Change 20136 by [EMAIL PROTECTED] on 2003/07/11 00:05:20
Integrate:
[ 20134]
Check PERL_HASH_SEED even when tainted.
[ 20135]
Chicken out: the hash randomisation is not on by default.
We switch over to the explicit mode: in other words, if
the $ENV{PERL_HASH_SEED} is on, we randomise. Also, we
randomise only if PL_hash_seed_set is FALSE (this means
one can use PERL_HASH() before perl_run.) Also, since
now PERL_HASH_SEED is okay even under -T, all should be fine.
(Ha!)
Affected files ...
... //depot/maint-5.8/perl/embed.fnc#39 integrate
... //depot/maint-5.8/perl/embed.h#39 integrate
... //depot/maint-5.8/perl/embedvar.h#27 integrate
... //depot/maint-5.8/perl/intrpvar.h#21 integrate
... //depot/maint-5.8/perl/perl.c#45 integrate
... //depot/maint-5.8/perl/perl.h#39 integrate
... //depot/maint-5.8/perl/perlapi.h#24 integrate
... //depot/maint-5.8/perl/pod/perldiag.pod#30 integrate
... //depot/maint-5.8/perl/pod/perlrun.pod#24 integrate
... //depot/maint-5.8/perl/proto.h#33 integrate
... //depot/maint-5.8/perl/util.c#27 integrate
Differences ...
==== //depot/maint-5.8/perl/embed.fnc#39 (text) ====
Index: perl/embed.fnc
--- perl/embed.fnc#38~20122~ Thu Jul 10 11:06:05 2003
+++ perl/embed.fnc Thu Jul 10 17:05:20 2003
@@ -854,6 +854,7 @@
p |I32 |wait4pid |Pid_t pid|int* statusp|int flags
p |U32 |parse_unicode_opts|char **popt
p |U32 |seed
+p |UV |get_seed
p |void |report_evil_fh |GV *gv|IO *io|I32 op
pd |void |report_uninit
Afpd |void |warn |const char* pat|...
==== //depot/maint-5.8/perl/embed.h#39 (text+w) ====
Index: perl/embed.h
--- perl/embed.h#38~20122~ Thu Jul 10 11:06:05 2003
+++ perl/embed.h Thu Jul 10 17:05:20 2003
@@ -1135,6 +1135,9 @@
#define seed Perl_seed
#endif
#ifdef PERL_CORE
+#define get_seed Perl_get_seed
+#endif
+#ifdef PERL_CORE
#define report_evil_fh Perl_report_evil_fh
#endif
#ifdef PERL_CORE
@@ -3644,6 +3647,9 @@
#endif
#ifdef PERL_CORE
#define seed() Perl_seed(aTHX)
+#endif
+#ifdef PERL_CORE
+#define get_seed() Perl_get_seed(aTHX)
#endif
#ifdef PERL_CORE
#define report_evil_fh(a,b,c) Perl_report_evil_fh(aTHX_ a,b,c)
==== //depot/maint-5.8/perl/embedvar.h#27 (text+w) ====
Index: perl/embedvar.h
--- perl/embedvar.h#26~20128~ Thu Jul 10 15:23:08 2003
+++ perl/embedvar.h Thu Jul 10 17:05:20 2003
@@ -593,6 +593,7 @@
#define PL_glob_index (vTHX->Iglob_index)
#define PL_globalstash (vTHX->Iglobalstash)
#define PL_hash_seed (vTHX->Ihash_seed)
+#define PL_hash_seed_set (vTHX->Ihash_seed_set)
#define PL_he_arenaroot (vTHX->Ihe_arenaroot)
#define PL_he_root (vTHX->Ihe_root)
#define PL_hintgv (vTHX->Ihintgv)
@@ -913,6 +914,7 @@
#define PL_Iglob_index PL_glob_index
#define PL_Iglobalstash PL_globalstash
#define PL_Ihash_seed PL_hash_seed
+#define PL_Ihash_seed_set PL_hash_seed_set
#define PL_Ihe_arenaroot PL_he_arenaroot
#define PL_Ihe_root PL_he_root
#define PL_Ihintgv PL_hintgv
==== //depot/maint-5.8/perl/intrpvar.h#21 (text) ====
Index: perl/intrpvar.h
--- perl/intrpvar.h#20~20115~ Thu Jul 10 08:11:29 2003
+++ perl/intrpvar.h Thu Jul 10 17:05:20 2003
@@ -558,6 +558,8 @@
PERLVARI(Ihash_seed, UV, 0) /* Hash initializer */
+PERLVARI(Ihash_seed_set, bool, FALSE) /* Hash initialized? */
+
/* New variables must be added to the very end, before this comment,
* for binary compatibility (the offsets of the old members must not change).
