Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 24 Jan 2015 07:24:08 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: Assign a CVE Identifier <cve-assign@...re.org>
Subject: Re: [perl #119505] Segfault from bad backreference

Hi Kurt,

On Fri, Jan 23, 2015 at 02:38:51PM -0700, Kurt Seifried wrote:
> http://perl5.git.perl.org/perl.git/commitdiff/0c2990d652e985784f095bba4bc356481a66aa06
> 
> The code that parses regex backrefs (or ambiguous backref/octal) such as
> \123, did a simple atoi(), which could wrap round to negative values on
> long digit strings and cause seg faults.
> 
> Include a check on the length of the digit string, and if greater than 9
> digits, assume it can never be a valid backref (obviating the need for
> the atoi() call).
> 
> I've also simplified the code a bit, putting most of the \g handling
> code into a single block, rather than doing multiple "if (isg) {...}".
> 
> PoC:
> 
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776046
> perl -e '/\7777777777/'
> 
> not sure if this can be exploited at all, but someone creative maybe has
> ideas, if so this may need a CVE.

Just additional infomration: I think this was way back found already
around 2008, in opensuse-commits the following can be found:

http://marc.info/?l=opensuse-commit&m=121933719424130

then also reported in the Perl request-tracker at

https://rt.perl.org/Public/Bug/Display.html?id=119505

Regards,
Salvatore

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.