diffstat for perl-5.26.1 perl-5.26.1 changelog | 36 ++++ control | 3 patches/fixes/CVE-2018-12015.patch | 39 +++++ patches/fixes/CVE-2018-18311.patch | 172 +++++++++++++++++++++++ patches/fixes/CVE-2018-18312.patch | 24 +++ patches/fixes/CVE-2018-18313.patch | 50 ++++++ patches/fixes/CVE-2018-18314.patch | 267 +++++++++++++++++++++++++++++++++++++ patches/series | 5 8 files changed, 595 insertions(+), 1 deletion(-) diff -Nru perl-5.26.1/debian/changelog perl-5.26.1/debian/changelog --- perl-5.26.1/debian/changelog 2018-03-10 18:40:42.000000000 +0000 +++ perl-5.26.1/debian/changelog 2018-11-19 15:54:44.000000000 +0000 @@ -1,3 +1,39 @@ +perl (5.26.1-6ubuntu0.3) bionic-security; urgency=medium + + * SECURITY UPDATE: Integer overflow leading to buffer overflow + - debian/patches/fixes/CVE-2018-18311.patch: handle integer wrap in + util.c. + - CVE-2018-18311 + * SECURITY UPDATE: Heap-buffer-overflow write / reg_node overrun + - debian/patches/fixes/CVE-2018-18312.patch: fix logic in regcomp.c. + - CVE-2018-18312 + * SECURITY UPDATE: Heap-buffer-overflow read + - debian/patches/fixes/CVE-2018-18313.patch: convert some strchr to + memchr in regcomp.c. + - CVE-2018-18313 + * SECURITY UPDATE: Heap-based buffer overflow + - debian/patches/fixes/CVE-2018-18314.patch: fix extended charclass in + pod/perldiag.pod, pod/perlrecharclass.pod, regcomp.c, + t/lib/warnings/regcomp, t/re/reg_mesg.t, t/re/regex_sets.t. + - CVE-2018-18314 + + -- Marc Deslauriers Mon, 19 Nov 2018 10:54:44 -0500 + +perl (5.26.1-6ubuntu0.2) bionic; urgency=high + + * No change rebuild to fix LP: #1574351 + + -- Balint Reczey Wed, 18 Jul 2018 16:21:03 +0200 + +perl (5.26.1-6ubuntu0.1) bionic-security; urgency=medium + + * SECURITY UPDATE: Directory traversal vulnerability + - debian/patches/fixes/CVE-2018-12015.patch: fix ing + cpan/Archive-Tar/lib/Archive/Tar.pm. + - CVE-2018-12015 + + -- Leonidas S. Barbosa Tue, 12 Jun 2018 16:32:02 -0300 + perl (5.26.1-6) unstable; urgency=high * [SECURITY] CVE-2018-6797: buffer overflow related to regex diff -Nru perl-5.26.1/debian/control perl-5.26.1/debian/control --- perl-5.26.1/debian/control 2018-03-10 18:40:42.000000000 +0000 +++ perl-5.26.1/debian/control 2018-06-12 19:32:02.000000000 +0000 @@ -1,7 +1,8 @@ Source: perl Section: perl Priority: standard -Maintainer: Niko Tyni +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Niko Tyni Uploaders: Dominic Hargreaves Standards-Version: 3.9.8 Homepage: http://dev.perl.org/perl5/ diff -Nru perl-5.26.1/debian/patches/fixes/CVE-2018-12015.patch perl-5.26.1/debian/patches/fixes/CVE-2018-12015.patch --- perl-5.26.1/debian/patches/fixes/CVE-2018-12015.patch 1970-01-01 00:00:00.000000000 +0000 +++ perl-5.26.1/debian/patches/fixes/CVE-2018-12015.patch 2018-06-12 19:31:41.000000000 +0000 @@ -0,0 +1,39 @@ +Backported of: + +From ae65651eab053fc6dc4590dbb863a268215c1fc5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= +Date: Fri, 8 Jun 2018 11:45:40 +0100 +Subject: [PATCH] [PATCH] Remove existing files before