Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is tru [truncated]
A heap buffer overflow vulnerability exists in Perl versions through 5.43.10 when compiling regular expressions containing a repeated fixed string on 32-bit builds. The flaw resides in `Perl_study_chunk` within `regcomp_study.c`, where the size of the joined substring buffer was checked in characters rather than bytes. For quantified fixed substrings with large minimum counts, the byte length calculation [truncated]
