Front page | perl.perl5.porters |
Postings from March 2001
On Tue, 27 Feb 2001 14:07 -0600, Jarkko Hietaniemi wrote:
> If there are any suggested bleadperl patches that I have missed,
> please feel free to resend them.
The patch below fixes the bugs 20010221.005 and 20010221.008: "the
taint checker was checking argv[0] regardless of whether a different
pathname will actually be executed."
However the test I prepared fails due to an eval scoping bug I
guess. Unfortunately I don't have the knowledge to discover and fix
this bug.
$ cat test.pl
#!./perl -T
eval { system { "echo" } "/arg0", "arg1"; };
print "not " unless $@ =~ /^Insecure/;
print "ok 156\n";
$ ./test.pl
ok 156
not ok 156
Thanks,
Radu Greab
--- doio.c~ Sat Feb 17 18:42:21 2001
+++ doio.c Thu Feb 22 14:24:58 2001
@@ -1294,15 +1294,18 @@
*a++ = "";
}
*a = Nullch;
- if (*PL_Argv[0] != '/') /* will execvp use PATH? */
+ if (really)
+ tmps = SvPV(really, n_a);
+ if ((!really && *PL_Argv[0] != '/') ||
+ (really && *tmps != '/')) /* will execvp use PATH? */
TAINT_ENV(); /* testing IFS here is overkill, probably */
- if (really && *(tmps = SvPV(really, n_a)))
+ if (really && *tmps)
PerlProc_execvp(tmps,EXEC_ARGV_CAST(PL_Argv));
else
PerlProc_execvp(PL_Argv[0],EXEC_ARGV_CAST(PL_Argv));
if (ckWARN(WARN_EXEC))
Perl_warner(aTHX_ WARN_EXEC, "Can't exec \"%s\": %s",
- PL_Argv[0], Strerror(errno));
+ (really ? tmps : PL_Argv[0]), Strerror(errno));
if (do_report) {
int e = errno;
Thread Previous
|
Thread Next