overwriting them + +Archive should extract only the latest same-named entry. +Extracted regular file should not be writtent into existing block +device (or any other one). + +https://rt.cpan.org/Ticket/Display.html?id=125523 + +Signed-off-by: Chris 'BinGOs' Williams +Index: perl-5.26.0/cpan/Archive-Tar/lib/Archive/Tar.pm +=================================================================== +--- perl-5.26.0.orig/cpan/Archive-Tar/lib/Archive/Tar.pm ++++ perl-5.26.0/cpan/Archive-Tar/lib/Archive/Tar.pm +@@ -845,6 +845,20 @@ sub _extract_file { + return; + } + ++ ### If a file system already contains a block device with the same name as ++ ### the being extracted regular file, we would write the file's content ++ ### to the block device. So remove the existing file (block device) now. ++ ### If an archive contains multiple same-named entries, the last one ++ ### should replace the previous ones. So remove the old file now. ++ ### If the old entry is a symlink to a file outside of the CWD, the new ++ ### entry would create a file there. This is CVE-2018-12015 ++ ### . ++ if (-l $full || -e _) { ++ if (!unlink $full) { ++ $self->_error( qq[Could not remove old file '$full': $!] ); ++ return; ++ } ++ } + if( length $entry->type && $entry->is_file ) { + my $fh = IO::File->new; + $fh->open( '>' . $full ) or ( diff -Nru perl-5.26.1/debian/patches/fixes/CVE-2018-18311.patch perl-5.26.1/debian/patches/fixes/CVE-2018-18311.patch --- perl-5.26.1/debian/patches/fixes/CVE-2018-18311.patch 1970-01-01 00:00:00.000000000 +0000 +++ perl-5.26.1/debian/patches/fixes/CVE-2018-18311.patch 2018-11-19 15:54:22.000000000 +0000 @@ -0,0 +1,172 @@ +From 34716e2a6ee2af96078d62b065b7785c001194be Mon Sep 17 00:00:00 2001 +From: David Mitchell +Date: Fri, 29 Jun 2018 13:37:03 +0100 +Subject: [PATCH] Perl_my_setenv(); handle integer wrap + +RT #133204 + +Wean this function off int/I32 and onto UV/Size_t. +Also, replace all malloc-ish calls with a wrapper that does +overflow checks, + +In particular, it was doing (nlen + vlen + 2) which could wrap when +the combined length of the environment variable name and value +exceeded around 0x7fffffff. + +The wrapper check function is probably overkill, but belt and braces... + +NB this function has several variant parts, #ifdef'ed by platform +type; I have blindly changed the parts that aren't compiled under linux. +--- + util.c | 76 ++++++++++++++++++++++++++++++++++++++++------------------ + 1 file changed, 53 insertions(+), 23 deletions(-) + +Index: perl-5.26.2/util.c +=================================================================== +--- perl-5.26.2.orig/util.c 2018-11-19 10:03:18.317669734 -0500 ++++ perl-5.26.2/util.c 2018-11-19 10:04:28.081872595 -0500 +@@ -2064,8 +2064,40 @@ Perl_new_warnings_bitfield(pTHX_ STRLEN + *(s+(nlen+1+vlen)) = '\0' + + #ifdef USE_ENVIRON_ARRAY +- /* VMS' my_setenv() is in vms.c */ ++ ++/* small wrapper for use by Perl_my_setenv that mallocs, or reallocs if ++ * 'current' is non-null, with up to three sizes