* (Don't forget to add your variable also to perl_clone()!)
==== //depot/maint-5.8/perl/perl.c#45 (text) ====
Index: perl/perl.c
--- perl/perl.c#44~20132~ Thu Jul 10 15:46:30 2003
+++ perl/perl.c Thu Jul 10 17:05:20 2003
@@ -1030,35 +1030,18 @@
#if defined(USE_HASH_SEED) || defined(USE_HASH_SEED_EXPLICIT)
/* [perl #22371] Algorimic Complexity Attack on Perl 5.6.1, 5.8.0
* This MUST be done before any hash stores or fetches take place. */
+ if (!PL_hash_seed_set)
+ PL_hash_seed = get_seed();
{
- bool earlytaint = doing_taint(argc, argv, env);
- char *s = NULL;
+ char *s = PerlEnv_getenv("PERL_HASH_SEED_DEBUG");
- if (!earlytaint)
- s = PerlEnv_getenv("PERL_HASH_SEED");
- if (s)
- while (isSPACE(*s)) s++;
- if (s && isDIGIT(*s))
- PL_hash_seed = (UV)Atoul(s);
-#ifndef USE_HASH_SEED_EXPLICIT
- else {
- /* Compute a random seed */
- (void)seedDrand01((Rand_seed_t)seed());
- PL_srand_called = TRUE;
- PL_hash_seed = (UV)(Drand01() * (NV)UV_MAX);
-#if RANDBITS < (UVSIZE * 8)
- /* Since there are not enough randbits to to reach all
- * the bits of a UV, the low bits might need extra
- * help. Sum in another random number that will
- * fill in the low bits. */
- PL_hash_seed +=
- (UV)(Drand01() * (NV)((1 << ((UVSIZE * 8 - RANDBITS))) - 1));
-#endif /* RANDBITS < (UVSIZE * 8) */
- }
-#endif /* #ifndef USE_HASH_SEED_EXPLICIT */
- if ((s = PerlEnv_getenv("PERL_HASH_SEED_DEBUG")))
- PerlIO_printf(Perl_debug_log, "HASH_SEED = %"UVuf"\n",
- PL_hash_seed);
+ if (s) {
+ int i = atoi(s);
+
+ if (i == 1)
+ PerlIO_printf(Perl_debug_log, "HASH_SEED = %"UVuf"\n",
+ PL_hash_seed);
+ }
}
#endif /* #if defined(USE_HASH_SEED) || defined(USE_HASH_SEED_EXPLICIT) */
==== //depot/maint-5.8/perl/perl.h#39 (text) ====
Index: perl/perl.h
--- perl/perl.h#38~20122~ Thu Jul 10 11:06:05 2003
+++ perl/perl.h Thu Jul 10 17:05:20 2003
@@ -2310,7 +2310,7 @@
/* [perl #22371] Algorimic Complexity Attack on Perl 5.6.1, 5.8.0 */
#if !defined(NO_HASH_SEED) && !defined(USE_HASH_SEED) &&
!defined(USE_HASH_SEED_EXPLICIT)
-# define USE_HASH_SEED
+# define USE_HASH_SEED_EXPLICIT
#endif
#include "regexp.h"
==== //depot/maint-5.8/perl/perlapi.h#24 (text+w) ====
Index: perl/perlapi.h
--- perl/perlapi.h#23~20122~ Thu Jul 10 11:06:05 2003
+++ perl/perlapi.h Thu Jul 10 17:05:20 2003
@@ -276,6 +276,8 @@
#define PL_globalstash (*Perl_Iglobalstash_ptr(aTHX))
#undef PL_hash_seed
#define PL_hash_seed (*Perl_Ihash_seed_ptr(aTHX))
+#undef PL_hash_seed_set
+#define PL_hash_seed_set (*Perl_Ihash_seed_set_ptr(aTHX))
#undef PL_he_arenaroot
#define PL_he_arenaroot (*Perl_Ihe_arenaroot_ptr(aTHX))
#undef PL_he_root
==== //depot/maint-5.8/perl/pod/perlrun.pod#24 (text) ====
Index: perl/pod/perlrun.pod
--- perl/pod/perlrun.pod#23~19951~ Thu Jul 3 01:47:35 2003
+++ perl/pod/perlrun.pod Thu Jul 10 17:05:20 2003
@@ -1101,12 +1101,11 @@
=item PERL_HASH_SEED
-(Since Perl 5.8.1.)
