========================================================================
CVE-2013-10076                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2013-10076

   Distribution:  ExtUtils-Typemaps-Default
       Versions:  before 1.05
       MetaCPAN: https://metacpan.org/dist/ExtUtils-Typemaps-Default
       VCS Repo:  https://github.com/tsee/extutils-typemap-default

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate
a 32 GiB array on an empty list

Description
-----------
ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate
a 32 GiB array on an empty list.

The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this
undeflows, and av_extend will allocate an array with 2^32 slots,
leading to memory exhaustion.

Problem types
-------------
- CWE-191 Integer Underflow (Wrap or Wraparound)

Solutions
---------
Upgrade to ExtUtils::Typemaps::Default version 1.07 or later. (Note
that while this issue was fixed in version 1.05, a related issue was
fixied in 1.07.)

Rebuild any modules that use ExtUtils::Typemaps::Default as part of
their build process.

References
----------
https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.05/changes
https://rt.cpan.org/Public/Bug/Display.html?id=91213
https://github.com/tsee/extutils-typemap-default/commit/0eb696b75afcfedbf87a72e11d44d98110863934.patch