that are added together. ++ * It handles integer overflow. ++ */ ++static char * ++S_env_alloc(void *current, Size_t l1, Size_t l2, Size_t l3, Size_t size) ++{ ++ void *p; ++ Size_t sl, l = l1 + l2; ++ ++ if (l < l2) ++ goto panic; ++ l += l3; ++ if (l < l3) ++ goto panic; ++ sl = l * size; ++ if (sl < l) ++ goto panic; ++ ++ p = current ++ ? safesysrealloc(current, sl) ++ : safesysmalloc(sl); ++ if (p) ++ return (char*)p; ++ ++ panic: ++ croak_memory_wrap(); ++} ++ ++ ++/* VMS' my_setenv() is in vms.c */ + #if !defined(WIN32) && !defined(NETWARE) ++ + void + Perl_my_setenv(pTHX_ const char *nam, const char *val) + { +@@ -2081,28 +2113,27 @@ Perl_my_setenv(pTHX_ const char *nam, co + #ifndef PERL_USE_SAFE_PUTENV + if (!PL_use_safe_putenv) { + /* most putenv()s leak, so we manipulate environ directly */ +- I32 i; +- const I32 len = strlen(nam); +- int nlen, vlen; ++ UV i; ++ Size_t vlen, nlen = strlen(nam); + + /* where does it go? */ + for (i = 0; environ[i]; i++) { +- if (strnEQ(environ[i],nam,len) && environ[i][len] == '=') ++ if (strnEQ(environ[i], nam, nlen) && environ[i][nlen] == '=') + break; + } + + if (environ == PL_origenviron) { /* need we copy environment? */ +- I32 j; +- I32 max; ++ UV j, max; + char **tmpenv; + + max = i; + while (environ[max]) + max++; +- tmpenv = (char**)safesysmalloc((max+2) * sizeof(char*)); ++ /* XXX shouldn't that be max+1 rather than max+2 ??? - DAPM */ ++ tmpenv = (char**)S_env_alloc(NULL, max, 2, 0, sizeof(char*)); + for (j=0; j +Date: Mon, 24 Sep 2018 11:54:41 -0600 +Subject: [PATCH 242/242] PATCH: [perl #133423] for 5.26 maint + +--- + regcomp.c | 1 - + t/re/reg_mesg.t | 4 ++++ + 2 files changed, 4 insertions(+), 1 deletion(-) + +Index: perl-5.26.1/regcomp.c +=================================================================== +--- perl-5.26.1.orig/regcomp.c 2018-11-19 10:54:28.171286094 -0500 ++++ perl-5.26.1/regcomp.c 2018-11-19 10:54:28.167286082 -0500 +@@ -15104,7 +15104,6 @@ redo_curchar: + RExC_parse++; + assert(UCHARAT(RExC_parse) == ')'); + +- RExC_parse++; + RExC_flags = save_flags; + goto handle_operand; + } diff -Nru perl-5.26.1/debian/patches/fixes/CVE-2018-18313.patch perl-5.26.1/debian/patches/fixes/CVE-2018-18313.patch --- perl-5.26.1/debian/patches/fixes/CVE-2018-18313.patch 1970-01-01 00:00:00.000000000 +0000 +++ perl-5.26.1/debian/patches/fixes/CVE-2018-18313.patch 2018-11-19 15:54:35.000000000 +0000 @@ -0,0 +1,50 @@ +From cc56be313c7d4e7c266c01dabc762a153d5b2c28 Mon Sep 17 00:00:00 2001 +From: Karl Williamson +Date: Sat, 25 Mar 2017 15:00:22 -0600 +Subject: [PATCH] regcomp.c: Convert some strchr to memchr + +This allows things to work properly in the face of embedded NULs. +See the branch merge message for more information. + +(cherry picked from commit 43b2f4ef399e2fd7240b4eeb0658686ad95f8e62) +--- + regcomp.