untrusted comment: signature from openbsd 6.0 base secret key
RWSho3oKSqgLQ5cFmAM9fuzSw/Nc6MHqRHojdlOqPwSDmI/ptdtOKT32Q1op9aDaHoPkCaWBRrHnRMwH9jXWvFDgzqNTxjdRqwY=

OpenBSD 6.0 errata 042, September 22, 2017:

A buffer over-read and heap overflow in perl's regexp may result in
a crash or memory leak.

Apply by doing:
   signify -Vep /etc/signify/openbsd-60-base.pub -x 042_perl.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install perl:
   cd /usr/src/gnu/usr.bin/perl/
   make -f Makefile.bsd-wrapper obj
   make -f Makefile.bsd-wrapper depend
   make -f Makefile.bsd-wrapper
   make -f Makefile.bsd-wrapper install

Index: gnu/usr.bin/perl/regcomp.c
===================================================================
RCS file: /cvs/src/gnu/usr.bin/perl/regcomp.c,v
retrieving revision 1.21
diff -u -p -r1.21 regcomp.c
--- gnu/usr.bin/perl/regcomp.c  3 Jul 2016 01:07:48 -0000       1.21
+++ gnu/usr.bin/perl/regcomp.c  19 Sep 2017 02:06:07 -0000
@@ -10836,12 +10836,14 @@ S_grok_bslash_N(pTHX_ RExC_state_t *pREx
       }
       sv_catpv(substitute_parse, ")");

-       RExC_parse = SvPV(substitute_parse, len);
+        len = SvCUR(substitute_parse);

       /* Don't allow empty number */
       if (len < 8) {
           vFAIL("Invalid hexadecimal number in \\N{U+...}");
       }
+
+       RExC_parse = SvPV_nolen(substitute_parse);
       RExC_end = RExC_parse + len;

       /* The values are Unicode, and therefore not subject to recoding */
@@ -11168,7 +11170,7 @@ S_regatom(pTHX_ RExC_state_t *pRExC_stat
    dVAR;
    regnode *ret = NULL;
    I32 flags = 0;
-    char *parse_start = RExC_parse;
+    char *parse_start;
    U8 op;
    int invert = 0;

@@ -11181,6 +11183,7 @@ S_regatom(pTHX_ RExC_state_t *pRExC_stat
    PERL_ARGS_ASSERT_REGATOM;

tryagain:
+    parse_start = RExC_parse;
    switch ((U8)*RExC_parse) {
    case '^':
       RExC_seen_zerolen++;
@@ -11269,7 +11272,7 @@ tryagain:
       break;
    case '{':
       if (!regcurly(RExC_parse, FALSE)) {
-           RExC_parse++;
+           RExC_parse = parse_start;
           goto defchar;
       }
       /* FALL THROUGH */
@@ -11486,7 +11489,7 @@ tryagain:
                                FALSE /* not strict */ )) {
                if (*flagp & RESTART_UTF8)
                    return NULL;
-                RExC_parse--;
+                RExC_parse = parse_start;
                goto defchar;
            }
            break;
@@ -11588,6 +11591,7 @@ tryagain:
                            && *RExC_parse != '8' && *RExC_parse != '9'))
                    {
                        /* Probably a character specified in octal, e.g. \35 */
+                        RExC_parse = parse_start;
                        goto defchar;
                    }
                }
@@ -11638,7 +11642,7 @@ tryagain:
       default:
           /* Do not generate "unrecognized" warnings here, we fall
              back into the quick-grab loop below */
-           parse_start--;
+           RExC_parse = parse_start;
           goto defchar;
       }
       break;
@@ -11652,10 +11656,6 @@ tryagain:

    default:

-            parse_start = RExC_parse - 1;
-
-           RExC_parse++;
-
       defchar: {
           STRLEN len = 0;
           UV ender = 0;
@@ -11719,7 +11719,12 @@ tryagain:
             * could back off to end with only a code point that isn't such a
             * non-final, but it is possible for there not to be any in the
             * entire node. */
-           for (p = RExC_parse - 1;
+
+            assert(   ! UTF     /* Is at the beginning of a character */
+                   || UTF8_IS_INVARIANT(UCHARAT(RExC_parse))
+                   || UTF8_IS_START(UCHARAT(RExC_parse)));
+
+           for (p = RExC_parse;
                len < upper_parse && p < RExC_end;
                len++)
           {
@@ -11792,6 +11797,7 @@ tryagain:
                            goto loopdone;
                        }
                        p = RExC_parse;
+                        RExC_parse = parse_start;
                        if (ender > 0xff) {
                            REQUIRE_UTF8;
                        }