Attachment 705056 Details for Bug 884354 – Fix ported to perl-5.8.8

[patch] Fix ported to perl-5.8.8

perl-5.8.8-CVE-2012-6329.patch (text/plain), 3.05 KB, created by Petr Pisar on 2013-03-04 15:58:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Petr Pisar

Created: 2013-03-04 15:58:52 UTC

Size: 3.05 KB

patch

obsolete

>From 7ed50207fe13a6c519913c551674728a29054259 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
>Date: Mon, 4 Mar 2013 16:54:54 +0100
>Subject: [PATCH] Fix misparsing of maketext strings
>
>Case 61251: This commit fixes a misparse of maketext strings that could
>lead to arbitrary code execution.  Basically, maketext was compiling
>bracket notation into functions, but neglected to escape backslashes
>inside the content or die on fully-qualified method names when
>generating the code.  This change escapes all such backslashes and dies
>when a method name with a colon or apostrophe is specified.
>
>Petr Pisar: Ported to 1.09 bundled in perl-5.8.8.
>---
> AUTHORS                     |  1 +
> lib/Locale/Maketext/Guts.pm | 24 ++++++++----------------
> 2 files changed, 9 insertions(+), 16 deletions(-)
>
>diff --git a/AUTHORS b/AUTHORS
>index b3328d4..c892649 100644
>--- a/AUTHORS
>+++ b/AUTHORS
>@@ -103,6 +103,7 @@ Brent B. Powers			<powers@ml.com>
> Brent Dax			<brentdax@cpan.org>
> Brooks D Boyd
> Brian Callaghan			<callagh@itginc.com>
>+Brian Carlson			<brian.carlson@cpanel.net>
> Brian Clarke			<clarke@appliedmeta.com>
> Brian Grossman
> Brian Harrison			<brie@corp.home.net>
>diff --git a/lib/Locale/Maketext/Guts.pm b/lib/Locale/Maketext/Guts.pm
>index 72f0c9b..b030f71 100644
>--- a/lib/Locale/Maketext/Guts.pm
>+++ b/lib/Locale/Maketext/Guts.pm
>@@ -127,21 +127,9 @@ sub _compile {
>           if($m eq '') {
>             # 0-length method name means to just interpolate:
>             push @code, ' (';
>-          } elsif($m =~ m<^\w+(?:\:\:\w+)*$>s
>-            and $m !~ m<(?:^|\:)\d>s
>-             # exclude starting a (sub)package or symbol with a digit 
>+          elsif($m =~ /^\w+$/s
>+            # exclude anything fancy, especially fully-qualified module names
>           ) {
>-            # Yes, it even supports the demented (and undocumented?)
>-            #  $obj->Foo::bar(...) syntax.
>-            $target->_die_pointing(
>-              $_[1], "Can't (yet?) use \"SUPER::\" in a bracket-group method",
>-              2 + length($c[-1])
>-            )
>-             if $m =~ m/^SUPER::/s;
>-              # Because for SUPER:: to work, we'd have to compile this into
>-              #  the right package, and that seems just not worth the bother,
>-              #  unless someone convinces me otherwise.
>-            
>             push @code, ' $_[0]->' . $m . '(';
>           } else {
>             # TODO: implement something?  or just too icky to consider?
>@@ -189,7 +177,9 @@ sub _compile {
>       } elsif(substr($1,0,1) ne '~') {
>         # it's stuff not containing "~" or "[" or "]"
>         # i.e., a literal blob
>-        $c[-1] .= $1;
>+        my $text = $1;
>+        $text =~ s/\\/\\\\/g;
>+        $c[-1] .= $text;
>         
>       } elsif($1 eq '~~') { # "~~"
>         $c[-1] .= '~';
>@@ -219,7 +209,9 @@ sub _compile {
>       } else {
>         # It's a "~X" where X is not a special character.
>         # Consider it a literal ~ and X.
>-        $c[-1] .= $1;
>+        my $text = $1;
>+        $text =~ s/\\/\\\\/g;
>+        $c[-1] .= $text;
>       }
>     }
>   }
>-- 
>1.8.1.4
>

Actions: View | Diff

Attachments on bug 884354: 658787 | 676781 | 704920 | 705056 | 705349 | 705351