Control: fixed -1 5.22.0~rc2-1
Control: tags -1 + confirmed upstream patch fixed-upstream
On Thu, May 26, 2016 at 04:22:45PM +0300, Yuriy M. Kaminskiy wrote:
> Dear Maintainer,
>
> I've made typo in code, and found that it freezes perl on attempt to parse:
> perl -ce 's{foo}{$h->X({->aaa=>"b"},$d)}ge'
> ( it was meant to be 's{foo}{$h->X({-aaa=>"b"},$d)}ge' )
Thanks for the report!
[snip backtrace]
> (Theoretically, this can be called "potential DoS on parsing untrusted
> code", but I'm pretty sure parsing untrusted perl code is not safe anyway).
>
> It seems only jessie version affected, perl binaries extracted from
> perl-base packages from wheezy and squeeze seems correctly report error:
Just to note that I can confirm that it we get a syntax error on
wheezy (so this is a regression for jessie).
> $ ./perl5.22.2 -ce 's{foo}{$h->X({->aaa=>"b"},$d)}ge'
> syntax error at -e line 1, near "{->aaa"
> syntax error at -e line 1, near ")}"
> -e had compilation errors.
>
> It seems no changes in 5.20.2-3+deb8u5 (from jessie-proposed-updates) (also
> freezes).
Thanks for the report!
I bisected this using something like:
cat ../test_prog.sh
#!/bin/sh
./perl -e 's{foo}{$h->X({->aaa=>"b"},$d)}ge;'
if [ $? = 255 ]; then
exit 0
fi
../perl/Porting/bisect.pl --expect-fail --start v5.20.0 --end v5.22.0 --timeout
2 -- ../test_prog.sh
This was fixed upstream by f8a7ccebba5637bf0cf5a23cea563b2ccd62312d[1],
which as you observed was first included in 5.22.0. It may be a candidate
for backporting to jessie / maint-5.20 upstream, but the patch doesn't
apply as-is.
Cheers,
Dominic.
[1]
<http://perl5.git.perl.org/perl.git/commit/f8a7ccebba5637bf0cf5a23cea563b2ccd62312d>