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +Index: perl-5.26.1/regcomp.c +=================================================================== +--- perl-5.26.1.orig/regcomp.c 2018-11-19 10:54:33.971305075 -0500 ++++ perl-5.26.1/regcomp.c 2018-11-19 10:54:33.971305075 -0500 +@@ -12018,7 +12018,8 @@ S_grok_bslash_N(pTHX_ RExC_state_t *pREx + + RExC_parse++; /* Skip past the '{' */ + +- if (! (endbrace = strchr(RExC_parse, '}'))) { /* no trailing brace */ ++ endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse); ++ if (! endbrace) { /* no trailing brace */ + vFAIL2("Missing right brace on \\%c{}", 'N'); + } + else if(!(endbrace == RExC_parse /* nothing between the {} */ +@@ -12687,9 +12688,11 @@ S_regatom(pTHX_ RExC_state_t *pRExC_stat + else { + STRLEN length; + char name = *RExC_parse; +- char * endbrace; ++ char * endbrace = NULL; + RExC_parse += 2; +- endbrace = strchr(RExC_parse, '}'); ++ if (RExC_parse < RExC_end) { ++ endbrace = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse); ++ } + + if (! endbrace) { + vFAIL2("Missing right brace on \\%c{}", name); +@@ -16221,7 +16224,7 @@ S_regclass(pTHX_ RExC_state_t *pRExC_sta + vFAIL2("Empty \\%c", (U8)value); + if (*RExC_parse == '{') { + const U8 c = (U8)value; +- e = strchr(RExC_parse, '}'); ++ e = (char *) memchr(RExC_parse, '}', RExC_end - RExC_parse); + if (!e) { + RExC_parse++; + vFAIL2("Missing right brace on \\%c{}", c); diff -Nru perl-5.26.1/debian/patches/fixes/CVE-2018-18314.patch perl-5.26.1/debian/patches/fixes/CVE-2018-18314.patch --- perl-5.26.1/debian/patches/fixes/CVE-2018-18314.patch 1970-01-01 00:00:00.000000000 +0000 +++ perl-5.26.1/debian/patches/fixes/CVE-2018-18314.patch 2018-11-19 15:54:41.000000000 +0000 @@ -0,0 +1,267 @@ +From 10ce49389ea9ee26a3b02b6494b0a3849d56c6fa Mon Sep 17 00:00:00 2001 +From: Yves Orton +Date: Mon, 26 Jun 2017 13:19:55 +0200 +Subject: [PATCH] fix #131649 - extended charclass can trigger assert + +The extended charclass parser makes some assumptions during the +first pass which are only true on well structured input, and it +does not properly catch various errors. later on the code assumes +that things the first pass will let through are valid, when in +fact they should trigger errors. + +(cherry picked from commit 19a498a461d7c81ae3507c450953d1148efecf4f) +--- + pod/perldiag.pod | 27 ++++++++++++++++++++++++++- + pod/perlrecharclass.pod | 4 ++-- + regcomp.c | 28 ++++++++++++++++++---------- + t/lib/warnings/regcomp | 6 +++--- + t/re/reg_mesg.t | 29 ++++++++++++++++------------- + t/re/regex_sets.t | 6 +++--- + 6 files changed, 68 insertions(+), 32 deletions(-) + +Index: perl-5.26.1/pod/perldiag.pod +=================================================================== +--- perl-5.26.1.orig/pod/perldiag.pod 2018-11-19 10:54:39.623323552 -0500 ++++ perl-5.26.1/pod/perldiag.pod 2018-11-19 10:54:39.619323539 -0500 +@@ -5904,7 +5904,7 @@ yourself. + a perl4 interpreter, especially if the next 2 tokens are "use strict" + or "my $var" or "our $var". + +-=item Syntax error in (?[...]) in regex m/%s/ ++=item Syntax error in (?