...
 
Commits (131)
......@@ -2918,6 +2918,7 @@ dist/base/t/fields-5_6_0.t See if fields work
dist/base/t/fields-5_8_0.t See if fields work
dist/base/t/fields-base.t See if fields work
dist/base/t/fields.t See if fields work
dist/base/t/incdot.t Test how base.pm handles '.' in @INC
dist/base/t/isa.t See if base's behaviour doesn't change
dist/base/t/lib/Broken.pm Test module for base.pm
dist/base/t/lib/Dummy.pm Test module for base.pm
......@@ -5360,6 +5361,7 @@ t/op/warn.t See if warn works
t/op/while.t See if while loops work
t/op/write.t See if write works (formats work)
t/op/yadayada.t See if ... works
t/perf/taint.t See if optimisations are keeping things fast (taint issues)
t/perl.supp Perl valgrind suppressions
t/porting/args_assert.t Check that all PERL_ARGS_ASSERT* macros are used
t/porting/authors.t Check that all authors have been acknowledged
......@@ -5386,6 +5388,7 @@ t/porting/perlfunc.t Test that Functions_pm.PL can parse perlfunc.pod
t/porting/podcheck.t Test the POD of shipped modules is well formed
t/porting/pod_rules.t Check that various pod lists are consistent
t/porting/readme.t Check that all files in Porting/ are mentioned in Porting/README.pod
t/porting/re_context.t Check assumptions made by save_re_context()
t/porting/regen.t Check that regen.pl doesn't need running
t/porting/ss_dup.t Check that sv.c:ss_dup handle everything
t/porting/test_bootstrap.t Test that the instructions for test bootstrapping aren't accidentally overlooked.
......
......@@ -324,7 +324,7 @@ RUN_PERL = \$(LDLIBPTH) \$(RUN) $perl\$(EXE_EXT)
$spitshell >>$Makefile <<!GROK!THIS!
# Macros to invoke a copy of our fully operational perl during the build.
PERL_EXE = perl\$(EXE_EXT)
RUN_PERL = \$(LDLIBPTH) \$(RUN) ./perl\$(EXE_EXT) -Ilib
RUN_PERL = \$(LDLIBPTH) \$(RUN) ./perl\$(EXE_EXT) -Ilib -I.
!GROK!THIS!
;;
esac
......
......@@ -26,7 +26,7 @@ use Getopt::Long;
# plan9 => 'plan9/mkfile',
);
require 'Porting/pod_lib.pl';
require './Porting/pod_lib.pl';
sub my_die;
# process command-line switches
......
......@@ -47,7 +47,7 @@ sub import {
} elsif ($_ eq 'T') {
$chdir = '..'
unless -f 't/TEST' && -f 'MANIFEST' && -d 'lib' && -d 'ext';
@INC = 'lib';
@INC = qw/ lib . /;
$setopt = 1;
} else {
die "Unknown option '$_'";
......
......@@ -617,6 +617,7 @@ struct block_format {
cx->blk_format.gv = gv; \
cx->blk_format.retop = (retop); \
cx->blk_format.dfoutgv = PL_defoutgv; \
cx->blk_u16 = 0; \
if (!CvDEPTH(cv)) SvREFCNT_inc_simple_void_NN(cv); \
CvDEPTH(cv)++; \
SvREFCNT_inc_void(cx->blk_format.dfoutgv)
......@@ -639,6 +640,8 @@ struct block_format {
#define POPSUB(cx,sv) \
STMT_START { \
const I32 olddepth = cx->blk_sub.olddepth; \
if (!(cx->blk_u16 & CxPOPSUB_DONE)) { \
cx->blk_u16 |= CxPOPSUB_DONE; \
RETURN_PROBE(CvNAMED(cx->blk_sub.cv) \
? HEK_KEY(CvNAME_HEK(cx->blk_sub.cv)) \
: GvENAME(CvGV(cx->blk_sub.cv)), \
......@@ -661,6 +664,7 @@ struct block_format {
CLEAR_ARGARRAY(cx->blk_sub.argarray); \
} \
} \
} \
sv = MUTABLE_SV(cx->blk_sub.cv); \
LEAVE_SCOPE(PL_scopestack[cx->blk_oldscopesp-1]); \
if (sv && (CvDEPTH((const CV*)sv) = olddepth)) \
......@@ -674,13 +678,16 @@ struct block_format {
#define POPFORMAT(cx) \
STMT_START { \
if (!(cx->blk_u16 & CxPOPSUB_DONE)) { \
CV * const cv = cx->blk_format.cv; \
GV * const dfuot = cx->blk_format.dfoutgv; \
cx->blk_u16 |= CxPOPSUB_DONE; \
setdefout(dfuot); \
