regcomp: heap-buffer-overflow read numeric= (perl-5.30.0)

[p5pRT]

Migrated from rt.perl.org#134134 (status was 'pending release')

Searchable as RT134134$

[p5pRT]

From @Etsukata

PoC

```

[eiichi@​x1 ~]$ valgrind perl5/perlbrew/perls/perl-5.30.0/bin/perl -e
'qr/\p{kAnumeric=}/'
==12733== Memcheck, a memory error detector
==12733== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==12733== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==12733== Command​: perl5/perlbrew/perls/perl-5.30.0/bin/perl -e
qr/\\p{kAnumeric=}/
==12733==
==12733== Invalid read of size 1
==12733==    at 0x483BBE6​: strlen (vg_replace_strmem.c​:461)
==12733==    by 0x54F463​: Perl_my_atof3 (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x488F10​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==  Address 0x51c802a is 0 bytes after a block of size 10 alloc'd
==12733==    at 0x483880B​: malloc (vg_replace_malloc.c​:309)
==12733==    by 0x4A70D2​: Perl_safesysmalloc (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x487E98​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==
==12733== Invalid read of size 1
==12733==    at 0x54F46A​: Perl_my_atof3 (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x488F10​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==  Address 0x51c802a is 0 bytes after a block of size 10 alloc'd
==12733==    at 0x483880B​: malloc (vg_replace_malloc.c​:309)
==12733==    by 0x4A70D2​: Perl_safesysmalloc (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x487E98​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==
==12733== Invalid read of size 1
==12733==    at 0x54ED77​: Perl_grok_infnan (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x54F4D0​: Perl_my_atof3 (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x488F10​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==  Address 0x51c802a is 0 bytes after a block of size 10 alloc'd
==12733==    at 0x483880B​: malloc (vg_replace_malloc.c​:309)
==12733==    by 0x4A70D2​: Perl_safesysmalloc (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x487E98​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==
==12733== Invalid read of size 1
==12733==    at 0x4A79193​: ____strtod_l_internal (in
/usr/lib64/libc-2.29.so)
==12733==    by 0x54F5F6​: Perl_my_atof3 (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x488F10​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==  Address 0x51c802a is 0 bytes after a block of size 10 alloc'd
==12733==    at 0x483880B​: malloc (vg_replace_malloc.c​:309)
==12733==    by 0x4A70D2​: Perl_safesysmalloc (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x487E98​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==
Can't find Unicode property definition "kAnumeric=" in regex; marked by
<-- HERE in m/\p{kAnumeric=} <-- HERE / at -e line 1.
==12733==
==12733== HEAP SUMMARY​:
==12733==     in use at exit​: 153,845 bytes in 675 blocks
==12733==   total heap usage​: 890 allocs, 215 frees, 190,773 bytes allocated
==12733==
==12733== LEAK SUMMARY​:
==12733==    definitely lost​: 0 bytes in 0 blocks
==12733==    indirectly lost​: 0 bytes in 0 blocks
==12733==      possibly lost​: 0 bytes in 0 blocks
==12733==    still reachable​: 153,845 bytes in 675 blocks
==12733==         suppressed​: 0 bytes in 0 blocks
==12733== Rerun with --leak-check=full to see details of leaked memory
==12733==
==12733== For lists of detected and suppressed errors, rerun with​: -s
==12733== ERROR SUMMARY​: 4 errors from 4 contexts (suppressed​: 0 from 0)

```

[p5pRT]

From @khwilliamson

On 5/24/19 9​:27 AM, Karl Williamson wrote​:

On 5/23/19 11​:53 PM, Eiichi Tsukata (via RT) wrote​:

# New Ticket Created by  Eiichi Tsukata
# Please include the string​:  [perl #134134]
# in the subject line of all future correspondence about this issue.
# <URL​: https://rt-archive.perl.org/perl5/Ticket/Display.html?id=134134 >

