Heap overflow via regex substring length miscalculation

Heap buffer overflow in Perl through 5.43.10 allows attackers to corrupt memory by compiling a repeated fixed-string regex on 32-bit builds. Perl_study_chunk in regcomp_study.c multiplies a quantified substring's byte length by its minimum count without rejecting SSize_t overflow, so SvGROW reserves an undersized buffer before the copy. The condition requires a 32-bit Perl build and an attacker-controlled regular expression; resulting memory corruption can crash the process, while code execution has not been demonstrated.