LEAVE_SCOPE(PL_scopestack[cx->blk_oldscopesp-1]); \
if (!--CvDEPTH(cv)) \
SvREFCNT_dec_NN(cx->blk_format.cv); \
SvREFCNT_dec_NN(dfuot); \
} \
} STMT_END
/* eval context */
......@@ -768,7 +775,10 @@ struct block_loop {
#define CxLABEL_len(c,len) (0 + CopLABEL_len((c)->blk_oldcop, len))
#define CxLABEL_len_flags(c,len,flags) (0 + CopLABEL_len_flags((c)->blk_oldcop, len, flags))
#define CxHASARGS(c) (((c)->cx_type & CXp_HASARGS) == CXp_HASARGS)
#define CxLVAL(c) (0 + (c)->blk_u16)
#define CxLVAL(c) (0 + ((c)->blk_u16 & 0xff))
/* POPSUB has already been performed on this context frame */
#define CxPOPSUB_DONE 0x100
#define PUSHLOOP_PLAIN(cx, s) \
cx->blk_loop.resetsp = s - PL_stack_base; \
......
#!/usr/bin/perl
use strict;
BEGIN { pop @INC if $INC[-1] eq '.' }
use File::Find;
use Getopt::Std;
use Archive::Tar;
......
#!/usr/bin/perl
BEGIN { pop @INC if $INC[-1] eq '.' }
use strict;
use Archive::Tar;
use Getopt::Std;
......
......@@ -4,6 +4,7 @@
# archive. See 'ptargrep --help' for more documentation.
#
BEGIN { pop @INC if $INC[-1] eq '.' }
use strict;
use warnings;
......
......@@ -843,6 +843,20 @@ sub _extract_file {
return;
}
### If a file system already contains a block device with the same name as
### the being extracted regular file, we would write the file's content
### to the block device. So remove the existing file (block device) now.
### If an archive contains multiple same-named entries, the last one
### should replace the previous ones. So remove the old file now.
### If the old entry is a symlink to a file outside of the CWD, the new
### entry would create a file there. This is CVE-2018-12015
### <https://rt.cpan.org/Ticket/Display.html?id=125523>.
if (-l $full || -e _) {
if (!unlink $full) {
$self->_error( qq[Could not remove old file '$full': $!] );
return;
}
}
if( length $entry->type && $entry->is_file ) {
my $fh = IO::File->new;
$fh->open( '>' . $full ) or (
......
......@@ -458,9 +458,20 @@ sub AUTOLOAD { 1 }
sub DESTROY { 1 }
}
# load a module without searching the default entry for the current
# directory
sub _safe_load_module {
my $name = shift;
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
eval "require $name; 1";
}
sub _init_logger
{
my $log4perl_loaded = eval "require Log::Log4perl; 1";
my $log4perl_loaded = _safe_load_module("Log::Log4perl");
unless( $log4perl_loaded )
{
......@@ -898,7 +909,7 @@ sub _load_local_lib # -I
{
$logger->debug( "Loading local::lib" );
my $rc = eval { require local::lib; 1; };
my $rc = _safe_load_module("local::lib");
unless( $rc ) {
$logger->die( "Could not load local::lib" );
}
......@@ -1013,7 +1024,7 @@ sub _get_file
{
my $path = shift;
my $loaded = eval "require LWP::Simple; 1;";
my $loaded = _safe_load_module("LWP::Simple");
croak "You need LWP::Simple to use features that fetch files from CPAN\n"
unless $loaded;
......@@ -1035,7 +1046,7 @@ sub _gitify
{
my $args = shift;
my $loaded = eval "require Archive::Extract; 1;";
my $loaded = _safe_load_module("Archive::Extract");
croak "You need Archive::Extract to use features that gitify distributions\n"
unless $loaded;
......@@ -1099,7 +1110,7 @@ sub _show_Changes
sub _get_changes_file
{
croak "Reading Changes files requires LWP::Simple and URI\n"
unless eval "require LWP::Simple; require URI; 1";
unless _safe_load_module("LWP::Simple") && _safe_load_module("URI");
my $url = shift;
......
