# Perl 5.22 VDir::MapPathA/W Out-of-bounds Reads and Buffer Over-reads

Perl 5.22 on Windows: VDir::MapPathA/W pass an unvalidated drive-letter char to DriveIndex, indexing dirTableA out of bounds and over-reading buffers via strcat.

- Payout: $1,000
- Severity: medium
- Program: Internet Bug Bounty
- Credited: johnleitch
- Disclosed: 2016-03-31
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/110352
- Library page: https://bugbountylibrary.com/r/h1%3A110352
- Tags: domain:desktop domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:windows technique:source-review vuln:dos vuln:memory-corruption

**Target:** Perl win32 VDir::MapPathA/W path mapping (glob/stat)
**Root cause:** DriveIndex(char) computes (chr|0x20)-'a' without validating the input is a letter, so GetDirA indexes dirTableA out of bounds; returned pointer is then strcpy'd/strcat'd into fixed buffers. MapPathA also reads pInName[2] and &pInName[2] on 2-byte strings.
**Steps:**
1. Run Perl 5.22 on Windows under a debugger
2. Execute `print glob "]:";`
3. Observe access violation in MSVCR110!strcat called from VDir::MapPathA via win32_stat/PerlLIOLstat/glob
4. Trace: DriveIndex(']') returns 0x1c, GetDirA indexes dirTableA out of bounds, strcpy copies attacker-influenced pointer
**How found:** Code review of VDir::MapPathA/W noticed DriveIndex lacks validation of the chr argument before indexing dirTableA, and that pInName[2]/&pInName[2] are accessed on strings that may only be 2 bytes including null; confirmed with a one-line glob PoC under a debugger.
**Exploitation:** Attacker supplies a crafted glob/path string whose first char is a non-letter; DriveIndex yields an out-of-range index into dirTableA, GetDirA returns an out-of-bounds pointer, and strcpy/strcat copy from it into a fixed buffer. With memory layout control this could become a buffer overflow toward code execution; demonstrated only as an OOB read crash.
**Insight:** On Windows Perl, glob/stat path strings flow into VDir::MapPathA; any non-letter first char before ':' produces an out-of-range dirTableA index. Audit drive-letter parsing helpers for missing isalpha checks and fixed-buffer strcpy of table lookups.