PoC

```

[eiichi@​x1 ~]$ valgrind perl5/perlbrew/perls/perl-5.30.0/bin/perl -e
'qr/\p{kAnumeric=}/'
==12733== Memcheck, a memory error detector
==12733== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==12733== Using Valgrind-3.15.0 and LibVEX; rerun with -h for
copyright info
==12733== Command​: perl5/perlbrew/perls/perl-5.30.0/bin/perl -e
qr/\\p{kAnumeric=}/
==12733==
==12733== Invalid read of size 1
==12733==    at 0x483BBE6​: strlen (vg_replace_strmem.c​:461)
==12733==    by 0x54F463​: Perl_my_atof3 (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x488F10​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==  Address 0x51c802a is 0 bytes after a block of size 10 alloc'd
==12733==    at 0x483880B​: malloc (vg_replace_malloc.c​:309)
==12733==    by 0x4A70D2​: Perl_safesysmalloc (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x487E98​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==
==12733== Invalid read of size 1
==12733==    at 0x54F46A​: Perl_my_atof3 (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x488F10​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==  Address 0x51c802a is 0 bytes after a block of size 10 alloc'd
==12733==    at 0x483880B​: malloc (vg_replace_malloc.c​:309)
==12733==    by 0x4A70D2​: Perl_safesysmalloc (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x487E98​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==
==12733== Invalid read of size 1
==12733==    at 0x54ED77​: Perl_grok_infnan (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x54F4D0​: Perl_my_atof3 (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x488F10​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==  Address 0x51c802a is 0 bytes after a block of size 10 alloc'd
==12733==    at 0x483880B​: malloc (vg_replace_malloc.c​:309)
==12733==    by 0x4A70D2​: Perl_safesysmalloc (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x487E98​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==
==12733== Invalid read of size 1
==12733==    at 0x4A79193​: ____strtod_l_internal (in
/usr/lib64/libc-2.29.so)
==12733==    by 0x54F5F6​: Perl_my_atof3 (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x488F10​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==  Address 0x51c802a is 0 bytes after a block of size 10 alloc'd
==12733==    at 0x483880B​: malloc (vg_replace_malloc.c​:309)
==12733==    by 0x4A70D2​: Perl_safesysmalloc (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x487E98​: Perl_parse_uniprop_string (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x48ED99​: S_regclass (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x492095​: S_regpiece (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x495E54​: S_regbranch (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x4963A7​: S_reg (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x49AE68​: Perl_re_op_compile (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x43928A​: Perl_pmruntime (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x46FEBD​: Perl_yyparse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x444AAC​: perl_parse (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==    by 0x42023F​: main (in
/home/eiichi/perl5/perlbrew/perls/perl-5.30.0/bin/perl)
==12733==
Can't find Unicode property definition "kAnumeric=" in regex; marked by
<-- HERE in m/\p{kAnumeric=} <-- HERE / at -e line 1.
==12733==
==12733== HEAP SUMMARY​:
==12733==     in use at exit​: 153,845 bytes in 675 blocks
==12733==   total heap usage​: 890 allocs, 215 frees, 190,773 bytes
allocated
==12733==
==12733== LEAK SUMMARY​:
==12733==    definitely lost​: 0 bytes in 0 blocks
==12733==    indirectly lost​: 0 bytes in 0 blocks
==12733==      possibly lost​: 0 bytes in 0 blocks
==12733==    still reachable​: 153,845 bytes in 675 blocks
==12733==         suppressed​: 0 bytes in 0 blocks
==12733== Rerun with --leak-check=full to see details of leaked memory
==12733==
==12733== For lists of detected and suppressed errors, rerun with​: -s
==12733== ERROR SUMMARY​: 4 errors from 4 contexts (suppressed​: 0 from 0)

```

This is fixed by the attached file

And I carelessly pushed that patch to blead in
2d26cf4

So we have a patch publicly available for an undisclosed potential
security flaw in 5.30, but not existing earlier.

I'm not sure what to do.

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @hvds

On Mon, 03 Jun 2019 14​:11​:52 -0700, public@​khwilliamson.com wrote​:

This is fixed by the attached file

And I carelessly pushed that patch to blead in
2d26cf4

So we have a patch publicly available for an undisclosed potential
security flaw in 5.30, but not existing earlier.

I'm not sure what to do.

First thing is probably to work out whether it's more than a _potential_ flaw. It isn't obvious to me from a brief look​: what is the buffer that's being overrun? It looks like it should be the SV with the string being qr{}d, but I'd expect that to be nul-terminated.

Hugo

[p5pRT]

From @hvds

On Mon, 03 Jun 2019 18​:01​:33 -0700, hv wrote​:

On Mon, 03 Jun 2019 14​:11​:52 -0700, public@​khwilliamson.com wrote​:

This is fixed by the attached file

And I carelessly pushed that patch to blead in
2d26cf4

So we have a patch publicly available for an undisclosed potential
security flaw in 5.30, but not existing earlier.

