CVE-2007-5116: Buffer Overflow

Tavis Ormandy and Will Drewry have discovered a flaw in the way perl calculates the space needed to process a regular expression. It is possible to cause the two passes to mismatch. To quote their mail:

The compile phase uses multiple passes (similar to older pcre releases), once to determine space requirements and another to actually compile the expression, however it's very simple to cause the two passes to mismatch. From the perl documentation:

> The regular expression compiler produces polymorphic opcodes.That is, > the pattern adapts to the data and automatically switches to the Unicode > character scheme when presented with Unicode data--or instead uses a > traditional byte scheme when presented with byte data.

This unfortunately means that you can cause the mode to switch at an arbitrary point, and then subsequent passes of any of the expression prior to this point switch will be passed differently, and thus potentially have their space requirements miscalculated.

Acknowledgements:

Red Hat would like to thank Tavis Ormandy and Will Drewry for properly disclosing this issue.