[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <54C2BF6B.4080508@redhat.com>
Date: Fri, 23 Jan 2015 14:38:51 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
Assign a CVE Identifier <cve-assign@...re.org>
Subject: [perl #119505] Segfault from bad backreference
http://perl5.git.perl.org/perl.git/commitdiff/0c2990d652e985784f095bba4bc356481a66aa06
The code that parses regex backrefs (or ambiguous backref/octal) such as
\123, did a simple atoi(), which could wrap round to negative values on
long digit strings and cause seg faults.
Include a check on the length of the digit string, and if greater than 9
digits, assume it can never be a valid backref (obviating the need for
the atoi() call).
I've also simplified the code a bit, putting most of the \g handling
code into a single block, rather than doing multiple "if (isg) {...}".
PoC:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776046
perl -e '/\7777777777/'
not sure if this can be exploited at all, but someone creative maybe has
ideas, if so this may need a CVE.
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