I'm not sure what to do.

First thing is probably to work out whether it's more than a
_potential_ flaw. It isn't obvious to me from a brief look​: what is
the buffer that's being overrun? It looks like it should be the SV
with the string being qr{}d, but I'd expect that to be nul-terminated.

I've found the Newx at the top of parse_uniprop_string() string now. Digging a bit further, I don't see an avenue for a security problem here​: worst case seems to be that the following bytes will successfully parse as a number without causing SEGV, in which case that number will be stored in 'value', fail the immediate test on the returned char*, and be discarded.

Unless I'm missing some further payload, this should not be a problem​: I don't see a way that the following bytes can be overwritten, nor any way for information about what was read to leak out unless my_atof3 itself has debug paths or failure cases that can emit diagnostics (and I don't see any).

I do think the earlier code in parse_uniprop_string could be tightened further​: there look to be cases where we look at name[i] when we may already have reached namelen. It's possible that we can always rely on a '}' protecting us there, but it seems unwise to rely on that in the longer term.

Hugo

[p5pRT]

From @iabyn

On Tue, Jun 04, 2019 at 03​:05​:35AM -0700, Hugo van der Sanden via RT wrote​:

Unless I'm missing some further payload, this should not be a problem​: I
don't see a way that the following bytes can be overwritten, nor any way
for information about what was read to leak out unless my_atof3 itself
has debug paths or failure cases that can emit diagnostics (and I don't
see any).

I agree.

--
The warp engines start playing up a bit, but seem to sort themselves out
after a while without any intervention from boy genius Wesley Crusher.
  -- Things That Never Happen in "Star Trek" #17

[p5pRT]

From @khwilliamson

On 6/4/19 4​:34 AM, Dave Mitchell wrote​:

On Tue, Jun 04, 2019 at 03​:05​:35AM -0700, Hugo van der Sanden via RT wrote​:

Unless I'm missing some further payload, this should not be a problem​: I
don't see a way that the following bytes can be overwritten, nor any way
for information about what was read to leak out unless my_atof3 itself
has debug paths or failure cases that can emit diagnostics (and I don't
see any).

I agree.

So, should this be moved to the public queue before closing?

[p5pRT]

From @khwilliamson

On 6/4/19 4​:05 AM, Hugo van der Sanden via RT wrote​:

I do think the earlier code in parse_uniprop_string could be tightened further​: there look to be cases where we look at name[i] when we may already have reached namelen. It's possible that we can always rely on a '}' protecting us there, but it seems unwise to rely on that in the longer term.

I found one such case, fixed by the attached patch.

If you know of others, please tell me.

[p5pRT]

From @khwilliamson

0005-regcomp.c-Don-t-read-off-the-end-of-buffer.patch

From 81a6635310602f5a7564d6e7a2f6aeed04e05929 Mon Sep 17 00:00:00 2001
From: Karl Williamson <khw@cpan.org>
Date: Thu, 27 Jun 2019 15:39:11 -0600
Subject: [PATCH 5/5] regcomp.c: Don't read off the end of buffer

Until this commit, it was possible that \p{nv=3/} would cause the right
brace to be considered part of the property name.
---
 regcomp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/regcomp.c b/regcomp.c
index aa291a20d0..ab0aac0d96 100644
--- a/regcomp.c
+++ b/regcomp.c
@@ -23090,7 +23090,9 @@ Perl_parse_uniprop_string(pTHX_
             }
 
             /* Store the first real character in the denominator */
-            lookup_name[j++] = name[i];
+            if (i < name_len) {
+                lookup_name[j++] = name[i];
+            }
         }
     }
 
-- 
2.17.1

[p5pRT]

From @iabyn

On Thu, Jun 27, 2019 at 03​:44​:08PM -0600, Karl Williamson wrote​:

On 6/4/19 4​:05 AM, Hugo van der Sanden via RT wrote​:

I do think the earlier code in parse_uniprop_string could be tightened further​: there look to be cases where we look at name[i] when we may already have reached namelen. It's possible that we can always rely on a '}' protecting us there, but it seems unwise to rely on that in the longer term.

I found one such case, fixed by the attached patch.

