Package: perl / 5.20.2-3+deb8u11

Metadata

Package Version Patches format
perl 5.20.2-3+deb8u11 3.0 (quilt)

Patch series

view the series file
Patch File delta Description
debian/cpan_definstalldirs.diff | (download)

cpan/CPAN/lib/CPAN/FirstTime.pm | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

 provide a sensible installdirs default for modules installed from
 CPAN.

Some modules which are included in core set INSTALLDIRS => 'perl'
explicitly in Makefile.PL or Build.PL.  This makes sense for the normal @INC
ordering, but not ours.

debian/db_file_ver.diff | (download)

cpan/DB_File/version.c | 2 2 + 0 - 0 !
1 file changed, 2 insertions(+)

 remove overly restrictive db_file version check.

Bug-Debian: http://bugs.debian.org/340047

Package dependencies ensure the correct library is linked at run-time.

debian/doc_info.diff | (download)

pod/perl.pod | 12 10 + 2 - 0 !
1 file changed, 10 insertions(+), 2 deletions(-)

 replace generic man(1) instructions with debian-specific information.

Indicate that the user needs to install the perl-doc package.

debian/enc2xs_inc.diff | (download)

cpan/Encode/bin/enc2xs | 8 4 + 4 - 0 !
t/porting/customized.t | 3 3 + 0 - 0 !
2 files changed, 7 insertions(+), 4 deletions(-)

 tweak enc2xs to follow symlinks and ignore missing @inc directories.

Bug-Debian: http://bugs.debian.org/290336

- ignore missing directories,
- follow symlinks (/usr/share/perl/5.8 -> 5.8.4).
- filter "." out when running "enc2xs -C", it's unnecessary and causes
  issues with follow => 1 (see #603686 and [rt.cpan.org #64585])

debian/errno_ver.diff | (download)

ext/Errno/Errno_pm.PL | 5 0 + 5 - 0 !
1 file changed, 5 deletions(-)

 remove errno version check due to upgrade problems with long-running
 processes.

Bug-Debian: http://bugs.debian.org/343351

Remove version check which can cause problems for long running
processes embedding perl when upgrading to a newer version,
debian/libperl_embed_doc.diff | (download)

lib/ExtUtils/Embed.pm | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 note that libperl-dev package is required for embedded linking

Bug-Debian: http://bugs.debian.org/186778

fixes/respect_umask.diff | (download)

cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Unix.pm | 18 9 + 9 - 0 !
dist/ExtUtils-Install/lib/ExtUtils/Install.pm | 18 9 + 9 - 0 !
2 files changed, 18 insertions(+), 18 deletions(-)

 respect umask during installation

This is needed to satisfy Debian policy regarding group-writable
site directories.

debian/writable_site_dirs.diff | (download)

cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Unix.pm | 6 3 + 3 - 0 !
1 file changed, 3 insertions(+), 3 deletions(-)

 set umask approproately for site install directories

Policy requires group writable site directories

debian/extutils_set_libperl_path.diff | (download)

cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Unix.pm | 2 1 + 1 - 0 !
pp.c | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

 eu:mm: set location of libperl.a under /usr/lib

The Debian packaging moves libperl.a a couple of levels up from the
CORE directory to match other static libraries.

debian/no_packlist_perllocal.diff | (download)

cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Unix.pm | 36 4 + 32 - 0 !
1 file changed, 4 insertions(+), 32 deletions(-)

 don't install .packlist or perllocal.pod for perl or vendor

debian/prefix_changes.diff | (download)

cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Any.pm | 12 6 + 6 - 0 !
cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Unix.pm | 3 1 + 2 - 0 !
cpan/ExtUtils-MakeMaker/t/INST.t | 4 1 + 3 - 0 !
cpan/ExtUtils-MakeMaker/t/INST_PREFIX.t | 10 5 + 5 - 0 !
4 files changed, 13 insertions(+), 16 deletions(-)

 fiddle with *prefix and variables written to the makefile

Fiddle with *PREFIX and variables written to the makefile so that
install directories may be changed when make is run by passing
PREFIX= to the "make install" command (used when packaging
modules).

debian/fakeroot.diff | (download)

Makefile.SH | 7 2 + 5 - 0 !
1 file changed, 2 insertions(+), 5 deletions(-)

 postpone ld_library_path evaluation to the binary targets.

