AI analysis
ExtUtils::Typemaps::STL::String before 1.06 provides a T_STD_STRING typemap that builds a C++ std::string with std::string(SvPV_nolen($arg), SvCUR($arg)). C++ does not define argument evaluation order, so some compilers may evaluate SvCUR before SvPV_nolen has stringified the Perl SV. If the argument is not already a string—an integer, number, or reference—SvCUR can return an invalid length and the process may abort or segfault (CWE-125, out-of-bounds read). Perl XS or C++ bindings generated from this typemap are affected when non-string values reach that conversion; the practical impact described is a crash, not confirmed code execution. There is no known public proof of concept, no confirmed in-the-wild exploitation, no CVSS score yet, and the issue is not on the CISA KEV list.
What to do: Upgrade ExtUtils::Typemaps::STL::String to version 1.06 or later, then regenerate and rebuild any Perl XS or C++ extensions that embedded the T_STD_STRING typemap from an older release. Until those binaries are rebuilt, only pass real Perl strings into APIs that use this conversion, and treat aborts or segfaults on non-string inputs as a sign the old typemap is still linked in.
Affected
| CPAN ExtUtils::Typemaps::STL::String | before 1.06 |
Estimated exposure
nicheunknown (niche CPAN typemap; no install census) — No public active-install counts or internet-scan figures are available; this is a developer typemap baked into a limited set of Perl XS/C++ extensions rather than a mass-deployed service, so exposure is confined to applications that load…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first. When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.