This patch applies the upstream fix as referenced in [1], using the commit shown in [2].
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-13221 [2] https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7 Signed-off-by: Jaipaul Cheernam <[email protected]> --- .../perl/files/CVE-2026-13221.patch | 75 +++++++++++++++++++ meta/recipes-devtools/perl/perl_5.38.4.bb | 1 + 2 files changed, 76 insertions(+) create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-13221.patch diff --git a/meta/recipes-devtools/perl/files/CVE-2026-13221.patch b/meta/recipes-devtools/perl/files/CVE-2026-13221.patch new file mode 100644 index 0000000000..03396f3e43 --- /dev/null +++ b/meta/recipes-devtools/perl/files/CVE-2026-13221.patch @@ -0,0 +1,75 @@ +From 03f74bbbd3a68350d926ee93d56ee4808c28c4c7 Mon Sep 17 00:00:00 2001 +From: Karl Williamson <[email protected]> +Date: Thu, 26 Mar 2026 10:13:49 -0600 +Subject: [PATCH] regcomp_study: Don't create a trie that would overflow + +This addresses GH #23388 + +The design of the trie compiling code is to batch extra long tries into +smaller chunks that fit into whatever limitations there are. However, +this ticket shows that that isn't always being done. + +In this case, a bunch of branches that have TAIL operands can be +combined together, and the final TAIL is used. And the code requires +that the delta between the first branch and this final TAIL fit into a +16-bit field. That is the root cause of this bug. + +I'm not familiar enough with the trie construction code to easily +understand why the final tail needs to be used here. So this patch +simply doesn't optimize a sequence of branches into a trie that would +overflow. + +This could be revisited by someone who knows more about this than I, or +earlier in the development cycle. + +CVE: CVE-2026-13221 +Upstream-Status: Backport [https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7] +Signed-off-by: Jaipaul Cheernam <[email protected]> +--- + regcomp_study.c | 10 ++++++++++ + t/re/pat_advanced.t | 9 +++++++++ + 2 files changed, 19 insertions(+) + +diff --git a/regcomp_study.c b/regcomp_study.c +index db7ab3a409..a1b2c3d4e5 100644 +--- a/regcomp_study.c ++++ b/regcomp_study.c +@@ -1933,6 +1933,16 @@ Perl_study_chunk(pTHX_ + tail = regnext( tail ); + } + ++ /* The code below currently saves the difference from ++ * start to finish in a 16-bit field, causing ++ * GH #23388. This defeats the design of batching ++ * tries into chunks that each fit. khw thinks it is ++ * too late in the 5.44 cycle to relook at the design, ++ * so for now anyway, don't make a trie that would ++ * overflow */ ++ if (tail - startbranch >= U16_MAX) { ++ continue; ++ } + + DEBUG_TRIE_COMPILE_r({ + regprop(RExC_rx, RExC_mysv, tail, NULL, pRExC_state); +diff --git a/t/re/pat_advanced.t b/t/re/pat_advanced.t +index 398680838d..c9e389ecb3 100644 +--- a/t/re/pat_advanced.t ++++ b/t/re/pat_advanced.t +@@ -4898,6 +4898,15 @@ EOF_DEBUG_OUT + $x =~ s/^[\x{0301}\x{030C}]+//; + } + ++ { # GH #23388 ++ fresh_perl_is(<<~'PROG', , "", {}, "Avoid trie overflow"); ++ my $x = join "|", "aaa".."mzz"; ++ my $y = join "|", "naa".."zzz"; ++ use re 'Debug'; ++ "fnord" =~ m/(?:$x)|(?:$y)/; ++ PROG ++ } ++ + + # !!! NOTE that tests that aren't at all likely to crash perl should go + # a ways above, above these last ones. There's a comment there that, like +-- +2.43.0 diff --git a/meta/recipes-devtools/perl/perl_5.38.4.bb b/meta/recipes-devtools/perl/perl_5.38.4.bb index 9f4cc1c404..8dccd34499 100644 --- a/meta/recipes-devtools/perl/perl_5.38.4.bb +++ b/meta/recipes-devtools/perl/perl_5.38.4.bb @@ -20,6 +20,7 @@ SRC_URI = "https://www.cpan.org/src/5.0/perl-${PV}.tar.gz;name=perl \ file://0001-Fix-intermittent-failure-of-test-t-op-sigsystem.t.patch \ file://CVE-2026-8376-01.patch \ file://CVE-2026-8376-02.patch \ + file://CVE-2026-13221.patch \ " SRC_URI:append:class-native = " \ file://perl-configpm-switch.patch \
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241526): https://lists.openembedded.org/g/openembedded-core/message/241526 Mute This Topic: https://lists.openembedded.org/mt/120376718/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
