelog entries are preserved in CVS. %changelog +* Fri Aug 21 2026 RHEL Packaging Agent - 4:5.40.2-515 +- Fixes: CVE-2026-13221 - regcomp_study: Don't create a trie that would + overflow + * Thu Jul 10 2025 Jitka Plesnikova - 4:5.40.1-514 - Fixes: CVE-2025-40909 - Clone dirhandles without fchdir