......@@ -1090,6 +1090,8 @@ sub has_usable {
]
};
if ($usable->{$mod}) {
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
for my $c (0..$#{$usable->{$mod}}) {
my $code = $usable->{$mod}[$c];
my $ret = eval { &$code() };
......@@ -1118,6 +1120,8 @@ sub has_inst {
$CPAN::META->{dontload_hash}{$mod}||=1; # unsafe meta access, ok
return 0;
}
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
my $file = $mod;
my $obj;
$file =~ s|::|/|g;
......
#!/usr/local/bin/perl
BEGIN { pop @INC if $INC[-1] eq '.' }
use strict;
use vars qw($VERSION);
BEGIN {
# make sure we can install any modules from CPAN without patching them
$ENV{PERL_USE_UNSAFE_INC} = 1;
}
use App::Cpan '1.60_02';
$VERSION = '1.61';
......
......@@ -94,6 +94,7 @@ L<Digest::SHA::PurePerl>.
END_OF_POD
BEGIN { pop @INC if $INC[-1] eq '.' }
use strict;
use Fcntl;
use Getopt::Long;
......
......@@ -38,7 +38,11 @@ sub new
unless (exists ${"$class\::"}{"VERSION"}) {
my $pm_file = $class . ".pm";
$pm_file =~ s{::}{/}g;
eval { require $pm_file };
eval {
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
require $pm_file
};
if ($@) {
$err ||= $@;
next;
......
......@@ -56,6 +56,8 @@ require Encode::Config;
eval {
local $SIG{__DIE__};
local $SIG{__WARN__};
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
require Encode::ConfigLocal;
};
......
......@@ -176,7 +176,15 @@ simply treated as a normal character (ZERO WIDTH NO-BREAK SPACE).
When BE or LE is omitted during decode(), it checks if BOM is at the
beginning of the string; if one is found, the endianness is set to
what the BOM says. If no BOM is found, the routine dies.
what the BOM says.
=item Default Byte Order
When no BOM is found, Encode 2.76 and blow croaked. Since Encode
2.77, it falls back to BE accordingly to RFC2781 and the Unicode
Standard version 8.0. This behaviour has also been backported to
Encode 2.60 and later as shipped in the Debian perl package since
version 5.20.2-3+deb8u3 (see L<https://bugs.debian.org/798727>).
=item *
......
......@@ -164,9 +164,19 @@ CODE:
endian = 'V';
}
else {
croak("%"SVf":Unrecognised BOM %"UVxf,
*hv_fetch((HV *)SvRV(obj),"Name",4,0),
bom);
/* No BOM found, use big-endian fallback as specified in
* RFC2781 and the Unicode Standard version 8.0:
*
* The UTF-16 encoding scheme may or may not begin with
* a BOM. However, when there is no BOM, and in the
* absence of a higher-level protocol, the byte order
* of the UTF-16 encoding scheme is big-endian.
*
* If the first two octets of the text is not 0xFE
* followed by 0xFF, and is not 0xFF followed by 0xFE,
* then the text SHOULD be interpreted as big-endian.
*/
s -= size;
}
}
#if 1
......
......@@ -4,6 +4,7 @@ BEGIN {
# with $ENV{PERL_CORE} set
# In case we need it in future...
require Config; import Config;
pop @INC if $INC[-1] eq '.';
}
use strict;
use warnings;
......
#!./perl
# $Id: piconv,v 2.6 2014/03/28 02:37:42 dankogai Exp $
#
BEGIN { pop @INC if $INC[-1] eq '.' }
use 5.8.0;
use strict;
use Encode ;
......
