diff --git a/SOURCES/perl-5.30.1-study_chunk-avoid-mutating-regexp-program-within-GOS.patch b/SOURCES/perl-5.30.1-study_chunk-avoid-mutating-regexp-program-within-GOS.patch deleted file mode 100644 index 70e5ed0..0000000 --- a/SOURCES/perl-5.30.1-study_chunk-avoid-mutating-regexp-program-within-GOS.patch +++ /dev/null @@ -1,306 +0,0 @@ -From 783ddef8fc74b00cde72898c2c3228853dc82d91 Mon Sep 17 00:00:00 2001 -From: Hugo van der Sanden -Date: Sat, 11 Apr 2020 14:10:24 +0100 -Subject: [PATCH] study_chunk: avoid mutating regexp program within GOSUB -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -gh16947 and gh17743: studying GOSUB may restudy in an inner call -(via a mix of recursion and enframing) something that an outer call -is in the middle of looking at. Let the outer frame deal with it. - -(CVE-2020-12723) - -(cherry picked from commit c4033e740bd18d9fbe3456a9db2ec2053cdc5271) -Petr Písař: Ported to 5.30.1 from -66bbb51b93253a3f87d11c2695cfb7bdb782184a. -Signed-off-by: Petr Písař ---- - embed.fnc | 2 +- - embed.h | 2 +- - proto.h | 2 +- - regcomp.c | 54 +++++++++++++++++++++++++++++++++++------------------- - t/re/pat.t | 26 +++++++++++++++++++++++++- - 5 files changed, 63 insertions(+), 23 deletions(-) - -diff --git a/embed.fnc b/embed.fnc -index 1b9cf54..d0463e4 100644 ---- a/embed.fnc -+++ b/embed.fnc -@@ -2482,7 +2482,7 @@ Es |SSize_t|study_chunk |NN RExC_state_t *pRExC_state \ - |NULLOK struct scan_data_t *data \ - |I32 stopparen|U32 recursed_depth \ - |NULLOK regnode_ssc *and_withp \ -- |U32 flags|U32 depth -+ |U32 flags|U32 depth|bool was_mutate_ok - Es |void |rck_elide_nothing|NN regnode *node - EsR |SV * |get_ANYOFM_contents|NN const regnode * n - EsRn |U32 |add_data |NN RExC_state_t* const pRExC_state \ -diff --git a/embed.h b/embed.h -index cf44011..72c2a8e 100644 ---- a/embed.h -+++ b/embed.h -@@ -1239,7 +1239,7 @@ - #define ssc_is_cp_posixl_init S_ssc_is_cp_posixl_init - #define ssc_or(a,b,c) S_ssc_or(aTHX_ a,b,c) - #define ssc_union(a,b,c) S_ssc_union(aTHX_ a,b,c) --#define study_chunk(a,b,c,d,e,f,g,h,i,j,k) S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k) -+#define study_chunk(a,b,c,d,e,f,g,h,i,j,k,l) S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k,l) - # endif - # if defined(PERL_IN_REGCOMP_C) || defined (PERL_IN_DUMP_C) - #define _invlist_dump(a,b,c,d) Perl__invlist_dump(aTHX_ a,b,c,d) -diff --git a/proto.h b/proto.h -index ee74153..9a3ce27 100644 ---- a/proto.h -+++ b/proto.h -@@ -5671,7 +5671,7 @@ PERL_STATIC_INLINE void S_ssc_union(pTHX_ regnode_ssc *ssc, SV* const invlist, c - #define PERL_ARGS_ASSERT_SSC_UNION \ - assert(ssc); assert(invlist) - #endif --STATIC SSize_t S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth); -+STATIC SSize_t S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth, bool was_mutate_ok); - #define PERL_ARGS_ASSERT_STUDY_CHUNK \ - assert(pRExC_state); assert(scanp); assert(minlenp); assert(deltap); assert(last) - #endif -diff --git a/regcomp.c b/regcomp.c -index b101752..b9ea2a0 100644 ---- a/regcomp.c -+++ b/regcomp.c -@@ -106,6 +106,7 @@ typedef struct scan_frame { - regnode *next_regnode; /* next node to process when last is reached */ - U32 prev_recursed_depth; - I32 stopparen; /* what stopparen do we use */ -+ bool in_gosub; /* this