From @hvds

% miniperl -ce '/(?7777777777)/'
Segmentation fault (core dumped)
%

Found by AFL (<http​://lcamtuf.coredump.cx/afl>).

This is caused by integer wraparound on a UV to I32 conversion; will add a fix shortly.

From @hvds

Now fixed with b3725d4​:

  [perl #123782] regcomp​: check for overflow on /(?123)/
 
  AFL (<http​://lcamtuf.coredump.cx/afl>) found that the UV to I32 conversion
  can evade the necessary range checks on wraparound, leading to bad reads.
 
  Check for it, and force to I32_MAX, expecting that this will usually
  yield a "Reference to nonexistent group" error.

Hugo

@hvds - Status changed from 'new' to 'pending release'

From @khwilliamson

Thank you for submitting this ticket.

The issue should now be resolved with the release today of Perl v5.22, which is available at http​://www.perl.org/get.html
--
Karl Williamson for the Perl 5 team

@khwilliamson - Status changed from 'pending release' to 'resolved'