......@@ -3,6 +3,7 @@
# $Id: ucmlint,v 2.2 2008/03/12 09:51:11 dankogai Exp $
#
BEGIN { pop @INC if $INC[-1] eq '.' }
use strict;
our $VERSION = do { my @r = (q$Revision: 2.2 $ =~ /\d+/g); sprintf "%d."."%02d" x $#r, @r };
......
#!./perl
BEGIN { pop @INC if $INC[-1] eq '.' }
use strict;
use Encode;
use Getopt::Std;
......
#!/usr/bin/perl -w
BEGIN { pop @INC if $INC[-1] eq '.' }
use strict;
use IO::File;
use ExtUtils::Packlist;
......
......@@ -3462,7 +3462,7 @@ PERL_DL_NONLAZY set for tests.
sub test_via_harness {
my($self, $perl, $tests) = @_;
return $self->SUPER::test_via_harness("PERL_DL_NONLAZY=1 $perl", $tests);
return $self->SUPER::test_via_harness("PERL_DL_NONLAZY=1 PERL_USE_UNSAFE_INC=1 $perl", $tests);
}
=item test_via_script (override)
......@@ -3473,7 +3473,7 @@ Again, the PERL_DL_NONLAZY thing.
sub test_via_script {
my($self, $perl, $script) = @_;
return $self->SUPER::test_via_script("PERL_DL_NONLAZY=1 $perl", $script);
return $self->SUPER::test_via_script("PERL_DL_NONLAZY=1 PERL_USE_UNSAFE_INC=1 $perl", $script);
}
......
......@@ -5,6 +5,11 @@ use strict;
BEGIN {require 5.006;}
# Assure anything called from Makefile.PL is allowed to have . in @INC.
BEGIN {
$ENV{PERL_USE_UNSAFE_INC} = 1;
}
require Exporter;
use ExtUtils::MakeMaker::Config;
use Carp;
......
......@@ -567,6 +567,8 @@ sub _lwp_fetch {
};
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
unless( can_load( modules => $use_list ) ) {
$METHOD_FAIL->{'lwp'} = 1;
return;
......@@ -619,6 +621,8 @@ sub _httptiny_fetch {
};
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
unless( can_load(modules => $use_list) ) {
$METHOD_FAIL->{'httptiny'} = 1;
return;
......@@ -658,6 +662,8 @@ sub _httplite_fetch {
};
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
unless( can_load(modules => $use_list) ) {
$METHOD_FAIL->{'httplite'} = 1;
return;
......@@ -733,6 +739,8 @@ sub _iosock_fetch {
'IO::Select' => '0.0',
};
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
unless( can_load(modules => $use_list) ) {
$METHOD_FAIL->{'iosock'} = 1;
return;
......@@ -814,6 +822,8 @@ sub _netftp_fetch {
check( $tmpl, \%hash ) or return;
### required modules ###
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
my $use_list = { 'Net::FTP' => 0 };
unless( can_load( modules => $use_list ) ) {
......
......@@ -284,13 +284,21 @@ sub _rmtree {
if (!chdir($root)) {
# see if we can escalate privileges to get in
# (e.g. funny protection mask such as -w- instead of rwx)
$perm &= 07777;
my $nperm = $perm | 0700;
if (!($arg->{safe} or $nperm == $perm or chmod($nperm, $root))) {
_error($arg, "cannot make child directory read-write-exec", $canon);
next ROOT_DIR;
# This uses fchmod to avoid traversing outside of the proper
# location (CVE-2017-6512)
my $root_fh;
if (open($root_fh, '<', $root)) {
my ($fh_dev, $fh_inode) = (stat $root_fh )[0,1];
$perm &= 07777;
my $nperm = $perm | 0700;
local $@;
if (!($arg->{safe} or $nperm == $perm or !-d _ or $fh_dev ne $ldev or $fh_inode ne $lino or eval { chmod( $nperm, $root_fh ) } )) {
_error($arg, "cannot make child directory read-write-exec", $canon);
next ROOT_DIR;
}
close $root_fh;
}
elsif (!chdir($root)) {
if (!chdir($root)) {
_error($arg, "cannot chdir to child", $canon);
next ROOT_DIR;
}
......
