# read outside of buffer (heap buffer overflow) in S_regmatch - regexec.c:6057

Out-of-bounds heap read in Perl's S_regmatch during regex substitution, causing crashes or leaking up to 12 bytes past the buffer.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: geeknik
- Disclosed: 2017-05-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/207983
- Library page: https://bugbountylibrary.com/r/h1%3A207983
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:linux technique:fuzzing vuln:dos vuln:memory-corruption

**Target:** Perl regex engine (regexec.c S_regmatch)
**Root cause:** S_regmatch reads one byte past the end of the allocated string buffer when handling certain regex matches, extending up to 12 bytes beyond the string depending on character encoding and UV size.
**Steps:**
1. Build Perl with AddressSanitizer
2. Run a regex substitution that triggers S_regmatch at regexec.c:6057
3. Observe ASan heap-buffer-overflow READ of size 1, 2 bytes right of a 1064-byte region
**How found:** Fuzzing/ASan instrumentation of Perl's regex engine surfaced the out-of-bounds read in S_regmatch during substitution.
**Insight:** Regex engine match loops that read multi-byte/UTF-8 characters can over-read past the buffer end; ASan on the interpreter's regex paths surfaces these reliably.