or an outer frame is for GOSUB */ - - struct scan_frame *this_prev_frame; /* this previous frame */ - struct scan_frame *prev_frame; /* previous frame */ -@@ -4475,7 +4476,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - I32 stopparen, - U32 recursed_depth, - regnode_ssc *and_withp, -- U32 flags, U32 depth) -+ U32 flags, U32 depth, bool was_mutate_ok) - /* scanp: Start here (read-write). */ - /* deltap: Write maxlen-minlen here. */ - /* last: Stop before this one. */ -@@ -4554,6 +4555,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - node length to get a real minimum (because - the folded version may be shorter) */ - bool unfolded_multi_char = FALSE; -+ /* avoid mutating ops if we are anywhere within the recursed or -+ * enframed handling for a GOSUB: the outermost level will handle it. -+ */ -+ bool mutate_ok = was_mutate_ok && !(frame && frame->in_gosub); - /* Peephole optimizer: */ - DEBUG_STUDYDATA("Peep", data, depth, is_inf); - DEBUG_PEEP("Peep", scan, depth, flags); -@@ -4564,7 +4569,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - * parsing code, as each (?:..) is handled by a different invocation of - * reg() -- Yves - */ -- JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0); -+ if (mutate_ok) -+ JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0); - - /* Follow the next-chain of the current node and optimize - away all the NOTHINGs from it. -@@ -4596,7 +4602,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - /* DEFINEP study_chunk() recursion */ - (void)study_chunk(pRExC_state, &scan, &minlen, - &deltanext, next, &data_fake, stopparen, -- recursed_depth, NULL, f, depth+1); -+ recursed_depth, NULL, f, depth+1, mutate_ok); - - scan = next; - } else -@@ -4664,7 +4670,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - /* recurse study_chunk() for each BRANCH in an alternation */ - minnext = study_chunk(pRExC_state, &scan, minlenp, - &deltanext, next, &data_fake, stopparen, -- recursed_depth, NULL, f, depth+1); -+ recursed_depth, NULL, f, depth+1, -+ mutate_ok); - - if (min1 > minnext) - min1 = minnext; -@@ -4731,9 +4738,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - } - } - -- if (PERL_ENABLE_TRIE_OPTIMISATION && -- OP( startbranch ) == BRANCH ) -- { -+ if (PERL_ENABLE_TRIE_OPTIMISATION -+ && OP(startbranch) == BRANCH -+ && mutate_ok -+ ) { - /* demq. - - Assuming this was/is a branch we are dealing with: 'scan' -@@ -5188,6 +5196,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - newframe->stopparen = stopparen; - newframe->prev_recursed_depth = recursed_depth; - newframe->this_prev_frame= frame; -+ newframe->in_gosub = ( -+ (frame && frame->in_gosub) || OP(scan) == GOSUB -+ ); - - DEBUG_STUDYDATA("frame-new", data, depth, is_inf); - DEBUG_PEEP("fnew", scan, depth, flags); -@@ -5345,7 +5356,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - - /* This temporary node can now be turned into EXACTFU, and - * must, as regexec.c doesn't handle it */ -- if (OP(next) == EXACTFU_S_EDGE) { -+ if (OP(next) == EXACTFU_S_EDGE && mutate_ok) { - OP(next) = EXACTFU; - } - -@@ -5353,8 +5364,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - && isALPHA_A(* STRING(next)) - && ( OP(next) == EXACTFAA - || ( OP(next) == EXACTFU -- && ! HAS_NONLATIN1_SIMPLE_FOLD_CLOSURE(* STRING(next))))) -- { -+ && ! HAS_NONLATIN1_SIMPLE_FOLD_CLOSURE(* STRING(next)))) -+ && mutate_ok -+ ) { - /* These differ in just one bit */ - U8 mask = ~ ('A' ^ 'a'); - -@@ -5441,7 +5453,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - (mincount == 0 - ? (f & ~SCF_DO_SUBSTR) - : f) -- ,depth+1); -+ , depth+1, mutate_ok); - - if (flags & SCF_DO_STCLASS) - data->start_class = oclass; -@@ -5507,7 +5519,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - if ( OP(oscan) == CURLYX && data - && data->flags & SF_IN_PAR - && !(data->flags & SF_HAS_EVAL) -- && !deltanext && minnext == 1 ) { -+ && !deltanext && minnext == 1 -+ && mutate_ok -+ ) { - /* Try to optimize to CURLYN. */ - regnode *nxt = NEXTOPER(oscan) + EXTRA_STEP_2ARGS; - regnode * const nxt1 = nxt; -@@ -5557,10 +5571,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - && !(data->flags & SF_HAS_EVAL) - && !deltanext /* atom is fixed width */ - && minnext != 0 /* CURLYM can't handle zero width */ -- - /* Nor characters whose fold at run-time may be - * multi-character */ - && ! (RExC_seen & REG_UNFOLDED_MULTI_SEEN) -+ && mutate_ok - ) { - /* XXXX How to optimize if data == 0? */ - /* Optimize to a simpler form. */ -@@ -5613,7 +5627,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - /* recurse study_chunk() on optimised CURLYX => CURLYM */ - study_chunk(pRExC_state, &nxt1, minlenp, &deltanext, nxt, - NULL, stopparen, recursed_depth, NULL, 0, -- depth+1); -+ depth+1, mutate_ok); - } - else - oscan->flags = 0; -@@ -6018,7 +6032,8 @@ Perl_re_printf( aTHX_ "LHS=%" UVuf " RHS=%" UVuf "\n", - /* recurse study_chunk() for lookahead body */ - minnext = study_chunk(pRExC_state, &nscan, minlenp, &deltanext, - last, &data_fake, stopparen, -- recursed_depth, NULL, f, depth+1); -+ recursed_depth, NULL, f, depth+1, -+ mutate_ok); - if (scan->flags) { - if ( deltanext < 0 - || deltanext > (I32) U8_MAX -@@ -6123,7 +6138,7 @@ Perl_re_printf( aTHX_ "LHS=%" UVuf " RHS=%" UVuf "\n", - *minnextp = study_chunk(pRExC_state, &nscan, minnextp, - &deltanext, last, &data_fake, - stopparen, recursed_depth, NULL, -- f, depth+1); -+ f, depth+1, mutate_ok); - if (scan->flags) { - assert(0); /* This code has never been tested since this - is normally not compiled */ -@@ -6291,7 +6306,8 @@ Perl_re_printf( aTHX_ "LHS=%" UVuf " RHS=%" UVuf "\n", - /* optimise study_chunk() for TRIE */ - minnext = study_chunk(pRExC_state, &scan, minlenp, - &deltanext, (regnode *)nextbranch, &data_fake, -- stopparen, recursed_depth, NULL, f, depth+1); -+ stopparen, recursed_depth, NULL, f, depth+1, -+ mutate_ok); - } - if (nextbranch && PL_regkind[OP(nextbranch)]==BRANCH) - nextbranch= regnext((regnode*)nextbranch); -@@ -8084,7 +8100,7 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count, - &data, -1, 0, NULL, - SCF_DO_SUBSTR | SCF_WHILEM_VISITED_POS | stclass_flag - | (restudied ? SCF_TRIE_DOING_RESTUDY : 0), -- 0); -+ 0, TRUE); - - - CHECK_RESTUDY_GOTO_butfirst(LEAVE_with_name("study_chunk")); -@@ -8213,7 +8229,7 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count, - SCF_DO_STCLASS_AND|SCF_WHILEM_VISITED_POS|(restudied - ? SCF_TRIE_DOING_RESTUDY - : 0), -- 0); -+ 0, TRUE); - - CHECK_RESTUDY_GOTO_butfirst(NOOP); - -diff --git a/t/re/pat.t b/t/re/pat.t -index 6a868f4..ba89a58 100644 ---- a/t/re/pat.t -+++ b/t/re/pat.t -@@ -25,7 +25,7 @@ BEGIN { - skip_all('no re module') unless defined &DynaLoader::boot_DynaLoader; - skip_all_without_unicode_tables(); - --plan tests => 864; # Update this when adding/deleting tests. -+plan tests => 868; # Update this when adding/deleting tests. - - run_tests() unless caller; - -@@ -2115,6 +2115,30 @@ x{0c!