Modify the setting of LD_LIBRARY_PATH to append pre-existing values at the
time the rule is evaluated rather than when the Makefile is created.

This is required when building packages with dpkg-buildpackage and fakeroot,
since fakeroot (which now sets LD_LIBRARY_PATH) is not used for the "build"
rule where the Makefile is created, but is for the clean/binary* targets.

debian/instmodsh_doc.diff | (download)

cpan/ExtUtils-MakeMaker/bin/instmodsh | 4 3 + 1 - 0 !
1 file changed, 3 insertions(+), 1 deletion(-)

 debian policy doesn't install .packlist files for core or vendor.

debian/ld_run_path.diff | (download)

cpan/ExtUtils-MakeMaker/lib/ExtUtils/Liblist/Kid.pm | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 remove standard libs from ld_run_path as per debian policy.

debian/libnet_config_path.diff | (download)

cpan/libnet/Net/Config.pm | 7 3 + 4 - 0 !
1 file changed, 3 insertions(+), 4 deletions(-)

 set location of libnet.cfg to /etc/perl/net as /usr may not be
 writable.

debian/mod_paths.diff | (download)

perl.c | 58 58 + 0 - 0 !
1 file changed, 58 insertions(+)

 tweak @inc ordering for debian

Our order is:

    etc (for config files)
    site (5.8.1)
    vendor (all)
    core (5.8.1)
    site (version-indep)
    site (pre-5.8.1)

The rationale being that an admin (via site), or module packager
(vendor) can chose to shadow core modules when there is a newer
version than is included in core.

debian/module_build_man_extensions.diff | (download)

cpan/Module-Build/lib/Module/Build/Base.pm | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

 adjust module::build manual page extensions for the debian perl
 policy

Bug-Debian: http://bugs.debian.org/479460

debian/prune_libs.diff | (download)

Configure | 5 2 + 3 - 0 !
1 file changed, 2 insertions(+), 3 deletions(-)

 prune the list of libraries wanted to what we actually need.

Bug-Debian: http://bugs.debian.org/128355

We want to keep the dependencies on perl-base as small as possible,
and some of the original list may be present on buildds (see Bug#128355).

fixes/net_smtp_docs.diff | (download)

cpan/libnet/Net/SMTP.pm | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 document the net::smtp 'port' option

Bug-Debian: http://bugs.debian.org/100195
Bug: http://rt.cpan.org/Public/Bug/Display.html?id=36038

debian/perlivp.diff | (download)

utils/perlivp.PL | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 make perlivp skip include directories in /usr/local

Bug-Debian: http://bugs.debian.org/510895

On Sat, Jan 10, 2009 at 12:37:18AM +1100, Brendan O'Dea wrote:
> On Wed, Jan 7, 2009 at 12:21 AM, Niko Tyni <ntyni@debian.org> wrote:

> > We could create the directories in a postinst script, but I'm not sure
> > I see the point. They will be created automatically when installing
> > CPAN modules.
>
> The directories are intentionally not created, as this way they are
> excluded from the search path at start-up, saving a bunch of wasted
> stats at use/require time in the common case that the user has not
> installed any local packages.  As Niko points out, they will be
> created as required.

Signed-off-by: Niko Tyni <ntyni@debian.org>

debian/deprecate with apt.diff | (download)

lib/deprecate.pm | 25 24 + 1 - 0 !
1 file changed, 24 insertions(+), 1 deletion(-)

 point users to debian packages of deprecated core modules

Bug-Debian: http://bugs.debian.org/747628

Several modules are being deprecated with perl 5.20.
To get a clean transition, perl/perl-modules is going to recommend the
separate Debian packages of these for one release cycle so that they will be
pulled in by default on upgrades. This is taking place for perl 5.20/jessie.

However, on systems configured to ignore recommendations the deprecation
warnings will still be useful, so modify them slightly to point to the
separate packages instead.

debian/squelch locale warnings.diff | (download)

locale.c | 4 4 + 0 - 0 !
pod/perllocale.pod | 8 8 + 0 - 0 !
2 files changed, 12 insertions(+)

 squelch locale warnings in debian package maintainer scripts

Bug-Debian: http://bugs.debian.org/508764

The system locales are rather frequently out of sync with the C library
during package upgrades, causing a huge amount of useless Perl locale
warnings. Squelch them when running package maintainer scripts, detected
by the DPKG_RUNNING_VERSION environment variable.