[...]) in regex; marked by <-- HERE in m/%s/ + + (F) Perl could not figure out what you meant inside this construct; this + notifies you that it is giving up trying. +@@ -6402,6 +6402,31 @@ to find out why that isn't happening. + (F) The unexec() routine failed for some reason. See your local FSF + representative, who probably put it there in the first place. + ++=item Unexpected ']' with no following ')' in (?[... in regex; marked by <-- HERE in m/%s/ ++ ++(F) While parsing an extended character class a ']' character was encountered ++at a point in the definition where the only legal use of ']' is to close the ++character class definition as part of a '])', you may have forgotten the close ++paren, or otherwise confused the parser. ++ ++=item Expecting close paren for nested extended charclass in regex; marked by <-- HERE in m/%s/ ++ ++(F) While parsing a nested extended character class like: ++ ++ (?[ ... (?flags:(?[ ... ])) ... ]) ++ ^ ++ ++we expected to see a close paren ')' (marked by ^) but did not. ++ ++=item Expecting close paren for wrapper for nested extended charclass in regex; marked by <-- HERE in m/%s/ ++ ++(F) While parsing a nested extended character class like: ++ ++ (?[ ... (?flags:(?[ ... ])) ... ]) ++ ^ ++ ++we expected to see a close paren ')' (marked by ^) but did not. ++ + =item Unexpected binary operator '%c' with no preceding operand in regex; + marked by S<<-- HERE> in m/%s/ + +Index: perl-5.26.1/pod/perlrecharclass.pod +=================================================================== +--- perl-5.26.1.orig/pod/perlrecharclass.pod 2018-11-19 10:54:39.623323552 -0500 ++++ perl-5.26.1/pod/perlrecharclass.pod 2018-11-19 10:54:39.619323539 -0500 +@@ -1128,8 +1128,8 @@ hence both of the following work: + Any contained POSIX character classes, including things like C<\w> and C<\D> + respect the Ca> (and Caa>) modifiers. + +-C<< (?[ ]) >> is a regex-compile-time construct. Any attempt to use +-something which isn't knowable at the time the containing regular ++Note that C<< (?[ ]) >> is a regex-compile-time construct. Any attempt ++to use something which isn't knowable at the time the containing regular + expression is compiled is a fatal error. In practice, this means + just three limitations: + +Index: perl-5.26.1/regcomp.c +=================================================================== +--- perl-5.26.1.orig/regcomp.c 2018-11-19 10:54:39.623323552 -0500 ++++ perl-5.26.1/regcomp.c 2018-11-19 10:54:39.623323552 -0500 +@@ -14835,8 +14835,9 @@ S_handle_regex_sets(pTHX_ RExC_state_t * + TRUE /* Force /x */ ); + + switch (*RExC_parse) { +- case '?': +- if (RExC_parse[1] == '[') depth++, RExC_parse++; ++ case '(': ++ if (RExC_parse[1] == '?' && RExC_parse[2] == '[') ++ depth++, RExC_parse+=2; + /* FALLTHROUGH */ + default: + break; +@@ -14893,9 +14894,9 @@ S_handle_regex_sets(pTHX_ RExC_state_t * + } + + case ']': +- if (depth--) break; +- RExC_parse++; +- if (*RExC_parse == ')') { ++ if (RExC_parse[1] == ')') { ++ RExC_parse++; ++ if (depth--) break; + node = reganode(pRExC_state, ANYOF, 0); + RExC_size += ANYOF_SKIP; + nextchar(pRExC_state); +@@ -14907,20 +14908,25 @@ S_handle_regex_sets(pTHX_ RExC_state_t * + + return node; + } +- goto no_close; ++ /* We output the messages even if warnings are off, because we'll fail ++ * the very next thing, and these give a likely diagnosis for that */ ++ if (posix_warnings && av_tindex_skip_len_mg(posix_warnings) >= 0) { ++ output_or_return_posix_warnings(pRExC_state, posix_warnings, NULL); ++ } ++ RExC_parse++; ++ vFAIL("Unexpected ']' with no following ')' in (?[..."); + } + + RExC_parse += UTF ? UTF8SKIP(RExC_parse) : 1; + } + +- no_close: + /* We output the messages even if warnings are off, because we'll fail + * the very next thing, and these give a likely diagnosis for that */ + if (posix_warnings && av_tindex_skip_len_mg(posix_warnings) >= 0) { + output_or_return_posix_warnings(pRExC_state, posix_warnings, NULL); + } + +- FAIL("Syntax error in (?[...])"); ++ vFAIL("Syntax error in (?[...])"); + } + + /* Pass 2 only after this. */ +@@ -15100,12 +15106,14 @@ redo_curchar: + * inversion list, and RExC_parse points to the trailing + * ']'; the next character should be the ')' */ + RExC_parse++; +- assert(UCHARAT(RExC_parse) == ')'); ++ if (UCHARAT(RExC_parse) != ')') ++ vFAIL("Expecting close paren for nested extended charclass"); + + /* Then the ')' matching the original '(' handled by this + * case: statement */ + RExC_parse++; +- assert(UCHARAT(RExC_parse) == ')'); ++ if (UCHARAT(RExC_parse) != ')') ++ vFAIL("Expecting close paren for wrapper for nested extended charclass"); + + RExC_flags = save_flags; + goto handle_operand; +Index: perl-5.26.1/t/lib/warnings/regcomp +=================================================================== +--- perl-5.26.1.orig/t/lib/warnings/regcomp 2018-11-19 10:54:39.623323552 -0500 ++++ perl-5.26.1/t/lib/warnings/regcomp 2018-11-19 10:54:39.623323552 -0500 +@@ -59,21 +59,21 @@ Unmatched [ in regex; marked by <-- HERE + qr/(?[[[:word]]])/; + EXPECT + Assuming NOT a POSIX class since there is no terminating ':' in regex; marked by <-- HERE in m/(?[[[:word <-- HERE ]]])/ at - line 2. +-syntax error in (?[...]) in regex m/(?[[[:word]]])/ at - line 2. ++Unexpected ']' with no following ')' in (?[... in regex; marked by <-- HERE in m/(?[[[:word]] <-- HERE ])/ at - line 2. + ######## + # NAME qr/(?[ [[:digit: ])/ + # OPTION fatal + qr/(?[[[:digit: ])/; + EXPECT + Assuming NOT a POSIX class since no blanks are allowed in one in regex; marked by <-- HERE in m/(?[[[:digit: ] <-- HERE )/ at - line 2. +-syntax error in (?[...]) in regex m/(?[[[:digit: ])/ at - line 2. ++syntax error in (?[...]) in regex; marked by <-- HERE in m/(?[[[:digit: ]) <-- HERE / at - line 2. + ######## + # NAME qr/(?[ [:digit: ])/ + # OPTION fatal + qr/(?[[:digit: ])/ + EXPECT + Assuming NOT a POSIX class since no blanks are allowed in one in regex; marked by <-- HERE in m/(?[[:digit: ] <-- HERE )/ at - line 2. +-syntax error in (?[...]) in regex m/(?[[:digit: ])/ at - line 2. ++syntax error in (?[...]) in regex; marked by <-- HERE in m/(?