-
-Used to randomise Perl's internal hash function. To emulate the
-pre-5.8.1 behaviour, set to an integer (zero means exactly the same
-order as 5.8.0). "Pre-5.8.1" means, among other things, that hash
-keys will be ordered the same between different runs of Perl.
+(Since Perl 5.8.1.) Used to randomise Perl's internal hash function.
+To emulate the pre-5.8.1 behaviour, set to an integer (zero means
+exactly the same order as 5.8.0). "Pre-5.8.1" means, among other
+things, that hash keys will be ordered the same between different runs
+of Perl.
The default behaviour is to randomise unless the PERL_HASH_SEED is set.
If Perl has been compiled with C<-DUSE_HASH_SEED_EXPLICIT>, the default
@@ -1114,14 +1113,15 @@
If PERL_HASH_SEED is unset or set to a non-numeric string, Perl uses
the pseudorandom seed supplied by the operating system and libraries.
-If unset, each different run of Perl will have different ordering of
-the outputs of keys(), values(), and each().
+This means that each different run of Perl will have a different
+ordering of the results of keys(), values(), and each().
See L<perlsec/"Algorithmic Complexity Attacks"> for more information.
=item PERL_HASH_SEED_DEBUG
-Set to (anything) to display the value of the hash seed.
+(Since Perl 5.8.1.) Set to "1" to display (to STDERR) the value of
+the hash seed at the beginning of execution.
=item PERL_ROOT (specific to the VMS port)
==== //depot/maint-5.8/perl/proto.h#33 (text+w) ====
Index: perl/proto.h
--- perl/proto.h#32~20091~ Wed Jul 9 01:23:20 2003
+++ perl/proto.h Thu Jul 10 17:05:20 2003
@@ -814,6 +814,7 @@
PERL_CALLCONV I32 Perl_wait4pid(pTHX_ Pid_t pid, int* statusp, int flags);
PERL_CALLCONV U32 Perl_parse_unicode_opts(pTHX_ char **popt);
PERL_CALLCONV U32 Perl_seed(pTHX);
+PERL_CALLCONV UV Perl_get_seed(pTHX);
PERL_CALLCONV void Perl_report_evil_fh(pTHX_ GV *gv, IO *io, I32 op);
PERL_CALLCONV void Perl_report_uninit(pTHX);
PERL_CALLCONV void Perl_warn(pTHX_ const char* pat, ...)
==== //depot/maint-5.8/perl/util.c#27 (text) ====
Index: perl/util.c
--- perl/util.c#26~20092~ Wed Jul 9 04:41:01 2003
+++ perl/util.c Thu Jul 10 17:05:20 2003
@@ -4359,3 +4359,35 @@
return u;
}
+UV
+Perl_get_seed(void)
+{
+ char *s = PerlEnv_getenv("PERL_HASH_SEED");
+ UV myseed = 0;
+
+ if (s)
+ while (isSPACE(*s)) s++;
+ if (s && isDIGIT(*s))
+ myseed = (UV)Atoul(s);
+ else
+#ifdef USE_HASH_SEED_EXPLICIT
+ if (s)
+#endif
+ {
+ /* Compute a random seed */
+ (void)seedDrand01((Rand_seed_t)seed());
+ PL_srand_called = TRUE;
+ myseed = (UV)(Drand01() * (NV)UV_MAX);
+#if RANDBITS < (UVSIZE * 8)
+ /* Since there are not enough randbits to to reach all
+ * the bits of a UV, the low bits might need extra
+ * help. Sum in another random number that will
+ * fill in the low bits. */
+ myseed +=
+ (UV)(Drand01() * (NV)((1 << ((UVSIZE * 8 - RANDBITS))) - 1));
+#endif /* RANDBITS < (UVSIZE * 8) */
+ }
+ PL_hash_seed_set = TRUE;
+
+ return myseed;
+}
End of Patch.
