This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
Fix stack buffer overflow in deserialization of hooks.
authorJohn Lightsey <jd@cpanel.net>
Tue, 24 Jan 2017 16:30:18 +0000 (10:30 -0600)
committerTony Cook <tony@develop-help.com>
Sun, 5 Feb 2017 23:31:50 +0000 (10:31 +1100)
commit3e998ddfb597cfae7bdb460b22e6c50440b1de92
tree7bf4fab3352e879d2d02fac32f50af5cf84f4941
parent90c3aa01208e3c5b9ab464a058bbd2f6ebda4ff4
Fix stack buffer overflow in deserialization of hooks.

The use of signed lengths resulted in a stack overflow in retrieve_hook()
when a negative length was provided in the storable data.

The retrieve_blessed() codepath had a similar problem with the placement
of the trailing null byte when negative lengths were provided.
dist/Storable/Storable.pm
dist/Storable/Storable.xs
dist/Storable/t/store.t