Any real locale problem will show up after the system upgrade too, and
the warning will be triggered normally again at that point.

debian/skip upstream git tests.diff | (download)

t/test.pl | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 skip tests specific to the upstream git repository

debian/patchlevel.diff | (download)

patchlevel.h | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 list packaged patches in patchlevel.h

debian/skip kfreebsd crash.diff | (download)

t/op/threads.t | 4 4 + 0 - 0 !
1 file changed, 4 insertions(+)

 skip a crashing test case in t/op/threads.t on gnu/kfreebsd

Bug: http://rt.perl.org/rt3/Ticket/Display.html?id=96272
Bug-Debian: http://bugs.debian.org/628493

The crash is not a regression in 5.14, it just gets triggered there by
a new unrelated test case.

Skip the test until the culprit is found.

fixes/document_makemaker_ccflags.diff | (download)

cpan/ExtUtils-MakeMaker/lib/ExtUtils/MakeMaker.pm | 4 4 + 0 - 0 !
1 file changed, 4 insertions(+)

 document that ccflags should include $config{ccflags}

Bug: https://rt.cpan.org/Public/Bug/Display.html?id=68613
Bug-Debian: http://bugs.debian.org/628522

Compiling XS extensions without $Config{ccflags} can break the
binary interface on some platforms.

debian/find_html2text.diff | (download)

cpan/CPAN/lib/CPAN/Distribution.pm | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 configure cpan::distribution with correct name of html2text

Bug-Debian: http://bugs.debian.org/640479
debian/perl5db x terminal emulator.patch | (download)

lib/perl5db.pl | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 invoke x-terminal-emulator rather than xterm in perl5db.pl

In Debian systems, xterm might not exist or might not be the preferred
terminal emulator. Use x-terminal-emulator instead

Bug-Debian: http://bugs.debian.org/668490
debian/cpan missing site dirs.diff | (download)

cpan/CPAN/lib/CPAN/FirstTime.pm | 31 27 + 4 - 0 !
1 file changed, 27 insertions(+), 4 deletions(-)

 fix cpan::firsttime defaults with nonexisting site dirs if a parent
 is writable

The site directories do not exist on a typical Debian system.  The build
systems will create them when necessary, so there's no need for a prompt
suggesting local::lib if the first existing parent directory is writable.

Also, writability of the core directories is not interesting as we
explicitly tell CPAN not to touch those with INSTALLDIRS=site.

Bug-Debian: http://bugs.debian.org/688842
fixes/memoize_storable_nstore.diff | (download)

cpan/Memoize/Memoize/Storable.pm | 2 1 + 1 - 0 !
cpan/Memoize/t/tie_storable.t | 24 20 + 4 - 0 !
2 files changed, 21 insertions(+), 5 deletions(-)

 memoize::storable: respect 'nstore' option not respected
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Memoize(3perl) says:

                tie my %cache => 'Memoize::Storable', $filename, 'nstore';
                memoize 'function', SCALAR_CACHE => [HASH => \%cache];

        Include the nstore option to have the "Storable" database
        written in network order.  (See Storable for more details
        about this.)

In fact the "nstore" option does no such thing.  Option parsing looks
like this:

        @options{@_} = ();

$self->{OPTIONS}{'nstore'} is accordingly set to undef.  Later
Memoize::Storable checks if the option is true, and since undef is
not true, the "else" branch is always taken.

        if ($self->{OPTIONS}{'nstore'}) {
                Storable::nstore($self->{H}, $self->{FILENAME});
        } else {
                Storable::store($self->{H}, $self->{FILENAME});
        }

Correcting the condition to (exists $self->{OPTIONS}{'nstore'}) fixes
it.

Noticed because git-svn, which uses the 'nstore' option for its
on-disk caches, was producing

        Byte order is not compatible at ../../lib/Storable.pm

debian/regen skip.diff | (download)

regen/lib_cleanup.pl | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 skip a regeneration check in unrelated git repositories

If the test is run in a git repository without lib/.gitignore,
for instance because the repository only imported the Perl tarball,
the regeneration check is broken because lib/.gitignore is missing.

fixes/regcomp mips optim.diff | (download)

cflags.SH | 5 5 + 0 - 0 !
1 file changed, 5 insertions(+)

 downgrade the optimization of regcomp.c on mips and mipsel due to a
 gcc-4.9 bug

  % cat ~/t.pl
  print ( (q{foo'} =~ /[^']+'/) ?  "ok\n" : "not ok\n" );
  % perl ~/t.pl
  ok
  % ./miniperl ~/t.pl
  not ok

This only happens with -fPIC -ftree-vrp builds.
It is a regression from gcc-4.8.

