CVE-2018-18313

An attacker can trigger this vulnerability by providing a specially crafted regular expression to Perl's regex engine. This crafted input causes the engine to perform an out-of-bounds read from process memory. The vulnerability is triggered during the compilation phase of the regular expression, specifically when parsing constructs like \N{...} or character classes with braces [].

The vulnerability resides in the `regcomp.c` file within Perl's source code. Specifically, the functions `S_grok_bslash_N`, `S_regatom`, and `S_regclass` are affected. The patch modifies these functions to use `memchr` instead of `strchr` for searching for closing braces, limiting the search to the valid buffer boundaries [ref_id=1].

The patch replaces calls to `strchr` with `memchr` when searching for a closing brace '}'. The `memchr` function is used with a length argument derived from `RExC_end - RExC_parse`, ensuring that the search is bounded by the available memory. This prevents the `strchr` function from reading past the end of the allocated buffer, thus mitigating the buffer over-read vulnerability [ref_id=1].