}\;\;îçÿ /0f/!F/;îçÿù\Qxÿÿÿÿù`x{0c!};ù\Q - like(runperl(prog => "$s", stderr => 1), qr/Unmatched \(/); - } - -+ # gh16947: test regexp corruption (GOSUB) -+ { -+ fresh_perl_is(q{ -+ 'xy' =~ /x(?0)|x(?|y|y)/ && print 'ok' -+ }, 'ok', {}, 'gh16947: test regexp corruption (GOSUB)'); -+ } -+ # gh16947: test fix doesn't break SUSPEND -+ { -+ fresh_perl_is(q{ 'sx' =~ m{ss++}i; print 'ok' }, -+ 'ok', {}, "gh16947: test fix doesn't break SUSPEND"); -+ } -+ -+ # gh17743: more regexp corruption via GOSUB -+ { -+ fresh_perl_is(q{ -+ "0" =~ /((0(?0)|000(?|0000|0000)(?0))|)/; print "ok" -+ }, 'ok', {}, 'gh17743: test regexp corruption (1)'); -+ -+ fresh_perl_is(q{ -+ "000000000000" =~ /(0(())(0((?0)())|000(?|\x{ef}\x{bf}\x{bd}|\x{ef}\x{bf}\x{bd}))|)/; -+ print "ok" -+ }, 'ok', {}, 'gh17743: test regexp corruption (2)'); -+ } -+ - } # End of sub run_tests - - 1; --- -2.25.4 - diff --git a/SOURCES/perl-5.30.2-regcomp-use-long-jumps-if-there-is-any-possibility-o.patch b/SOURCES/perl-5.30.2-regcomp-use-long-jumps-if-there-is-any-possibility-o.patch deleted file mode 100644 index c14c0fd..0000000 --- a/SOURCES/perl-5.30.2-regcomp-use-long-jumps-if-there-is-any-possibility-o.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 3295b48defa0f8570114877b063fe546dd348b3c Mon Sep 17 00:00:00 2001 -From: Karl Williamson -Date: Thu, 20 Feb 2020 17:49:36 +0000 -Subject: [PATCH 2/2] regcomp: use long jumps if there is any possibility of - overflow -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -(CVE-2020-10878) Be conservative for backporting, we'll aim to do -something more aggressive for bleadperl. - -(cherry picked from commit 9d7759db46f3b31b1d3f79c44266b6ba42a47fc6) -Signed-off-by: Petr Písař ---- - regcomp.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/regcomp.c b/regcomp.c -index 4ba2980db6..73c35a6702 100644 ---- a/regcomp.c -+++ b/regcomp.c -@@ -7762,6 +7762,13 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count, - - /* We have that number in RExC_npar */ - RExC_total_parens = RExC_npar; -+ -+ /* XXX For backporting, use long jumps if there is any possibility of -+ * overflow */ -+ if (RExC_size > U16_MAX && ! RExC_use_BRANCHJ) { -+ RExC_use_BRANCHJ = TRUE; -+ flags |= RESTART_PARSE; -+ } - } - else if (! MUST_RESTART(flags)) { - ReREFCNT_dec(Rx); --- -2.25.4 - diff --git a/SOURCES/perl-5.30.2-regcomp.c-Prevent-integer-overflow-from-nested-regex.patch b/SOURCES/perl-5.30.2-regcomp.c-Prevent-integer-overflow-from-nested-regex.patch deleted file mode 100644 index 7601973..0000000 --- a/SOURCES/perl-5.30.2-regcomp.c-Prevent-integer-overflow-from-nested-regex.