Bug-Debian: http://bugs.debian.org/754054
Bug: https://rt.perl.org/Ticket/Display.html?id=122817
debian/makemaker pasthru.diff | (download)

cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Unix.pm | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 pass ld settings through to subdirectories

[rt.cpan.org #28632] fixed most issues with passing LD down to
subdirectory Makefile.PL files. However, there are some distributions
(including Wx, Par::Packer, and Verilog-Perl) that explicitly set
LD. Those still can't be overridden from the command line. Adding LD to
the PASTHRU list fixes this.

Bug-Debian: https://bugs.debian.org/758471
fixes/perldoc less R.diff | (download)

cpan/Pod-Perldoc/lib/Pod/Perldoc.pm | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 tell the 'less' pager to allow terminal escape sequences

The 'ToTerm' backend generates terminal escape sequences that
the 'less' pager does not display by default. The "-R" option
controls this, so pass it in the LESS environment variable
to avoid disturbing other pager invocations.

Bug-Debian: https://bugs.debian.org/758689
Bug: https://rt.cpan.org/Public/Bug/Display.html?id=98636
fixes/pod_man_reproducible_date.diff | (download)

cpan/podlators/lib/Pod/Man.pm | 69 51 + 18 - 0 !
cpan/podlators/t/devise-date.t | 29 21 + 8 - 0 !
2 files changed, 72 insertions(+), 26 deletions(-)

 support pod_man_date in pod::man for the left-hand footer

Honor the environment variable POD_MAN_DATE and use its contents, if
set, as the value of the left-hand footer if the date option is not
set, overriding the timestamp of the input file.  This is primarily
useful to ensure reproducible builds of the same output file given the
same souce and Pod::Man version, even when file timestamps may not be
consistent.  Thanks, Niko Tyni.

Bug-Debian: http://bugs.debian.org/759405
fixes/io_uncompress_gunzip_inmemory.diff | (download)

cpan/IO-Compress/lib/IO/Uncompress/Base.pm | 3 2 + 1 - 0 !
cpan/IO-Compress/t/compress/oneshot.pl | 27 25 + 2 - 0 !
2 files changed, 27 insertions(+), 3 deletions(-)

 fix gunzip to in-memory file handle

Bug: https://rt.cpan.org/Public/Bug/Display.html?id=95494
Bug-Debian: http://bugs.debian.org/747363
fixes/socket_test_recv_fix.diff | (download)

t/io/socket.t | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 compare recv return value to peername in socket test

Bug: https://rt.perl.org/Public/Bug/Display.html?id=122657
Bug-Debian: https://bugs.debian.org/758718
fixes/hurd_socket_recv_todo.diff | (download)

t/io/socket.t | 15 11 + 4 - 0 !
1 file changed, 11 insertions(+), 4 deletions(-)

 todo checking the result of recv() on hurd

Bug: https://rt.perl.org/Public/Bug/Display.html?id=122657
Bug-Debian: https://bugs.debian.org/758718
fixes/regexp performance.diff | (download)

regexec.c | 124 45 + 79 - 0 !
1 file changed, 45 insertions(+), 79 deletions(-)

 simpify and speed up /.*.../ handling

See RT ##123743.

A pattern that starts /.*/ has a fake MBOL or SBOL flag added, along
with PREGf_IMPLICIT.

The idea is that, with /.*.../s, if the NFA don't match when started at
pos 0, then it's not going to match if started at any other position
either; while /.*.../ won't match at any other start position up until
the next \n.

However, the branch in regexec() that implemented this was a bit a mess
(like much in the perl core, it had gradually accreted), and caused
intuit-enabled /.*.../ and /.*...patterns to go quadratic.