......@@ -16,6 +16,13 @@ my $has_Test_Output = $@ ? 0 : 1;
my $Is_VMS = $^O eq 'VMS';
my $fchmod_supported = 0;
if (open my $fh, curdir()) {
my ($perm) = (stat($fh))[2];
$perm &= 07777;
eval { $fchmod_supported = chmod( $perm, $fh); };
}
# first check for stupid permissions second for full, so we clean up
# behind ourselves
for my $perm (0111,0777) {
......@@ -258,13 +265,16 @@ is(scalar(@created), 1, "created directory (old style 3 mode undef)");
is($created[0], $dir, "created directory (old style 3 mode undef) cross-check");
is(rmtree($dir, 0, undef), 1, "removed directory 3 verbose undef");
$dir = catdir($tmp_base,'G');
$dir = VMS::Filespec::unixify($dir) if $Is_VMS;
@created = mkpath($dir, undef, 0200);
is(scalar(@created), 1, "created write-only dir");
is($created[0], $dir, "created write-only directory cross-check");
is(rmtree($dir), 1, "removed write-only dir");
SKIP: {
skip "fchmod of directories not supported on this platform", 3 unless $fchmod_supported;
$dir = catdir($tmp_base,'G');
$dir = VMS::Filespec::unixify($dir) if $Is_VMS;
@created = mkpath($dir, undef, 0400);
is(scalar(@created), 1, "created read-only dir");
is($created[0], $dir, "created read-only directory cross-check");
is(rmtree($dir), 1, "removed read-only dir");
}
# borderline new-style heuristics
if (chdir $tmp_base) {
......
......@@ -1368,6 +1368,8 @@ sub _find_CA_file {
return $self->{SSL_options}->{SSL_ca_file}
if $self->{SSL_options}->{SSL_ca_file} and -e $self->{SSL_options}->{SSL_ca_file};
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
return Mozilla::CA::SSL_ca_file()
if eval { require Mozilla::CA };
......
......@@ -5,6 +5,7 @@
# Display info on the contents of a Zip file
#
BEGIN { pop @INC if $INC[-1] eq '.' }
use strict;
use warnings ;
......
......@@ -27,6 +27,8 @@ Exporter::export_ok_tags('all');
BEGIN
{
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
eval ' use IO::Uncompress::Adapter::Inflate 2.064 ;';
eval ' use IO::Uncompress::Adapter::Bunzip2 2.064 ;';
eval ' use IO::Uncompress::Adapter::LZO 2.064 ;';
......
......@@ -142,6 +142,8 @@ sub can_use_ipc_run {
return if IS_WIN98;
### if we don't have ipc::run, we obviously can't use it.
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
return unless can_load(
modules => { 'IPC::Run' => '0.55' },
verbose => ($WARN && $verbose),
......@@ -169,6 +171,8 @@ sub can_use_ipc_open3 {
### IPC::Open3 works on every non-VMS platform, but it can't
### capture buffers on win32 :(
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
return unless can_load(
modules => { map {$_ => '0.0'} qw|IPC::Open3 IO::Select Symbol| },
verbose => ($WARN && $verbose),
......
#!/usr/bin/perl
BEGIN { pop @INC if $INC[-1] eq '.' }
use strict;
use Getopt::Long;
......
......@@ -134,7 +134,12 @@ sub load_loc {
my $pkg = join('::', grep { defined and length } $args{Class}, $args{Subclass});
return $Loc{$pkg} if exists $Loc{$pkg};
eval { require Locale::Maketext::Lexicon; 1 } or return;
eval {
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
require Locale::Maketext::Lexicon;
1
} or return;
$Locale::Maketext::Lexicon::VERSION > 0.20 or return;
eval { require File::Spec; 1 } or return;
......
......@@ -184,7 +184,11 @@ sub _my_tie {
}
my $modulefile = $module . '.pm';
$modulefile =~ s{::}{/}g;
eval { require $modulefile };
eval {
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
require $modulefile
};
if ($@) {
croak "Memoize: Couldn't load hash tie module `$module': $@; aborting";
}
......
