# heap-buffer-overflow (READ of size 11) in Perl 5.25.x

Perl's UTF-8 bit-and in do_vop() left result non-NUL-terminated, so a following bit-or numeric conversion strlen() read past the heap buffer.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by: geeknik
- Disclosed: 2017-05-28
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/232150
- Library page: https://bugbountylibrary.com/r/h1%3A232150
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:linux technique:fuzzing vuln:dos vuln:memory-corruption

**Target:** Perl interpreter numeric conversion (Perl_my_atof2 / do_vop)
**Root cause:** The UTF-8 string path of bit-and in do_vop() does not NUL-terminate its result; a subsequent bit-or forces numeric conversion and strlen() reads past the allocated buffer.
**Steps:**
1. Run `perl -e 'v300&O|0'`
2. Bit-and produces a non-NUL-terminated UTF-8 string
3. Bit-or converts that result to a number via Perl_my_atof2
4. strlen() reads 11 bytes past the 10-byte heap allocation (ASAN heap-buffer-overflow READ)
**How found:** Found with AFL fuzzing combined with ASAN and libdislocator.so; the crashing input was minimized to `v300&O|0`.
**Insight:** Fuzzing string bitwise ops with mixed version-strings and bareword operands can surface missing NUL-termination in UTF-8 result buffers that only manifest when a later op forces numeric conversion.