From 40b3cdad3649334585cee8f4630ec9a025e62be6 Mon Sep 17 00:00:00 2001 From: Karl Williamson Date: Fri, 25 Aug 2017 11:33:58 -0600 Subject: [PATCH] PATCH: [perl #131598] The cause of this is that the vFAIL macro uses RExC_parse, and that variable has just been changed in preparation for code after the vFAIL. The solution is to not change RExC_parse until after the vFAIL. This is a case where the macro hides stuff that can bite you. (cherry picked from commit 2be4edede4ae226e2eebd4eff28cedd2041f300f) Upstream-Status: Backport CVE: CVE-2017-12833 Signed-off-by: Armin Kuster --- regcomp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) Index: perl-5.24.1/regcomp.c =================================================================== --- perl-5.24.1.orig/regcomp.c +++ perl-5.24.1/regcomp.c @@ -11918,14 +11918,16 @@ S_grok_bslash_N(pTHX_ RExC_state_t *pREx } sv_catpv(substitute_parse, ")"); - RExC_parse = RExC_start = RExC_adjusted_start = SvPV(substitute_parse, - len); + len = SvCUR(substitute_parse); /* Don't allow empty number */ if (len < (STRLEN) 8) { RExC_parse = endbrace; vFAIL("Invalid hexadecimal number in \\N{U+...}"); } + + RExC_parse = RExC_start = RExC_adjusted_start + = SvPV_nolen(substitute_parse); RExC_end = RExC_parse + len; /* The values are Unicode, and therefore not subject to recoding, but