Which doesn't appear to have been applied yet.

From 81a6635310602f5a7564d6e7a2f6aeed04e05929 Mon Sep 17 00​:00​:00 2001
From​: Karl Williamson <khw@​cpan.org>
Date​: Thu, 27 Jun 2019 15​:39​:11 -0600
Subject​: [PATCH 5/5] regcomp.c​: Don't read off the end of buffer

Until this commit, it was possible that \p{nv=3/} would cause the right
brace to be considered part of the property name.
---
regcomp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/regcomp.c b/regcomp.c
index aa291a20d0..ab0aac0d96 100644
--- a/regcomp.c
+++ b/regcomp.c
@​@​ -23090,7 +23090,9 @​@​ Perl_parse_uniprop_string(pTHX_
}

         /\* Store the first real character in the denominator \*/

- lookup_name[j++] = name[i];
+ if (i < name_len) {
+ lookup_name[j++] = name[i];
+ }
}
}

--
2.17.1

--
Standards (n). Battle insignia or tribal totems.

[p5pRT]

From @khwilliamson

On 8/6/19 8​:02 AM, Dave Mitchell wrote​:

On Thu, Jun 27, 2019 at 03​:44​:08PM -0600, Karl Williamson wrote​:

On 6/4/19 4​:05 AM, Hugo van der Sanden via RT wrote​:

I do think the earlier code in parse_uniprop_string could be tightened further​: there look to be cases where we look at name[i] when we may already have reached namelen. It's possible that we can always rely on a '}' protecting us there, but it seems unwise to rely on that in the longer term.

I found one such case, fixed by the attached patch.

Which doesn't appear to have been applied yet.

It was applied after your email as
3153298

From 81a6635310602f5a7564d6e7a2f6aeed04e05929 Mon Sep 17 00​:00​:00 2001
From​: Karl Williamson <khw@​cpan.org>
Date​: Thu, 27 Jun 2019 15​:39​:11 -0600
Subject​: [PATCH 5/5] regcomp.c​: Don't read off the end of buffer

Until this commit, it was possible that \p{nv=3/} would cause the right
brace to be considered part of the property name.
---
regcomp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/regcomp.c b/regcomp.c
index aa291a20d0..ab0aac0d96 100644
--- a/regcomp.c
+++ b/regcomp.c
@​@​ -23090,7 +23090,9 @​@​ Perl_parse_uniprop_string(pTHX_
}

          /\* Store the first real character in the denominator \*/

- lookup_name[j++] = name[i];
+ if (i < name_len) {
+ lookup_name[j++] = name[i];
+ }
}
}

--
2.17.1

[p5pRT]

From @khwilliamson

This was fixed by
2d26cf4
--
Karl Williamson

[p5pRT]

@khwilliamson - Status changed from 'open' to 'pending release'

[p5pRT]

From @khwilliamson

On 8/6/19 8​:02 AM, Dave Mitchell wrote​:

On Thu, Jun 27, 2019 at 03​:44​:08PM -0600, Karl Williamson wrote​:

On 6/4/19 4​:05 AM, Hugo van der Sanden via RT wrote​:

I do think the earlier code in parse_uniprop_string could be tightened further​: there look to be cases where we look at name[i] when we may already have reached namelen. It's possible that we can always rely on a '}' protecting us there, but it seems unwise to rely on that in the longer term.

I found one such case, fixed by the attached patch.

Which doesn't appear to have been applied yet.

Now done

From 81a6635310602f5a7564d6e7a2f6aeed04e05929 Mon Sep 17 00​:00​:00 2001
From​: Karl Williamson <khw@​cpan.org>
Date​: Thu, 27 Jun 2019 15​:39​:11 -0600
Subject​: [PATCH 5/5] regcomp.c​: Don't read off the end of buffer

Until this commit, it was possible that \p{nv=3/} would cause the right
brace to be considered part of the property name.
---
regcomp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/regcomp.c b/regcomp.c
index aa291a20d0..ab0aac0d96 100644
--- a/regcomp.c
+++ b/regcomp.c
@​@​ -23090,7 +23090,9 @​@​ Perl_parse_uniprop_string(pTHX_
}

          /\* Store the first real character in the denominator \*/

- lookup_name[j++] = name[i];
+ if (i < name_len) {
+ lookup_name[j++] = name[i];
+ }
}
}

--
2.17.1