From f971f58db79e2382d79b7329f0c9c46816617d2f Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Wed, 26 Aug 2026 15:41:25 +0200 Subject: [PATCH] Resolves: RHEL-247945 --- perl-5.32.1-CVE-2026-13221.patch | 70 ++++++++++++++++++++++++++++++++ perl.spec | 12 +++++- 2 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 perl-5.32.1-CVE-2026-13221.patch diff --git a/perl-5.32.1-CVE-2026-13221.patch b/perl-5.32.1-CVE-2026-13221.patch new file mode 100644 index 0000000..c151612 --- /dev/null +++ b/perl-5.32.1-CVE-2026-13221.patch @@ -0,0 +1,70 @@ +From 4887c500a5440cddbaa0f98ed09726767362b570 Mon Sep 17 00:00:00 2001 +From: Karl Williamson +Date: Thu, 26 Mar 2026 10:13:49 -0600 +Subject: [PATCH] regcomp_study: Don't create a trie that would overflow + +This addresses GH #23388 + +The design of the trie compiling code is to batch extra long tries into +smaller chunks that fit into whatever limitations there are. However, +this ticket shows that that isn't always being done. + +In this case, a bunch of branches that have TAIL operands can be +combined together, and the final TAIL is used. And the code requires +that the delta between the first branch and this final TAIL fit into a +16-bit field. That is the root cause of this bug. + +I'm not familiar enough with the trie construction code to easily +understand why the final tail needs to be used here. So this patch +simply doesn't optimize a sequence of branches into a trie that would +overflow. + +This could be revisited by someone who knows more about this than I, or +earlier in the development cycle. +--- + regcomp.c | 10 ++++++++++ + t/re/pat_advanced.t | 9 +++++++++ + 2 files changed, 19 insertions(+) + +diff --git a/regcomp.c b/regcomp.c +index d282ebc044..39611fcae9 100644 +--- a/regcomp.c ++++ b/regcomp.c +@@ -4913,6 +4913,16 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, + tail = regnext( tail ); + } + ++ /* The code below currently saves the difference from ++ * start to finish in a 16-bit field, causing ++ * GH #23388. This defeats the design of batching ++ * tries into chunks that each fit. khw thinks it is ++ * too late in the 5.44 cycle to relook at the design, ++ * so for now anyway, don't make a trie that would ++ * overflow */ ++ if (tail - startbranch >= U16_MAX) { ++ continue; ++ } + + DEBUG_TRIE_COMPILE_r({ + regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state); +diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t +index 7f367f5c04..6592335f9c 100644 +--- a/t/re/pat_advanced.t ++++ b/t/re/pat_advanced.t +@@ -2584,6 +2584,15 @@ EOF + {}, "perl-security#140"); + } + ++ { # GH #23388 ++ fresh_perl_is(<<~'PROG', , "", {}, "Avoid trie overflow"); ++ my $x = join "|", "aaa".."mzz"; ++ my $y = join "|", "naa".."zzz"; ++ use re 'Debug'; ++ "fnord" =~ m/(?:$x)|(?:$y)/; ++ PROG ++ } ++ + + # !!! NOTE that tests that aren't at all likely to crash perl should go + # a ways above, above these last ones. There's a comment there that, like + diff --git a/perl.spec b/perl.spec index fecc49e..8aad723 100644 --- a/perl.spec +++ b/perl.spec @@ -100,7 +100,7 @@ License: GPL+ or Artistic Epoch: %{perl_epoch} Version: %{perl_version} # release number must be even higher, because dual-lived modules will be broken otherwise -Release: 474%{?dist} +Release: 475%{?dist} Summary: Practical Extraction and Report Language Url: https://www.perl.org/ Source0: https://www.cpan.org/src/5.0/perl-%{perl_version}.tar.xz @@ -288,6 +288,10 @@ Patch59: perl-5.32.1-CVE-2023-47038.patch Patch60: perl-5.42.0-CVE-2025-40909-Clone-dirhandles-without-fchdir.patch Patch61: perl-5.42.0-Use-PerlLIO_dup_cloexec-in-Perl_dirp_dup-to-set-O_CL.patch +# CVE-2026-13221 +# https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7 +Patch62: perl-5.32.1-CVE-2026-13221.patch + # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048 Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch @@ -4350,6 +4354,7 @@ you're not running VMS, this module does nothing. %patch59 -p1 %patch60 -p1 %patch61 -p1 +%patch62 -p1 %patch200 -p1 %patch201 -p1 %patch202 -p1 @@ -4410,6 +4415,7 @@ perl -x patchlevel.h \ 'Fedora Patch58: Fix an arithmetic left shift of a minimal integer value (GH#18639)' \ 'RHEL Patch59: Fix write past buffer end via illegal user-defined Unicode property (CVE-2023-47038)' \ 'RHEL Patch60: Fix CVE-2025-40909' \ + 'RHEL Patch62: Fix CVE-2026-13221 - Do not create a trie that would overflow' \ 'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \ 'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \ 'Fedora Patch202: Add definition of OPTIMIZE to .ph files (bug #2159760)' \ @@ -7132,6 +7138,10 @@ popd # Old changelog entries are preserved in CVS. %changelog +* Wed Aug 26 2026 Jitka Plesnikova - 4:5.32.1-475 +- Fixes: CVE-2026-13221 - Don't create a trie that would overflow +- Resolves: RHEL-247945 + * Mon Mar 16 2026 Jitka Plesnikova - 4:5.32.1-474 - Resolves: RHEL-153834 - Fix CVE-2025-40909 - Clone dirhandles without fchdir