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 897d1f7fd515b828e4b198d8b8bef76c6faf03ed Mon Sep 17 00:00:00 2001 -From: John Lightsey -Date: Wed, 20 Nov 2019 20:02:45 -0600 -Subject: [PATCH] regcomp.c: Prevent integer overflow from nested regex - quantifiers. -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -(CVE-2020-10543) On 32bit systems the size calculations for nested regular -expression quantifiers could overflow causing heap memory corruption. - -Fixes: Perl/perl5-security#125 -(cherry picked from commit bfd31397db5dc1a5c5d3e0a1f753a4f89a736e71) -Signed-off-by: Petr Písař ---- - regcomp.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/regcomp.c b/regcomp.c -index 93c8d98fbb..5f86be8086 100644 ---- a/regcomp.c -+++ b/regcomp.c -@@ -5489,6 +5489,12 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - RExC_precomp))); - } - -+ if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext ) -+ || min >= SSize_t_MAX - minnext * mincount ) -+ { -+ FAIL("Regexp out of space"); -+ } -+ - min += minnext * mincount; - is_inf_internal |= deltanext == SSize_t_MAX - || (maxcount == REG_INFTY && minnext + deltanext > 0); --- -2.25.4 - diff --git a/SOURCES/perl-5.30.2-study_chunk-extract-rck_elide_nothing.patch b/SOURCES/perl-5.30.2-study_chunk-extract-rck_elide_nothing.patch deleted file mode 100644 index 2a60d73..0000000 --- a/SOURCES/perl-5.30.2-study_chunk-extract-rck_elide_nothing.patch +++ /dev/null @@ -1,155 +0,0 @@ -From 0a320d753fe7fca03df259a4dfd8e641e51edaa8 Mon Sep 17 00:00:00 2001 -From: Hugo van der Sanden -Date: Tue, 18 Feb 2020 13:51:16 +0000 -Subject: [PATCH 1/2] study_chunk: extract rck_elide_nothing -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -(CVE-2020-10878) - -(cherry picked from commit 93dee06613d4e1428fb10905ce1c3c96f53113dc) -Signed-off-by: Petr Písař ---- - embed.fnc | 1 + - embed.h | 1 + - proto.h | 3 +++ - regcomp.c | 70 ++++++++++++++++++++++++++++++++++--------------------- - 4 files changed, 48 insertions(+), 27 deletions(-) - -diff --git a/embed.fnc b/embed.fnc -index aedb4baef1..d7cd04d3fc 100644 ---- a/embed.fnc -+++ b/embed.fnc -@@ -2481,6 +2481,7 @@ Es |SSize_t|study_chunk |NN RExC_state_t *pRExC_state \ - |I32 stopparen|U32 recursed_depth \ - |NULLOK regnode_ssc *and_withp \ - |U32 flags|U32 depth -+Es |void |rck_elide_nothing|NN regnode *node - EsR |SV * |get_ANYOFM_contents|NN const regnode * n - EsRn |U32 |add_data |NN RExC_state_t* const pRExC_state \ - |NN const char* const s|const U32 n -diff --git a/embed.h b/embed.h -index 75c91f77f4..356a8b98d9 100644 ---- a/embed.h -+++ b/embed.h -@@ -1208,6 +1208,7 @@ - #define parse_lparen_question_flags(a) S_parse_lparen_question_flags(aTHX_ a) - #define parse_uniprop_string(a,b,c,d,e,f,g,h,i) Perl_parse_uniprop_string(aTHX_ a,b,c,d,e,f,g,h,i) - #define populate_ANYOF_from_invlist(a,b) S_populate_ANYOF_from_invlist(aTHX_ a,b) -+#define rck_elide_nothing(a) S_rck_elide_nothing(aTHX_ a) - #define reg(a,b,c,d) S_reg(aTHX_ a,b,c,d) - #define reg2Lanode(a,b,c,d) S_reg2Lanode(aTHX_ a,b,c,d) - #define reg_node(a,b) S_reg_node(aTHX_ a,b) -diff --git a/proto.h b/proto.h -index 141ddbaee6..f316fe134e 100644 ---- a/proto.h -+++ b/proto.h -@@ -5543,6 +5543,9 @@ PERL_CALLCONV SV * Perl_parse_uniprop_string(pTHX_ const char * const name, cons - STATIC void S_populate_ANYOF_from_invlist(pTHX_ regnode *node, SV** invlist_ptr); - #define PERL_ARGS_ASSERT_POPULATE_ANYOF_FROM_INVLIST \ - assert(node); assert(invlist_ptr) -+STATIC void S_rck_elide_nothing(pTHX_ regnode *node); -+#define