From 1665b718d8fbd58705dbe6376fa51f8c1a02d887 Mon Sep 17 00:00:00 2001 From: Father Chrysostomos Date: Tue, 13 Sep 2016 22:38:59 -0700 Subject: [PATCH 5/5] [perl #129267] Test for gv_fetchmethod buffer overrun MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Petr Písař --- ext/XS-APItest/APItest.xs | 3 +++ ext/XS-APItest/t/gv_fetchmethod_flags.t | 5 +++++ 2 files changed, 8 insertions(+) diff --git a/ext/XS-APItest/APItest.xs b/ext/XS-APItest/APItest.xs index 992b6a5..4602cee 100644 --- a/ext/XS-APItest/APItest.xs +++ b/ext/XS-APItest/APItest.xs @@ -2571,6 +2571,9 @@ gv_fetchmethod_flags_type(stash, methname, type, flags) gv = gv_fetchmethod_pvn_flags(stash, name, len, flags | SvUTF8(methname)); break; } + case 4: + gv = gv_fetchmethod_pvn_flags(stash, SvPV_nolen(methname), + flags, SvUTF8(methname)); } XPUSHs( gv ? (SV*)gv : &PL_sv_undef); diff --git a/ext/XS-APItest/t/gv_fetchmethod_flags.t b/ext/XS-APItest/t/gv_fetchmethod_flags.t index 15d1c41..2da3b70 100644 --- a/ext/XS-APItest/t/gv_fetchmethod_flags.t +++ b/ext/XS-APItest/t/gv_fetchmethod_flags.t @@ -49,3 +49,8 @@ is XS::APItest::gv_fetchmethod_flags_type(\%::, "method\0not quite!", 2, 0), "*m } } } + +# [perl #129267] Buffer overrun when argument name ends with colon and +# there is a colon past the end. This used to segv. +XS::APItest::gv_fetchmethod_flags_type(\%::, "method:::::", 4, 7); + # With type 4, 7 is the length -- 2.7.4