[[:digit: ]) <-- HERE / at - line 2. + ######## + # NAME [perl #126141] + # OPTION fatal +Index: perl-5.26.1/t/re/reg_mesg.t +=================================================================== +--- perl-5.26.1.orig/t/re/reg_mesg.t 2018-11-19 10:54:39.623323552 -0500 ++++ perl-5.26.1/t/re/reg_mesg.t 2018-11-19 10:54:39.623323552 -0500 +@@ -213,8 +213,9 @@ my @death = + '/\b{gc}/' => "'gc' is an unknown bound type {#} m/\\b{gc{#}}/", + '/\B{gc}/' => "'gc' is an unknown bound type {#} m/\\B{gc{#}}/", + +- '/(?[[[::]]])/' => "Syntax error in (?[...]) in regex m/(?[[[::]]])/", +- '/(?[[[:w:]]])/' => "Syntax error in (?[...]) in regex m/(?[[[:w:]]])/", ++ ++ '/(?[[[::]]])/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[[[::]]{#}])/", ++ '/(?[[[:w:]]])/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[[[:w:]]{#}])/", + '/(?[[:w:]])/' => "", + '/([.].*)[.]/' => "", # [perl #127582] + '/[.].*[.]/' => "", # [perl #127604] +@@ -237,11 +238,12 @@ my @death = + '/(?[ \p{foo} ])/' => 'Can\'t find Unicode property definition "foo" {#} m/(?[ \p{foo}{#} ])/', + '/(?[ \p{ foo = bar } ])/' => 'Can\'t find Unicode property definition "foo = bar" {#} m/(?[ \p{ foo = bar }{#} ])/', + '/(?[ \8 ])/' => 'Unrecognized escape \8 in character class {#} m/(?[ \8{#} ])/', +- '/(?[ \t ]/' => 'Syntax error in (?[...]) in regex m/(?[ \t ]/', +- '/(?[ [ \t ]/' => 'Syntax error in (?[...]) in regex m/(?[ [ \t ]/', +- '/(?[ \t ] ]/' => 'Syntax error in (?[...]) in regex m/(?[ \t ] ]/', +- '/(?[ [ ] ]/' => 'Syntax error in (?[...]) in regex m/(?[ [ ] ]/', +- '/(?[ \t + \e # This was supposed to be a comment ])/' => 'Syntax error in (?[...]) in regex m/(?[ \t + \e # This was supposed to be a comment ])/', ++ '/(?[ \t ]/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[ \\t ]{#}/", ++ '/(?[ [ \t ]/' => "Syntax error in (?[...]) {#} m/(?[ [ \\t ]{#}/", ++ '/(?[ \t ] ]/' => "Unexpected ']' with no following ')' in (?[... {#} m/(?[ \\t ]{#} ]/", ++ '/(?[ [ ] ]/' => "Syntax error in (?[...]) {#} m/(?[ [ ] ]{#}/", ++ '/(?[ \t + \e # This was supposed to be a comment ])/' => ++ "Syntax error in (?[...]) {#} m/(?[ \\t + \\e # This was supposed to be a comment ]){#}/", + '/(?[ ])/' => 'Incomplete expression within \'(?[ ])\' {#} m/(?[ {#}])/', + 'm/(?[[a-\d]])/' => 'False [] range "a-\d" {#} m/(?[[a-\d{#}]])/', + 'm/(?[[\w-x]])/' => 'False [] range "\w-" {#} m/(?[[\w-{#}x]])/', +@@ -427,10 +429,10 @@ my @death_utf8 = mark_as_utf8( + + '/ネ\p{}ネ/' => 'Empty \p{} {#} m/ネ\p{{#}}ネ/', + +- '/ネ(?[[[:ネ]]])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[:ネ]]])ネ/", +- '/ネ(?[[[:ネ: ])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[:ネ: ])ネ/", +- '/ネ(?[[[::]]])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[::]]])ネ/", +- '/ネ(?[[[:ネ:]]])ネ/' => "Syntax error in (?[...]) in regex m/ネ(?[[[:ネ:]]])ネ/", ++ '/ネ(?[[[:ネ]]])ネ/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[[[:ネ]]{#}])ネ/", ++ '/ネ(?[[[:ネ: ])ネ/' => "Syntax error in (?[...]) {#} m/ネ(?[[[:ネ: ])ネ{#}/", ++ '/ネ(?