Package: perl
Version: 5.8.8-7
Severity: important
Perl 5.6.1+ hangs when:
(1) Taint mode (-T) is used
(2) 'study' is used
(3) Regular expression match with an expression starting
with "^", containing ".*" (or ".*?") matched by a
newline, using the /m flag, but not the /s flag.
See http://rt.perl.org/rt3/Ticket/Display.html?id=41831 for details.
Test case:
# ---------- cut ----------
#!/usr/bin/perl -T
my $DATA = <<'END'
line1 is here
line2 is here
line3 is here
line4 is here
END
;
sub read_some_tainted_data() {
return substr($ENV{HOME},0,1);
}
warn "tainting data";
$DATA .= read_some_tainted_data();
warn "studying data";
study $DATA;
warn "trying to match...";
## don't set $SIG{ALRM}, since we'd never get to a user-level handler as perl
## is stuck in a regexp infinite loop!
alarm(1);
if ($DATA =~ /^line2.*line4/m) {
print "match\n";
} else {
print "no match\n";
}
warn "match didn't hang!";
# ---------- cut ----------
The following patch fixed it for me, but perl 5.8.9 has a different fix.
--- perl-5.8.8/regexec.c.orig 2007-03-14 20:02:20.000000000 -0700
+++ perl-5.8.8/regexec.c 2007-03-14 20:57:24.000000000 -0700
@@ -454,7 +454,11 @@
"String too short... [re_intuit_start]\n"));
goto fail;
}
- strbeg = (sv && SvPOK(sv)) ? strend - SvCUR(sv) : strpos;
+ /* quarl 2007-03-14
+ * Need to check SvPOKp rather than SvPOK in case of taint mode +
+ * studied regexp. Reference: 615e0643-ac86-4c31-9cd3-3526b2fc883c */
+ strbeg = (sv && (SvPOK(sv) || SvPOKp(sv))) ? strend - SvCUR(sv) : strpos;
+ /* DEBUG_r( PerlIO_printf(Perl_debug_log, "## sv_flags=%p, SvPOK=%d,
SvPOKp=%d, strbeg = %p\n", sv ? sv->sv_flags : 0, (sv && SvPOK(sv) ? 1:0), (sv
&& SvPOKp(sv) ? 1:0), strbeg) ); */
PL_regeol = strend;
if (do_utf8) {
if (!prog->check_utf8 && prog->check_substr)
-- System Information:
Debian Release: 4.0
APT prefers testing
APT policy: (500, 'testing'), (500, 'stable'), (60, 'unstable'), (40,
'experimental')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.16-quack+roar.cs.berkeley.edu
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Versions of packages perl depends on:
ii libc6 2.3.6.ds1-13 GNU C Library: Shared libraries
ii libdb4.4 4.4.20-8 Berkeley v4.4 Database Libraries [
ii libgdbm3 1.8.3-3 GNU dbm database routines (runtime
ii perl-base 5.8.8-7 The Pathologically Eclectic Rubbis
ii perl-modules 5.8.8-7 Core Perl modules
Versions of packages perl recommends:
ii perl-doc 5.8.8-7 Perl documentation
-- no debconf information
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
