Resolves: RHEL-247945

perl-5.32.1-CVE-2026-13221.patch

@@ -0,0 +1,70 @@
+From 4887c500a5440cddbaa0f98ed09726767362b570 Mon Sep 17 00:00:00 2001
+From: Karl Williamson <khw@cpan.org>
+Date: Thu, 26 Mar 2026 10:13:49 -0600
+Subject: [PATCH] regcomp_study: Don't create a trie that would overflow
+
+This addresses GH #23388
+
+The design of the trie compiling code is to batch extra long tries into
+smaller chunks that fit into whatever limitations there are.  However,
+this ticket shows that that isn't always being done.
+
+In this case, a bunch of branches that have TAIL operands can be
+combined together, and the final TAIL is used.  And the code requires
+that the delta between the first branch and this final TAIL fit into a
+16-bit field.  That is the root cause of this bug.
+
+I'm not familiar enough with the trie construction code to easily
+understand why the final tail needs to be used here.  So this patch
+simply doesn't optimize a sequence of branches into a trie that would
+overflow.
+
+This could be revisited by someone who knows more about this than I, or
+earlier in the development cycle.
+---
+ regcomp.c           | 10 ++++++++++
+ t/re/pat_advanced.t |  9 +++++++++
+ 2 files changed, 19 insertions(+)
+
+diff --git a/regcomp.c b/regcomp.c
+index d282ebc044..39611fcae9 100644
+--- a/regcomp.c
++++ b/regcomp.c
+@@ -4913,6 +4913,16 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+                             tail = regnext( tail );
+                         }
+ 
++                        /* The code below currently saves the difference from
++                         * start to finish in a 16-bit field, causing
++                         * GH #23388.  This defeats the design of batching
++                         * tries into chunks that each fit.  khw thinks it is
++                         * too late in the 5.44 cycle to relook at the design,
++                         * so for now anyway, don't make a trie that would
++                         * overflow */
++                        if (tail - startbranch >= U16_MAX) {
++                            continue;
++                        }
+ 
+                         DEBUG_TRIE_COMPILE_r({
+                             regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state);
+diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t
+index 7f367f5c04..6592335f9c 100644
+--- a/t/re/pat_advanced.t
++++ b/t/re/pat_advanced.t
+@@ -2584,6 +2584,15 @@ EOF
+                         {}, "perl-security#140");
+     }
+ 
++    { # GH #23388
++        fresh_perl_is(<<~'PROG', , "", {}, "Avoid trie overflow");
++            my $x = join "|", "aaa".."mzz";
++            my $y = join "|", "naa".."zzz";
++            use re 'Debug';
++            "fnord" =~ m/(?:$x)|(?:$y)/;
++            PROG
++    }
++
+ 
+     # !!! NOTE that tests that aren't at all likely to crash perl should go
+     # a ways above, above these last ones.  There's a comment there that, like
+

perl.spec

@@ -100,7 +100,7 @@ License:        GPL+ or Artistic
 Epoch:          %{perl_epoch}
 Version:        %{perl_version}
 # release number must be even higher, because dual-lived modules will be broken otherwise
-Release:        474%{?dist}
+Release:        475%{?dist}
 Summary:        Practical Extraction and Report Language
 Url:            https://www.perl.org/
 Source0:        https://www.cpan.org/src/5.0/perl-%{perl_version}.tar.xz
@@ -288,6 +288,10 @@ Patch59:        perl-5.32.1-CVE-2023-47038.patch
 Patch60:        perl-5.42.0-CVE-2025-40909-Clone-dirhandles-without-fchdir.patch
 Patch61:        perl-5.42.0-Use-PerlLIO_dup_cloexec-in-Perl_dirp_dup-to-set-O_CL.patch
 
+# CVE-2026-13221
+# https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7
+Patch62:        perl-5.32.1-CVE-2026-13221.patch
+
 # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
 Patch200:       perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
 
@@ -4350,6 +4354,7 @@ you're not running VMS, this module does nothing.
 %patch59 -p1
 %patch60 -p1
 %patch61 -p1
+%patch62 -p1
 %patch200 -p1
 %patch201 -p1
 %patch202 -p1
@@ -4410,6 +4415,7 @@ perl -x patchlevel.h \
     'Fedora Patch58: Fix an arithmetic left shift of a minimal integer value (GH#18639)' \
     'RHEL Patch59: Fix write past buffer end via illegal user-defined Unicode property (CVE-2023-47038)' \
     'RHEL Patch60: Fix CVE-2025-40909' \
+    'RHEL Patch62: Fix CVE-2026-13221 - Do not create a trie that would overflow' \
     'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \
     'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
     'Fedora Patch202: Add definition of OPTIMIZE to .ph files (bug #2159760)' \
@@ -7132,6 +7138,10 @@ popd
 
 # Old changelog entries are preserved in CVS.
 %changelog
+* Wed Aug 26 2026 Jitka Plesnikova <jplesnik@redhat.com> - 4:5.32.1-475
+- Fixes: CVE-2026-13221 - Don't create a trie that would overflow
+- Resolves: RHEL-247945
+
 * Mon Mar 16 2026 Jitka Plesnikova <jplesnik@redhat.com> - 4:5.32.1-474
 - Resolves: RHEL-153834
 - Fix CVE-2025-40909 - Clone dirhandles without fchdir