The branch looked roughly like:

    if (anchored) {
        if (regtry(s)) goto success;
        if (can_intuit) {
            while (s < end) {
                s = intuit(s+1);
                if (!s) goto fail;
                if (regtry(s)) goto success;
            }
        }
        else {
            while (s < end) {
                s = skip_to_next_newline(s);
                if (regtry(s)) goto success;
            }
        }
    }

The problem is that in the presence of a .* at the start of the pattern,
intuit() will always return either NULL on failure, or the start position,
rather than any later position. So the can_intuit branch above calls
regtry() on every character position.

This commit fixes this by changing the structure of the code to be like
this, where it only tries things on newline boundaries:

    if (anchored) {
        if (regtry(s)) goto success;
        while (1) {
            s = skip_to_next_newline(s);
            if (can_intuit) {
                s = intuit(s+1);
                if (!s) goto fail;
            }
            if (regtry(s)) goto success;
        }
    }

This makes the code a lot simpler, and mostly avoids quadratic behaviour
(you can still get it with a string consisting mainly of newlines).

(backported for 5.20.1 by Niko Tyni <ntyni@debian.org>)

Bug: https://rt.perl.org/Public/Bug/Display.html?id=123743
Bug-Debian: https://bugs.debian.org/777556
fixes/failed_require_diagnostics.diff | (download)

pp_ctl.c | 3 2 + 1 - 0 !
1 file changed, 2 insertions(+), 1 deletion(-)

 report inaccesible file on failed require
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 2433d39e6 (require should die if a file exists but can't be
read) made first failed opened file fatal as request in
[perl #113422]. However error message produced in that case is not
much helpful in identifying which file ound not been accessed:

    $ LANG=C perl -I/root -e 'require strict'
    Can't locate strict.pm:   Permission denied at -e line 1.

This patch adds the name of the failed file to the message to help
identify which @INC directory is erroneous:

    $ LANG=C ./perl -I/root -I./lib -e 'require strict'
    Can't locate strict.pm:   /root/strict.pm: Permission denied at -e line 1.

Signed-off-by: Petr Psa <ppisar@redhat.com>

Bug: https://rt.perl.org/Public/Bug/Display.html?id=123270
Bug-Debian: http://bugs.debian.org/781120
fixes/array cloning.diff | (download)

sv.c | 2 1 + 1 - 0 !
t/op/threads.t | 8 7 + 1 - 0 !
2 files changed, 8 insertions(+), 2 deletions(-)

 fix cloning arrays with unused elements

ce0d59fd changed arrays to use NULL instead of &PL_sv_undef for
unused elements, unfortunately it missed updating sv_dup_common()'s
initialization of unused elements, leaving them as &PL_sv_undef.

This resulted in modification of read only value errors at runtime.

fixes/perldb threads.diff | (download)

lib/perl5db.pl | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 lib/perl5db.pl: restore noop lock prototype

cde405a6b9b86bd8110f63531b42d89590a4c56e removed the lock prototype
"because it's already a do-nothing weak keyword without threads".
However, that causes "perl -d threaded-script.pl" to complain

    lock can only be used on shared values at /usr/share/perl/5.20/perl5db.pl line 4101.
    BEGIN failed--compilation aborted at threaded-script.pl line 2.
    lock can only be used on shared values at /usr/share/perl/5.20/perl5db.pl line 2514.
    END failed--call queue aborted at threaded-script.pl line 2.
    Unbalanced scopes: 3 more ENTERs than LEAVEs

because threaded-script.pl's importing of threads::shared enable's
lock()'s non-noop behavior.  Restoring the lock() prototype fixes the
inconsistency between lock() and share() usage.

Signed-off-by: James McCoy <vega.james@gmail.com>

fixes/CVE 2015 8607_file_spec_taint_fix.diff | (download)

dist/PathTools/Cwd.xs | 1 1 + 0 - 0 !
dist/PathTools/t/taint.t | 19 18 + 1 - 0 !
2 files changed, 19 insertions(+), 1 deletion(-)

 ensure file::spec::canonpath() preserves taint

Previously the unix specific XS implementation of canonpath() would
return an untainted path when supplied a tainted path.

