From 60c6ffd4a1b8040daf60ab2650c5b3eb46175439 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar(a)redhat.com>
Date: Fri, 20 Jan 2017 09:49:49 +0100
Subject: Fix a heap overflow with pack "W"
---
...-avoid-a-heap-buffer-overflow-with-pack-W.patch | 58 ++++++++++++++++++++++
...-fix-the-test-so-skip-has-a-SKIP-to-work-.patch | 30 +++++++++++
perl.spec | 8 +++
3 files changed, 96 insertions(+)
create mode 100644
perl-5.25.8-perl-129149-avoid-a-heap-buffer-overflow-with-pack-W.patch
create mode 100644
perl-5.25.8-perl-129149-fix-the-test-so-skip-has-a-SKIP-to-work-.patch
diff --git a/perl-5.25.8-perl-129149-avoid-a-heap-buffer-overflow-with-pack-W.patch
b/perl-5.25.8-perl-129149-avoid-a-heap-buffer-overflow-with-pack-W.patch
new file mode 100644
index 0000000..32bbc4b
--- /dev/null
+++ b/perl-5.25.8-perl-129149-avoid-a-heap-buffer-overflow-with-pack-W.patch
@@ -0,0 +1,58 @@
+From bf4a926a29374161655548b149d1cb37300bcc05 Mon Sep 17 00:00:00 2001
+From: Tony Cook <tony(a)develop-help.com>
+Date: Wed, 7 Sep 2016 16:51:39 +1000
+Subject: [PATCH] (perl #129149) avoid a heap buffer overflow with pack "W"...
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Petr Písař <ppisar(a)redhat.com>
+---
+ pp_pack.c | 2 +-
+ t/op/pack.t | 13 ++++++++++++-
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/pp_pack.c b/pp_pack.c
+index ee4c69e..737e019 100644
+--- a/pp_pack.c
++++ b/pp_pack.c
+@@ -2587,7 +2587,7 @@ S_pack_rec(pTHX_ SV *cat, tempsym_t* symptr, SV **beglist, SV
**endlist )
+ if (in_bytes) auv = auv % 0x100;
+ if (utf8) {
+ W_utf8:
+- if (cur > end) {
++ if (cur >= end) {
+ *cur = '\0';
+ SvCUR_set(cat, cur - start);
+
+diff --git a/t/op/pack.t b/t/op/pack.t
+index 3fc12e4..47d1216 100644
+--- a/t/op/pack.t
++++ b/t/op/pack.t
+@@ -12,7 +12,7 @@ my $no_endianness = $] > 5.009 ? '' :
+ my $no_signedness = $] > 5.009 ? '' :
+ "Signed/unsigned pack modifiers not available on this perl";
+
+-plan tests => 14712;
++plan tests => 14713;
+
+ use strict;
+ use warnings qw(FATAL all);
+@@ -2047,3 +2047,14 @@ ok(1, "argument underflow did not crash");
+ is(pack("H40", $up_nul), $twenty_nuls,
+ "check pack H zero fills (utf8 source)");
+ }
++
++{
++ # [perl #129149] the code below would write one past the end of the output
++ # buffer, only detected by ASAN, not by valgrind
++ $Config{ivsize} >= 8
++ or skip "[perl #129149] need 64-bit for this test", 1;
++ fresh_perl_is(<<'EOS', "ok\n", { stderr => 1 },
"pack W overflow");
++print pack("ucW", "0000", 0, 140737488355327) eq
"\$,#`P,```\n\0\x{7fffffffffff}"
++ ? "ok\n" : "not ok\n";
++EOS
++}
+--
+2.7.4
+
diff --git a/perl-5.25.8-perl-129149-fix-the-test-so-skip-has-a-SKIP-to-work-.patch
b/perl-5.25.8-perl-129149-fix-the-test-so-skip-has-a-SKIP-to-work-.patch
new file mode 100644
index 0000000..530b65d
--- /dev/null
+++ b/perl-5.25.8-perl-129149-fix-the-test-so-skip-has-a-SKIP-to-work-.patch
@@ -0,0 +1,30 @@
+From 30be69c851a7fa7e29d85c9b6e070273df82f3e7 Mon Sep 17 00:00:00 2001
+From: Tony Cook <tony(a)develop-help.com>
+Date: Tue, 17 Jan 2017 15:36:31 +1100
+Subject: [PATCH] (perl #129149) fix the test so skip has a SKIP: to work with
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Thanks to bulk88 for pointing this out.
+
+Signed-off-by: Petr Písař <ppisar(a)redhat.com>
+---
+ t/op/pack.t | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/t/op/pack.t b/t/op/pack.t
+index 47d1216..919e4c5 100644
+--- a/t/op/pack.t
++++ b/t/op/pack.t
+@@ -2048,6 +2048,7 @@ ok(1, "argument underflow did not crash");
+ "check pack H zero fills (utf8 source)");
+ }
+
++SKIP:
+ {
+ # [perl #129149] the code below would write one past the end of the output
+ # buffer, only detected by ASAN, not by valgrind
+--
+2.7.4
+
diff --git a/perl.spec b/perl.spec
index eb898d0..16d81e9 100644
--- a/perl.spec
+++ b/perl.spec
@@ -159,6 +159,10 @@ Patch53:
perl-5.22.2-perl-130307-Correctly-unwind-on-cache-hit.patch
# in upstream after 5.25.8
Patch54: perl-5.24.1-perl-130262-split-scalar-context-stack-overflow-fix.patch
+# Fix a heap overflow with pack "W", RT129149, in upstream after 5.25.8
+Patch55: perl-5.25.8-perl-129149-avoid-a-heap-buffer-overflow-with-pack-W.patch
+Patch56: perl-5.25.8-perl-129149-fix-the-test-so-skip-has-a-SKIP-to-work-.patch
+
# Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
@@ -2455,6 +2459,8 @@ Perl extension for Version Objects
%patch52 -p1
%patch53 -p1
%patch54 -p1
+%patch55 -p1
+%patch56 -p1
%patch200 -p1
%patch201 -p1
@@ -2498,6 +2504,7 @@ perl -x patchlevel.h \
'Fedora Patch52: Fix a memory leak in IO::Poll (RT#129788)' \
'Fedora Patch53: Fix regular expression matching (RT#130307)' \
'Fedora Patch54: Fix a buffer overflow in split in scalar context
(RT#130262)' \
+ 'Fedora Patch55: Fix a heap overflow with pack "W" (RT129149)' \
'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux'
\
'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
%{nil}
@@ -4752,6 +4759,7 @@ popd
%changelog
* Fri Jan 20 2017 Petr Pisar <ppisar(a)redhat.com> - 4:5.22.3-367
- Fix a buffer overflow in split in scalar context (RT#130262)
+- Fix a heap overflow with pack "W" (RT129149)
* Mon Jan 16 2017 Jitka Plesnikova <jplesnik(a)redhat.com> - 4:5.22.3-366
- 5.22.3 bump (see <
http://search.cpan.org/dist/perl-5.22.3/pod/perldelta.pod>
--
cgit v0.12
http://pkgs.fedoraproject.org/cgit/perl.git/commit/?h=f24&id=60c6ffd4...