PERL_ARGS_ASSERT_RCK_ELIDE_NOTHING \ -+ assert(node) - PERL_STATIC_NO_RET void S_re_croak2(pTHX_ bool utf8, const char* pat1, const char* pat2, ...) - __attribute__noreturn__; - #define PERL_ARGS_ASSERT_RE_CROAK2 \ -diff --git a/regcomp.c b/regcomp.c -index 5f86be8086..4ba2980db6 100644 ---- a/regcomp.c -+++ b/regcomp.c -@@ -4450,6 +4450,44 @@ S_unwind_scan_frames(pTHX_ const void *p) - } while (f); - } - -+/* Follow the next-chain of the current node and optimize away -+ all the NOTHINGs from it. -+ */ -+STATIC void -+S_rck_elide_nothing(pTHX_ regnode *node) -+{ -+ dVAR; -+ -+ PERL_ARGS_ASSERT_RCK_ELIDE_NOTHING; -+ -+ if (OP(node) != CURLYX) { -+ const int max = (reg_off_by_arg[OP(node)] -+ ? I32_MAX -+ /* I32 may be smaller than U16 on CRAYs! */ -+ : (I32_MAX < U16_MAX ? I32_MAX : U16_MAX)); -+ int off = (reg_off_by_arg[OP(node)] ? ARG(node) : NEXT_OFF(node)); -+ int noff; -+ regnode *n = node; -+ -+ /* Skip NOTHING and LONGJMP. */ -+ while ( -+ (n = regnext(n)) -+ && ( -+ (PL_regkind[OP(n)] == NOTHING && (noff = NEXT_OFF(n))) -+ || ((OP(n) == LONGJMP) && (noff = ARG(n))) -+ ) -+ && off + noff < max -+ ) { -+ off += noff; -+ } -+ if (reg_off_by_arg[OP(node)]) -+ ARG(node) = off; -+ else -+ NEXT_OFF(node) = off; -+ } -+ return; -+} -+ - /* the return from this sub is the minimum length that could possibly match */ - STATIC SSize_t - S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, -@@ -4550,28 +4588,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, - */ - JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0); - -- /* Follow the next-chain of the current node and optimize -- away all the NOTHINGs from it. */ -- if (OP(scan) != CURLYX) { -- const int max = (reg_off_by_arg[OP(scan)] -- ? I32_MAX -- /* I32 may be smaller than U16 on CRAYs! */ -- : (I32_MAX < U16_MAX ? I32_MAX : U16_MAX)); -- int off = (reg_off_by_arg[OP(scan)] ? ARG(scan) : NEXT_OFF(scan)); -- int noff; -- regnode *n = scan; -- -- /* Skip NOTHING and LONGJMP. */ -- while ((n = regnext(n)) -- && ((PL_regkind[OP(n)] == NOTHING && (noff = NEXT_OFF(n))) -- || ((OP(n) == LONGJMP) && (noff = ARG(n)))) -- && off + noff < max) -- off += noff; -- if (reg_off_by_arg[OP(scan)]) -- ARG(scan) = off; -- else -- NEXT_OFF(scan) = off; -- } -+ /* Follow the next-chain of the current node and optimize -+ away all the NOTHINGs from it. -+ */ -+ rck_elide_nothing(scan); - - /* The principal pseudo-switch. Cannot be a switch, since we - look into several different things. */ -@@ -5745,11 +5765,7 @@ Perl_re_printf( aTHX_ "LHS=%" UVuf " RHS=%" UVuf "\n", - if (data && (fl & SF_HAS_EVAL)) - data->flags |= SF_HAS_EVAL; - optimize_curly_tail: -- if (OP(oscan) != CURLYX) { -- while (PL_regkind[OP(next = regnext(oscan))] == NOTHING -- && NEXT_OFF(next)) -- NEXT_OFF(oscan) += NEXT_OFF(next); -- } -+ rck_elide_nothing(oscan); - continue; - - default: --- -2.25.4 - diff --git a/SPECS/perl.spec b/SPECS/perl.spec index 9631b08..1199dad 100644 --- a/SPECS/perl.spec +++ b/SPECS/perl.spec @@ -85,7 +85,7 @@ License: GPL+ or Artistic Epoch: %{perl_epoch} Version: %{perl_version} # release number must be even higher, because dual-lived modules will be broken otherwise -Release: 452%{?dist} +Release: 450%{?dist} Summary: Practical Extraction and Report Language Url: https://www.perl.org/ Source0: https://www.cpan.org/src/5.0/perl-%{perl_version}.tar.xz @@ -296,19 +296,6 @@ Patch72: perl-5.31.5-Adapt-Configure-to-GCC-version-10.patch # GH#17218, in upsream after 5.31.5 Patch73: perl-5.31.5-PATCH-gh-17218-memory-leak.patch -# Fix CVE-2020-10543 (an integer overflow from nested regex quantifiers), -# bug #1837975, in upstream 5.30.3 -Patch74: perl-5.30.2-regcomp.c-Prevent-integer-overflow-from-nested-regex.patch - -# Fix CVE-2020-10878 (a corruption of a state of a compiled regular expression -# due to an integer overflow), bug #1837988, in upstream 5.30.3 -Patch75: perl-5.30.2-study_chunk-extract-rck_elide_nothing.patch -Patch76: perl-5.30.2-regcomp-use-long-jumps-if-there-is-any-possibility-o.patch - -# Fix CVE-2020-12723 (a corruption of a state of a compiled regular expression -# due to recursive calls), bug #1838000, in upstream 5.30.3 -Patch77: perl-5.30.1-study_chunk-avoid-mutating-regexp-program-within-GOS.patch - # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048 Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch @@ -539,8 +526,6 @@ Provides: perl(unicore::Name) Provides: perl(utf8_heavy.pl) # utf8 and utf8_heavy.pl require Carp, re, strict, warnings, XSLoader Requires: perl(Carp) -# Encode is loaded in BOOT section of PerlIO::encoding -Requires: perl(Encode) Requires: perl(Exporter) # Term::Cap is optional Requires: perl(XSLoader) @@ -2905,10 +2890,6 @@ rm -rf .git # Perl tests examine a git repository %patch71 -p1 %patch72 -p1 %patch73 -p1 -%patch74 -p1 -%patch75 -p1 -%patch76 -p1 -%patch77 -p1 %patch200 -p1 %patch201 -p1 @@ -2977,10 +2958,6 @@ perl -x patchlevel.h \ 'Fedora Patch71: Fix a buffer overread when parsing a number (GH#17279)' \ 'Fedora Patch72: Fix GCC 10 version detection (GH#17295)' \ 'Fedora Patch73: Fix a memory leak when compiling a regular expression with a non-word class (GH#17218)' \ - 'Fedora Patch74: Fix CVE-2020-10543 (an integer overflow from nested regex quantifiers)' \ - 'Fedora Patch75: Fix CVE-2020-10878 (a corruption of a state of a compiled regular expression due to an integer overflow)' \ - 'Fedora Patch76: Fix CVE-2020-10878 (a corruption of a state of a compiled regular expression due to an integer overflow)' \ - 'Fedora Patch77: Fix CVE-2020-12723 (a corruption of a state of a compiled regular expression due to recursive calls)' \ 'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \ 'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \ %{nil} @@ -5226,20 +5203,9 @@ popd # Old changelog entries are preserved in CVS. %changelog -* Sun Dec 10 2023 MSVSphere Packaging Team - 4:5.30.1-452 +* Sun Dec 10 2023 MSVSphere Packaging Team - 4:5.30.1-450 - Rebuilt for MSVSphere 8.8 -* Thu Dec 03 2020 Jitka Plesnikova - 4:5.30.1-452 -- Run-require perl(Encode) by perl-libs (bug #1903631) - -* Fri Jun 05 2020 Petr Pisar - 4:5.30.1-451 -- Fix CVE-2020-10543 (an integer overflow from nested regex quantifiers) - (bug #1837975) -- Fix CVE-2020-10878 (a corruption of a state of a compiled regular expression - due to an integer overflow) (bug #1837988) -- Fix CVE-2020-12723 (a corruption of a state of a compiled regular expression - due to recursive calls) (bug #1838000) - * Fri Mar 13 2020 Petr Pisar - 4:5.30.1-450 - Fix shebangs (bug #1813199)