For the empty string case, newSVpvs() already sets taint as needed on
its result.

fixes/encode unicode bom.diff | (download)

cpan/Encode/Unicode/Unicode.pm | 8 7 + 1 - 0 !
cpan/Encode/Unicode/Unicode.xs | 16 13 + 3 - 0 !
2 files changed, 20 insertions(+), 4 deletions(-)

 address https://rt.cpan.org/public/bug/display.html?id=107043

Backported to Encode 2.72 by Niko Tyni <ntyni@debian.org>

debian/encode unicode bom doc.diff | (download)

cpan/Encode/Unicode/Unicode.pm | 4 3 + 1 - 0 !
1 file changed, 3 insertions(+), 1 deletion(-)

 document debian backport of encode::unicode fix

Bug-Debian: https://bugs.debian.org/798727
debian/kfreebsd softupdates.diff | (download)

t/op/stat.t | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 work around debian bug#796798

kFreeBSD 10 (possibly only with softupdates enabled) may defer
calculating the mtime for more than 2 seconds.  Work around this
with a stat() call to calculate the mtime immediately.

(Modified to only stat() on kfreebsd by Niko Tyni)

Bug-Debian: https://bugs.debian.org/796798
fixes/CVE 2016 2381_duplicate_env.diff | (download)

perl.c | 51 49 + 2 - 0 !
1 file changed, 49 insertions(+), 2 deletions(-)

 remove duplicate environment variables from environ

If we see duplicate environment variables while iterating over
environ[]:

a) make sure we use the same value in %ENV that getenv() returns.

Previously on a duplicate, %ENV would have the last entry for the name
from environ[], but a typical getenv() would return the first entry.

Rather than assuming all getenv() implementations return the first entry
explicitly call getenv() to ensure they agree.

b) remove duplicate entries from environ

Previously if there was a duplicate definition for a name in environ[]
setting that name in %ENV could result in an unsafe value being passed
to a child process, so ensure environ[] has no duplicates.

debian/debugperl compat fix.diff | (download)

perl.h | 4 3 + 1 - 0 !
1 file changed, 3 insertions(+), 1 deletion(-)

 disable perl_track_mempool for debugging builds

This is a workaround for an ABI incompatibility between
-DDEBUGGING and normal builds.

Bug-Debian: https://bugs.debian.org/810326
Bug: https://rt.perl.org/Public/Bug/Display.html?id=127212
fixes/CVE 2015 8853_regexp_hang.diff | (download)

regexec.c | 12 12 + 0 - 0 !
t/re/pat.t | 19 18 + 1 - 0 !
2 files changed, 30 insertions(+), 1 deletion(-)

 patch [perl #123562] regexp-matching "hangs"

The regex engine got into an infinite loop because of the malformation.
It is trying to back-up over a sequence of UTF-8 continuation bytes.
But the character just before the sequence should be a start byte.  If
not, there is a malformation.  I added a test to croak if that isn't the
case so that it doesn't just infinitely loop.  I did this also in the
similar areas of regexec.c.

Comments long ago added to the code suggested that we check for
malformations in the vicinity of the new tests.  But that was never
done.  These new tests should be good enough to prevent looping, anyway.

(cherry picked from commit 22b433eff9a1ffa2454e18405a56650f07b385b5)

Bug: https://rt.perl.org/Ticket/Display.html?id=123562
Bug-Debian: https://bugs.debian.org/821848
fixes/utf8_regexp_crash.diff | (download)

MANIFEST | 1 1 + 0 - 0 !
regcomp.c | 21 18 + 3 - 0 !
t/porting/re_context.t | 43 43 + 0 - 0 !
t/re/pat_advanced.t | 13 13 + 0 - 0 !
4 files changed, 75 insertions(+), 3 deletions(-)

 save_re_context(): do "local $n" with no pl_curpm

RT #124109.

2c1f00b9036 localised PL_curpm to NULL when calling swash init code
(i.e. perl-level code that is loaded and executed when something
like "lc $large_codepoint" is executed).

b4fa55d3f1 followed this up by gutting Perl_save_re_context(), since
that function did, basically,

    if (PL_curpm) {
        for (i = 1; i <= RX_NPARENS(PM_GETRE(PL_curpm))) {
            do the C equivalent of the perl code "local ${i}";
        }
    }

and now that PL_curpm was null, the code wasn't called any more.  However,
it turns out that the localisation *was* still needed, it's just that
nothing in the test suite actually tested for it.

