From 821d2fe81d89d9bc26d12a0aaae9b93edcbacd5b Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Fri, 11 Apr 2025 11:49:51 +0200 Subject: [PATCH] perl: apply patch for CVE-2024-56406 --- .../interpreters/perl/CVE-2024-56406.patch | 26 +++++++++++++++++++ .../interpreters/perl/interpreter.nix | 4 ++- 2 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 pkgs/development/interpreters/perl/CVE-2024-56406.patch diff --git a/pkgs/development/interpreters/perl/CVE-2024-56406.patch b/pkgs/development/interpreters/perl/CVE-2024-56406.patch new file mode 100644 index 000000000000..3960d17e6519 --- /dev/null +++ b/pkgs/development/interpreters/perl/CVE-2024-56406.patch @@ -0,0 +1,26 @@ +commit 385e8759c3ff1e7f7f996bd4ea391074d61d48c1 +Author: Karl Williamson +AuthorDate: 2024-12-18 18:25:29 -0700 +Commit: Steve Hay +CommitDate: 2025-03-30 11:59:51 +0100 + + CVE-2024-56406: Heap-buffer-overflow with tr// + + This was due to underallocating needed space. If the translation forces + something to become UTF-8 that is initially bytes, that UTF-8 could + now require two bytes where previously a single one would do. + + (cherry picked from commit f93109c8a6950aafbd7488d98e112552033a3686) + +diff --git a/op.c b/op.c +index 3fc23eca49a..aeee88e0335 100644 +--- a/op.c ++++ b/op.c +@@ -6649,6 +6649,7 @@ S_pmtrans(pTHX_ OP *o, OP *expr, OP *repl) + * same time. But otherwise one crosses before the other */ + if (t_cp < 256 && r_cp_end > 255 && r_cp != t_cp) { + can_force_utf8 = TRUE; ++ max_expansion = MAX(2, max_expansion); + } + } + diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix index 6fea82501c06..0c9586fe1273 100644 --- a/pkgs/development/interpreters/perl/interpreter.nix +++ b/pkgs/development/interpreters/perl/interpreter.nix @@ -71,7 +71,9 @@ stdenv.mkDerivation ( disallowedReferences = [ stdenv.cc ]; patches = - [ ] + [ + ./CVE-2024-56406.patch + ] # Do not look in /usr etc. for dependencies. ++ lib.optional ((lib.versions.majorMinor version) == "5.38") ./no-sys-dirs-5.38.0.patch ++ lib.optional ((lib.versions.majorMinor version) == "5.40") ./no-sys-dirs-5.40.0.patch