[perl/f14/master] lc launders tainted flag, RT #87336
Marcela Mašláňová
mmaslano at fedoraproject.org
Sat Apr 2 07:34:01 UTC 2011
commit 9e8feff771f05212161a83deafe84b916e357eea
Author: Marcela Mašláňová <mmaslano at redhat.com>
Date: Sat Apr 2 09:32:29 2011 +0200
lc launders tainted flag, RT #87336
...lc-uc-first-fail-to-taint-the-returned-st.patch | 62 ++++++++++++++++++++
perl.spec | 9 +++-
2 files changed, 70 insertions(+), 1 deletions(-)
---
diff --git a/perl-87336-lc-uc-first-fail-to-taint-the-returned-st.patch b/perl-87336-lc-uc-first-fail-to-taint-the-returned-st.patch
new file mode 100644
index 0000000..fde16fc
--- /dev/null
+++ b/perl-87336-lc-uc-first-fail-to-taint-the-returned-st.patch
@@ -0,0 +1,62 @@
+diff -up perl-5.12.3/pp.c.87 perl-5.12.3/pp.c
+--- perl-5.12.3/pp.c.87 2011-01-09 21:20:58.000000000 +0100
++++ perl-5.12.3/pp.c 2011-04-01 15:06:23.000000000 +0200
+@@ -3949,6 +3949,8 @@ PP(pp_ucfirst)
+ SvCUR_set(dest, need - 1);
+ }
+ }
++ if (dest != source && SvTAINTED(source))
++ SvTAINT(dest);
+ SvSETMAGIC(dest);
+ RETURN;
+ }
+@@ -4008,7 +4010,8 @@ PP(pp_uc)
+ SvUPGRADE(dest, SVt_PV);
+ d = (U8*)SvGROW(dest, min);
+ (void)SvPOK_only(dest);
+-
++ if (dest != source && SvTAINTED(source))
++ SvTAINT(dest);
+ SETs(dest);
+ }
+
+@@ -4433,6 +4436,8 @@ PP(pp_lc)
+ SvCUR_set(dest, d - (U8*)SvPVX_const(dest));
+ }
+ }
++ if (dest != source && SvTAINTED(source))
++ SvTAINT(dest);
+ SvSETMAGIC(dest);
+ RETURN;
+ }
+diff -up perl-5.12.3/t/op/taint.t.87 perl-5.12.3/t/op/taint.t
+--- perl-5.12.3/t/op/taint.t.87 2011-01-09 21:20:58.000000000 +0100
++++ perl-5.12.3/t/op/taint.t 2011-04-01 15:07:43.000000000 +0200
+@@ -17,7 +17,7 @@ use Config;
+ use File::Spec::Functions;
+
+ BEGIN { require './test.pl'; }
+-plan tests => 302;
++plan tests => 306;
+
+ $| = 1;
+
+@@ -1318,6 +1318,18 @@ foreach my $ord (78, 163, 256) {
+ unlike($err, qr/^\d+$/, 'tainted $!');
+ }
+
++{
++ # [perl #87336] lc/uc(first) failing to taint the returned string
++ my $source = "foo$TAINT";
++ my $dest = lc $source;
++ test $dest, "lc(tainted) taints its return value";
++ $dest = lcfirst $source;
++ test $dest, "lcfirst(tainted) taints its return value";
++ $dest = uc $source;
++ test $dest, "uc(tainted) taints its return value";
++ $dest = ucfirst $source;
++ test $dest, "ucfirst(tainted) taints its return value";
++}
+
+ # This may bomb out with the alarm signal so keep it last
+ SKIP: {
diff --git a/perl.spec b/perl.spec
index 8482c6b..97e57b5 100644
--- a/perl.spec
+++ b/perl.spec
@@ -12,7 +12,7 @@
Name: perl
Version: %{perl_version}
# release number must be even higher, becase dual-lived modules will be broken otherwise
-Release: 142%{?dist}
+Release: 143%{?dist}
Epoch: %{perl_epoch}
Summary: Practical Extraction and Report Language
Group: Development/Languages
@@ -66,6 +66,8 @@ Patch9: perl-5.12.2-h2ph.patch
# Update ExtUtils::ParseXS to 2.2206
Patch10: perl-ExtUtils-ParseXS-2.2206.patch
+# 692900 - lc launders tainted flag, RT #87336
+Patch11: perl-87336-lc-uc-first-fail-to-taint-the-returned-st.patch
# Update some of the bundled modules
# see http://fedoraproject.org/wiki/Perl/perl.spec for instructions
@@ -938,6 +940,7 @@ upstream tarball from perl.org.
%patch8 -p1
%patch9 -p1
%patch10 -p1
+%patch11 -p1
#
# Candidates for doc recoding (need case by case review):
@@ -1138,6 +1141,7 @@ pushd %{build_archlib}/CORE/
'Fedora Patch8: Do not leak when destroying thread; RT #77352' \
'Fedora Patch9: h2ph produces incorrect code in preamble, based mainly on RT #74614 ' \
'Fedora Patch10: Update ExtUtils::ParseXS to 2.2206' \
+ 'Fedora Patch11: lc launders tainted flag RT #87336' \
%{nil}
rm patchlevel.bak
@@ -1871,6 +1875,9 @@ rm -rf $RPM_BUILD_ROOT
# Old changelog entries are preserved in CVS.
%changelog
+* Fri Apr 1 2011 Marcela Mašláňová <mmaslano at redhat.com> - 4:5.12.3-143
+- 692900 - lc launders tainted flag, RT #87336
+
* Thu Mar 10 2011 Tom Callaway <spot at fedoraproject.org> - 4:5.12.3-142
- update ExtUtils::ParseXS to 2.2206 (current) to fix Wx build
More information about the scm-commits
mailing list