In something like the following:

    $x = "\x{41c}";
    $x =~ /(.*)/;
    $s = lc $1;

pp_lc() calls get magic on $1, which sets $1's PV value to a copy of the
substring captured by the current pattern match.
Then pp_lc() calls a function to convert the string to upper case, which
triggers a swash load, which calls perl code that does a pattern match
and, most importantly, uses the value of $1. This triggers get magic on
$1, which overwrites $1's PV value with a new value. When control returns
to pp_lc(), $1 now holds the wrong string value.

Hence $1, $2 etc need localising as well as PL_curpm.

The old way that Perl_save_re_context() used to work (localising
$1..${RX_NPARENS}) won't work directly when PL_curpm is NULL (as in the
swash case), since we don't know how many vars to localise.

In this case, hard-code it as localising $1,$2,$3 and add a porting
test file that checks that the utf8.pm code and dependences don't
use anything outside those 3 vars.

(cherry picked from commit 3553f4fa11fd9e8bb0797ace43605cc33ebf32fa)

Bug: https://rt.perl.org/Ticket/Display.html?id=124109
Bug-Debian: https://bugs.debian.org/820328
fixes/regcomp_whitespace_fix.diff | (download)

regcomp.c | 28 12 + 16 - 0 !
1 file changed, 12 insertions(+), 16 deletions(-)

 perl_save_re_context(): re-indent after last commit

whitespace-only change.

(cherry picked from commit 4e0341d2ce817c9956f7f78e36bcaf8b764e18fc)

Bug: https://rt.perl.org/Ticket/Display.html?id=124109
Bug-Debian: https://bugs.debian.org/820328
fixes/5.20.3/eval_label_crash.diff | (download)

op.c | 2 1 + 1 - 0 !
t/comp/parser.t | 3 3 + 0 - 0 !
2 files changed, 4 insertions(+), 1 deletion(-)

 eval {label:} crash

As of v5.13.6-130-geae48c8, the block consists solely of a
nextstate op.

The code in ck_eval that distinguished between eval-block and eval-
string was checking the type of the kid op (looking for lineseq or
stub) instead of simply checking the type of the op itself (entertry/
entereval).

The lexer was already making the distinction between the two but op.c
was ignoring the information provided by the lexer.

Usually

  entertry(unop)
    kid

gets converted into

  leavetry
    entertry(logop)
    kid

with the entertry reallocated as a larger-sized op, but that was not
happening.  The peephole optimiser assumed it had happened, and fol-
lowed the cLOGOPo->op_other pointer, which is unrelated junk beyond
the end of the unop struct.  Hence the crash.
(cherry picked from commit 2f465e08eb39981706429873d24e3bcc18015bfb)

Bug: https://rt.perl.org/Ticket/Display.html?id=123652
Bug-Debian: https://bugs.debian.org/822336
fixes/5.20.3/preserve_record_separator.diff | (download)

mg.c | 1 1 + 0 - 0 !
t/base/rs.t | 11 9 + 2 - 0 !
2 files changed, 10 insertions(+), 2 deletions(-)

 "preserve" $/ if set to a bad value

and base/rs.t tests $/ not $!

(cherry picked from commit 5fe499a8e26270679c0c6d48431f3a328a8ffeba)

Bug: https://rt.perl.org/Ticket/Display.html?id=123218
Bug-Debian: https://bugs.debian.org/822336
fixes/5.20.3/test_count_base_rs.diff | (download)

t/base/rs.t | 3 1 + 2 - 0 !
1 file changed, 1 insertion(+), 2 deletions(-)

 fix test count in t/base/rs.t

Commit da902b5900 cherry-picked 5fe499a8e2, but I got the conflict
resolution wrong. Now resolved correctly after looking at blead commit
0b81c0dda6, which made corrections to the test counting/skipping.

Bug-Debian: https://bugs.debian.org/822336
fixes/5.20.3/remove_get_magic.diff | (download)

mg.c | 3 1 + 2 - 0 !
1 file changed, 1 insertion(+), 2 deletions(-)

 remove get-magic from $/
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fixes/5.20.3/speed_up_scalar_g.diff | (download)

MANIFEST | 1 1 + 0 - 0 !
embed.fnc | 1 1 + 0 - 0 !
embed.h | 1 1 + 0 - 0 !
inline.h | 24 24 + 0 - 0 !
mg.h | 2 1 + 1 - 0 !
proto.h | 5 5 + 0 - 0 !
t/perf/taint.t | 42 42 + 0 - 0 !
7 files changed, 75 insertions(+), 1 deletion(-)

 speed up scalar //g against tainted strings

(cherry picked from commit ed38223246c041b4e9ce5687cadf6f6b903050ca)

