[perl #130635] [PATCH] Stack overflow in Storable retrieve_hook

On Tue, 24 Jan 2017 19:22:28 GMT, john@nixnuts.net wrote:
> This is a bug report for perl from john@nixnuts.net,
> generated with the help of perlbug 1.40 running under perl 5.25.9.
> 
> 
> -----------------------------------------------------------------
> AFL detected a stack overflow in Storable's retrieve_hook() function.
> 
> The problem essentially is that a hook's classname length is read into
> a signed integer, compared to the size of a stack buffer, then used to
> read the classname. The size comparison treats the length as signed,
> while the read treats the length as unsigned.
> 

Available for smoke-testing in this branch:

smoke-me/jkeenan/130635-storable

I corrected one spelling error in a test description and incremented the VERSION number.

-- 
James E Keenan (jkeenan@cpan.org)

---
via perlbug:  queue: perl5 status: new
https://rt.perl.org/Ticket/Display.html?id=130635

• Re: [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by John Lightsey
• [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by James E Keenan via RT
• Re: [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by John Lightsey
• Re: [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by John Lightsey
• [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by James E Keenan via RT
• Re: [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by John Lightsey
• [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by James E Keenan via RT
• [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by James E Keenan via RT
• [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by James E Keenan via RT
• [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by James E Keenan via RT
• [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by James E Keenan via RT
• [perl #130635] [PATCH] Stack overflow in Storable retrieve_hook by John Lightsey