646b892680
Some checks failed
Periodic Merges (6h) / master → staging-nixos (push) Failing after 12m50s
Periodic Merges (6h) / master → staging-next (push) Failing after 12m54s
Periodic Merges (24h) / merge-base(master,staging) → haskell-updates (push) Failing after 11m54s
Periodic Merges (6h) / staging-next → staging (push) Failing after 12m13s
Periodic Merges (24h) / staging-next-25.05 → staging-25.05 (push) Failing after 13m24s
Periodic Merges (24h) / release-25.05 → staging-next-25.05 (push) Failing after 14m28s
27 lines
997 B
Diff
27 lines
997 B
Diff
commit 385e8759c3ff1e7f7f996bd4ea391074d61d48c1
|
|
Author: Karl Williamson <khw@cpan.org>
|
|
AuthorDate: 2024-12-18 18:25:29 -0700
|
|
Commit: Steve Hay <steve.m.hay@googlemail.com>
|
|
CommitDate: 2025-03-30 11:59:51 +0100
|
|
|
|
CVE-2024-56406: Heap-buffer-overflow with tr//
|
|
|
|
This was due to underallocating needed space. If the translation forces
|
|
something to become UTF-8 that is initially bytes, that UTF-8 could
|
|
now require two bytes where previously a single one would do.
|
|
|
|
(cherry picked from commit f93109c8a6950aafbd7488d98e112552033a3686)
|
|
|
|
diff --git a/op.c b/op.c
|
|
index 3fc23eca49a..aeee88e0335 100644
|
|
--- a/op.c
|
|
+++ b/op.c
|
|
@@ -6649,6 +6649,7 @@ S_pmtrans(pTHX_ OP *o, OP *expr, OP *repl)
|
|
* same time. But otherwise one crosses before the other */
|
|
if (t_cp < 256 && r_cp_end > 255 && r_cp != t_cp) {
|
|
can_force_utf8 = TRUE;
|
|
+ max_expansion = MAX(2, max_expansion);
|
|
}
|
|
}
|
|
|