summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/perl/perl-5.14.3/0001-Fix-misparsing-of-maketext-strings.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/perl/perl-5.14.3/0001-Fix-misparsing-of-maketext-strings.patch')
-rw-r--r--meta/recipes-devtools/perl/perl-5.14.3/0001-Fix-misparsing-of-maketext-strings.patch86
1 files changed, 86 insertions, 0 deletions
diff --git a/meta/recipes-devtools/perl/perl-5.14.3/0001-Fix-misparsing-of-maketext-strings.patch b/meta/recipes-devtools/perl/perl-5.14.3/0001-Fix-misparsing-of-maketext-strings.patch
new file mode 100644
index 0000000..89ec6ef
--- /dev/null
+++ b/meta/recipes-devtools/perl/perl-5.14.3/0001-Fix-misparsing-of-maketext-strings.patch
@@ -0,0 +1,86 @@
1From 1735f6f53ca19f99c6e9e39496c486af323ba6a8 Mon Sep 17 00:00:00 2001
2From: Brian Carlson <brian.carlson@cpanel.net>
3Date: Wed, 28 Nov 2012 08:54:33 -0500
4Subject: [PATCH] Fix misparsing of maketext strings.
5
6Case 61251: This commit fixes a misparse of maketext strings that could
7lead to arbitrary code execution. Basically, maketext was compiling
8bracket notation into functions, but neglected to escape backslashes
9inside the content or die on fully-qualified method names when
10generating the code. This change escapes all such backslashes and dies
11when a method name with a colon or apostrophe is specified.
12---
13 AUTHORS | 1 +
14 dist/Locale-Maketext/lib/Locale/Maketext.pm | 24 ++++++++----------------
15 2 files changed, 9 insertions(+), 16 deletions(-)
16
17Upstream-Status: Backport
18
19Signed-off-by: Saul Wold <sgw@linux.intel.com>
20
21
22diff --git a/AUTHORS b/AUTHORS
23index 70734b0..009dea0 100644
24--- a/AUTHORS
25+++ b/AUTHORS
26@@ -154,6 +154,7 @@ Breno G. de Oliveira <garu@cpan.org>
27 Brent Dax <brentdax@cpan.org>
28 Brooks D Boyd
29 Brian Callaghan <callagh@itginc.com>
30+Brian Carlson <brian.carlson@cpanel.net>
31 Brian Clarke <clarke@appliedmeta.com>
32 brian d foy <brian.d.foy@gmail.com>
33 Brian Fraser <fraserbn@gmail.com>
34diff --git a/dist/Locale-Maketext/lib/Locale/Maketext.pm b/dist/Locale-Maketext/lib/Locale/Maketext.pm
35index 4822027..63e5fba 100644
36--- a/dist/Locale-Maketext/lib/Locale/Maketext.pm
37+++ b/dist/Locale-Maketext/lib/Locale/Maketext.pm
38@@ -625,21 +625,9 @@ sub _compile {
39 # 0-length method name means to just interpolate:
40 push @code, ' (';
41 }
42- elsif($m =~ /^\w+(?:\:\:\w+)*$/s
43- and $m !~ m/(?:^|\:)\d/s
44- # exclude starting a (sub)package or symbol with a digit
45+ elsif($m =~ /^\w+$/s
46+ # exclude anything fancy, especially fully-qualified module names
47 ) {
48- # Yes, it even supports the demented (and undocumented?)
49- # $obj->Foo::bar(...) syntax.
50- $target->_die_pointing(
51- $string_to_compile, q{Can't use "SUPER::" in a bracket-group method},
52- 2 + length($c[-1])
53- )
54- if $m =~ m/^SUPER::/s;
55- # Because for SUPER:: to work, we'd have to compile this into
56- # the right package, and that seems just not worth the bother,
57- # unless someone convinces me otherwise.
58-
59 push @code, ' $_[0]->' . $m . '(';
60 }
61 else {
62@@ -693,7 +681,9 @@ sub _compile {
63 elsif(substr($1,0,1) ne '~') {
64 # it's stuff not containing "~" or "[" or "]"
65 # i.e., a literal blob
66- $c[-1] .= $1;
67+ my $text = $1;
68+ $text =~ s/\\/\\\\/g;
69+ $c[-1] .= $text;
70
71 }
72 elsif($1 eq '~~') { # "~~"
73@@ -731,7 +721,9 @@ sub _compile {
74 else {
75 # It's a "~X" where X is not a special character.
76 # Consider it a literal ~ and X.
77- $c[-1] .= $1;
78+ my $text = $1;
79+ $text =~ s/\\/\\\\/g;
80+ $c[-1] .= $text;
81 }
82 }
83 }
84--
851.8.3.1
86