[[[::]]])ネ/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[[[::]]{#}])ネ/", ++ '/ネ(?[[[:ネ:]]])ネ/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[[[:ネ:]]{#}])ネ/", + '/ネ(?[[:ネ:]])ネ/' => "", + '/ネ(?[ネ])ネ/' => 'Unexpected character {#} m/ネ(?[ネ{#}])ネ/', + '/ネ(?[ + [ネ] ])/' => 'Unexpected binary operator \'+\' with no preceding operand {#} m/ネ(?[ +{#} [ネ] ])/', +@@ -443,8 +445,9 @@ my @death_utf8 = mark_as_utf8( + '/(?[ \x{ネ} ])ネ/' => 'Non-hex character {#} m/(?[ \x{ネ{#}} ])ネ/', + '/(?[ \p{ネ} ])/' => 'Can\'t find Unicode property definition "ネ" {#} m/(?[ \p{ネ}{#} ])/', + '/(?[ \p{ ネ = bar } ])/' => 'Can\'t find Unicode property definition "ネ = bar" {#} m/(?[ \p{ ネ = bar }{#} ])/', +- '/ネ(?[ \t ]/' => 'Syntax error in (?[...]) in regex m/ネ(?[ \t ]/', +- '/(?[ \t + \e # ネ This was supposed to be a comment ])/' => 'Syntax error in (?[...]) in regex m/(?[ \t + \e # ネ This was supposed to be a comment ])/', ++ '/ネ(?[ \t ]/' => "Unexpected ']' with no following ')' in (?[... {#} m/ネ(?[ \\t ]{#}/", ++ '/(?[ \t + \e # ネ This was supposed to be a comment ])/' => ++ "Syntax error in (?[...]) {#} m/(?[ \\t + \\e # ネ This was supposed to be a comment ]){#}/", + 'm/(*ネ)ネ/' => q, + '/\cネ/' => "Character following \"\\c\" must be printable ASCII", + '/\b{ネ}/' => "'ネ' is an unknown bound type {#} m/\\b{ネ{#}}/", +Index: perl-5.26.1/t/re/regex_sets.t +=================================================================== +--- perl-5.26.1.orig/t/re/regex_sets.t 2018-11-19 10:54:39.623323552 -0500 ++++ perl-5.26.1/t/re/regex_sets.t 2018-11-19 10:54:39.623323552 -0500 +@@ -158,13 +158,13 @@ for my $char ("٠", "٥", "٩") { + eval { $_ = '/(?[(\c]) /'; qr/$_/ }; + like($@, qr/^Syntax error/, '/(?[(\c]) / should not panic'); + eval { $_ = '(?[\c#]' . "\n])"; qr/$_/ }; +- like($@, qr/^Syntax error/, '/(?[(\c]) / should not panic'); ++ like($@, qr/^Unexpected/, '/(?[(\c]) / should not panic'); + eval { $_ = '(?[(\c])'; qr/$_/ }; + like($@, qr/^Syntax error/, '/(?[(\c])/ should be a syntax error'); + eval { $_ = '(?[(\c]) ]\b'; qr/$_/ }; +- like($@, qr/^Syntax error/, '/(?[(\c]) ]\b/ should be a syntax error'); ++ like($@, qr/^Unexpected/, '/(?[(\c]) ]\b/ should be a syntax error'); + eval { $_ = '(?[\c[]](])'; qr/$_/ }; +- like($@, qr/^Syntax error/, '/(?[\c[]](])/ should be a syntax error'); ++ like($@, qr/^Unexpected/, '/(?[\c[]](])/ should be a syntax error'); + like("\c#", qr/(?[\c#])/, '\c# should match itself'); + like("\c[", qr/(?[\c[])/, '\c[ should match itself'); + like("\c\ ", qr/(?[\c\])/, '\c\ should match itself'); diff -Nru perl-5.26.1/debian/patches/series perl-5.26.1/debian/patches/series --- perl-5.26.1/debian/patches/series 2018-03-10 18:40:42.000000000 +0000 +++ perl-5.26.1/debian/patches/series 2018-11-19 15:54:44.000000000 +0000 @@ -60,3 +60,8 @@ fixes/CVE-2018-6798/pt3.diff fixes/CVE-2018-6798/pt4.diff fixes/CVE-2018-6913.diff +fixes/CVE-2018-12015.patch +fixes/CVE-2018-18311.patch +fixes/CVE-2018-18312.patch +fixes/CVE-2018-18313.patch +fixes/CVE-2018-18314.patch