diff options
author | Andy Dougherty <doughera@lafayette.edu> | 2012-09-27 09:52:18 -0400 |
---|---|---|
committer | Ricardo Signes <rjbs@cpan.org> | 2012-10-10 08:06:46 -0400 |
commit | 5ee2604e72cdd836101f279f8f9e89243c7f0097 (patch) | |
tree | 91df6224e3ec920bd3309f501e3e2b9c1b069b81 | |
parent | a01988fd04286c08345d75858dc6bd9f0471148a (diff) | |
download | perl-5ee2604e72cdd836101f279f8f9e89243c7f0097.tar.gz |
avoid calling memset with a negative count
Poorly written perl code that allows an attacker to specify the count to
perl's 'x' string repeat operator can already cause a memory exhaustion
denial-of-service attack. A flaw in versions of perl before 5.15.5 can
escalate that into a heap buffer overrun; coupled with versions of glibc
before 2.16, it possibly allows the execution of arbitrary code.
The flaw addressed to this commit has been assigned identifier
CVE-2012-5195.
-rw-r--r-- | util.c | 3 |
1 files changed, 3 insertions, 0 deletions
@@ -3033,6 +3033,9 @@ Perl_repeatcpy(register char *to, register const char *from, I32 len, register I { PERL_ARGS_ASSERT_REPEATCPY; + if (count < 0) + Perl_croak_nocontext("%s",PL_memory_wrap); + if (len == 1) memset(to, *from, count); else if (count) { |