Bug: https://rt.perl.org/Ticket/Display.html?id=123202
Bug-Debian: https://bugs.debian.org/822336
fixes/5.20.3/accidental_all_features.diff | (download)

hv.c | 3 2 + 1 - 0 !
t/lib/feature/bundle | 8 8 + 0 - 0 !
2 files changed, 10 insertions(+), 1 deletion(-)

 stop $^h |= 0x1c020000 from enabling all features
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

That set of bits sets the feature bundle to custom, which means that
the features are set by %^H, and also indicates that %^H has been did-
dled with, so its worth looking at.

In the specific case where %^H is untouched and there is no corres-
ponding cop hint hash behind the scenes, Perl_feature_is_enabled (in
toke.c) ends up returning TRUE.

Commit v5.15.6-55-g94250ae sped up feature checking by allowing
refcounted_he_fetch to return a boolean when checking for existence,
instead of converting the value to a scalar, whose contents we are not
even going to use.

This was when the bug started happening.  I did not update the code
path in refcounted_he_fetch that handles the absence of a hint hash.
So it was returning &PL_sv_placeholder instead of NULL; TRUE instead
of FALSE.

This did not cause problems for most code, but with the introduction
of the new bitwise ops in v5.21.8-150-g8823cb8, it started causing
uni::perl to fail, because they were implicitly enabled, making ^ a
numeric op, when it was being used as a string op.

(cherry picked from commit 71622e40793536aa4f2ace7ffc704cc78151fd26)

Bug-Debian: https://bugs.debian.org/822336
fixes/5.20.3/multidimensional_arrays_utf8.diff | (download)

t/lib/warnings/toke | 10 10 + 0 - 0 !
toke.c | 2 1 + 1 - 0 !
2 files changed, 11 insertions(+), 1 deletion(-)

 make check for multi-dimensional arrays be utf8-aware

During parsing, toke.c checks if the user is attempting provide multiple
fixes/5.20.3/unquoted_utf8_heredoc_terminators.diff | (download)

t/lib/warnings/toke | 11 11 + 0 - 0 !
toke.c | 10 7 + 3 - 0 !
2 files changed, 18 insertions(+), 3 deletions(-)

 allow unquoted utf-8 here-document terminators
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When not explicitly quoted, tokenization of the HERE-document terminator
dealt improperly with multi-byte characters, advancing one byte at a
time instead of one character at a time.  This lead to
incomprehensible-to-the-user errors of the form:

    Passing malformed UTF-8 to "XPosixWord" is deprecated
    Malformed UTF-8 character (unexpected continuation byte 0xa7, with
      no preceding start byte)
    Can't find string terminator "EnFra" anywhere before EOF

If enclosed in single or double quotes, parsing was correctly effected,
as delimcpy advances byte-by-byte, but looks only for the single-byte
ending character.

When doing a \w+ match looking for the end of the word, advance
character-by-character instead of byte-by-byte, ensuring that the size
does not extend past the available size in PL_tokenbuf.

(cherry picked from commit 6e59c8626d31f697a2b7b36cf8a200b36d93eac2)

Bug-Debian: https://bugs.debian.org/822336
fixes/5.20.3/parentheses_ambiguous_warning_utf8_functions.diff | (download)

t/lib/warnings/toke | 10 10 + 0 - 0 !
toke.c | 2 1 + 1 - 0 !
2 files changed, 11 insertions(+), 1 deletion(-)

 fix "...without parentheses is ambuguous" warning for utf-8 function
 names
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While isWORDCHAR_lazy_if is UTF-8 aware, checking advanced byte-by-byte.
This lead to errors of the form:

   Passing malformed UTF-8 to "XPosixWord" is deprecated
   Malformed UTF-8 character (unexpected continuation byte 0x9d, with
     no preceding start byte)
   Warning: Use of "" without parentheses is ambiguous

Use UTF8SKIP to advance character-by-character, not byte-by-byte.

(cherry picked from commit 8ce2ba821761a7ada1e1def512c0374977759cf7)

Bug-Debian: https://bugs.debian.org/822336