XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.<\/p>\n
The wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV() rather than SvROK(). SvRV() reads a union slot that only holds a referent once SvROK(sv) is true, so the guard never validates that it is a reference. For an IV or NV that slot holds the number itself, SvRV() returns the caller’s value and SvTYPE() dereferences it at offset 12. This will generally result in a segmentation fault.<\/p>\n
An application that hands the wrapper a list built from decoded input (for example, from JSON) lets whoever supplies a number in that list choose the address that the interpreter dereferences.<\/p>\n
An ordinary string’s byte 12 is rarely SVt_PVAV so the guard croaks by luck, but an attacker-crafted string carrying 0x0b there passes, and the buffer is then used as an AV head, with AvARRAY taken from bytes 16-23 and its entries pushed onto the Perl stack as live SVs.<\/p>\n
A simple proof-of-concept uses the zip operator:<\/p>\n
use Syntax::Operator::Zip ‘zip’;<\/p>\n
my @args = ([1], 2);
\n zip(@args);<\/p>\n","protected":false},"excerpt":{"rendered":"
XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.<\/p>\n
The wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether ar<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30258","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30258","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30258"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30258"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30258"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}