......@@ -1860,6 +1860,8 @@ BEGIN {
(
$quoted_INC
);
push \@INC, "." unless grep { \$_ eq "." } \@INC; # Force my process to include . in \@INC.
\$ENV{"PERL_USE_UNSAFE_INC"} = 1; # Force all child processes to include . in \@INC.
}
close(*DATA) unless eof(*DATA); # ensure no open handles to this script
......
......@@ -563,6 +563,9 @@ sub find_good_formatter_class {
my @class_list = @{ $self->{'formatter_classes'} || [] };
$self->die( "WHAT? Nothing in the formatter class list!?" ) unless @class_list;
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
my $good_class_found;
foreach my $c (@class_list) {
DEBUG > 4 and print "Trying to load $c...\n";
......@@ -994,6 +997,8 @@ sub new_translator { # $tr = $self->new_translator($lang);
my $self = shift;
my $lang = shift;
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
my $pack = 'POD2::' . uc($lang);
eval "require $pack";
if ( !$@ && $pack->can('new') ) {
......
......@@ -888,6 +888,8 @@ sub silent_eval (&) {
sub can_load {
my ($module, $verbose) = @_;
local($SIG{__DIE__}, $SIG{__WARN__}, $@);
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
my $loaded = eval "use $module; 1";
warn $@ if not $loaded and $verbose;
return $loaded
......
#!/usr/bin/perl -w
BEGIN { pop @INC if $INC[-1] eq '.' }
use strict;
use warnings;
use App::Prove;
......
......@@ -480,7 +480,12 @@ sub _diff_complain {
my($result, $expected, $detail, $prefix) = @_;
return _diff_complain_external(@_) if $ENV{PERL_TEST_DIFF};
return _diff_complain_algdiff(@_)
if eval { require Algorithm::Diff; Algorithm::Diff->VERSION(1.15); 1; };
if eval {
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
require Algorithm::Diff; Algorithm::Diff->VERSION(1.15);
1;
};
$told_about_diff++ or print $TESTERR <<"EOT";
# $prefix (Install the Algorithm::Diff module to have differences in multiline
......
......@@ -15,7 +15,12 @@ use strict;
@ISA = qw(Net::LocalCfg Exporter);
$VERSION = "1.13";
eval { local $SIG{__DIE__}; require Net::LocalCfg };
eval {
local @INC = @INC;
pop @INC if $INC[-1] eq '.';
local $SIG{__DIE__};
require Net::LocalCfg;
};
%NetConfig = (
nntp_hosts => [],
......
# see git-dpm(1) from git-dpm package
a7550ec974eef6efeb71cc1969d7b7efe93a7378
a7550ec974eef6efeb71cc1969d7b7efe93a7378
479e665bff7c2dbd7bc73435bf0dfac17ca2084e
479e665bff7c2dbd7bc73435bf0dfac17ca2084e
708ce0747a55640ef1136be276185cc1a5a82564
708ce0747a55640ef1136be276185cc1a5a82564
perl_5.20.2.orig.tar.bz2
......
perl (5.20.2-3+deb8u12) jessie-security; urgency=high
* [SECURITY] CVE-2018-18311: Integer overflow leading to buffer
overflow and segmentation fault
-- Dominic Hargreaves <dom@earth.li> Fri, 30 Nov 2018 13:00:03 +0000
perl (5.20.2-3+deb8u11) jessie-security; urgency=high
* [SECURITY] CVE-2018-12015: fix directory traversal vulnerability
in Archive-Tar (Closes: #900834)
-- Dominic Hargreaves <dom@earth.li> Sun, 10 Jun 2018 18:40:37 +0100
perl (5.20.2-3+deb8u10) jessie-security; urgency=high
* [SECURITY] CVE-2018-6913: heap buffer overflow with large data blocks.
-- Niko Tyni <ntyni@debian.org> Sat, 10 Mar 2018 20:36:19 +0200
perl (5.20.2-3+deb8u9) jessie-security; urgency=high
* Update upstream base.pm no-dot-in-inc fix patch description.
* [SECURITY] CVE-2017-12837: Fix a heap buffer overflow in regular
expression compiler. (Closes: #875596)
* [SECURITY] CVE-2017-12883: Fix a buffer over-read in regular
expression parser. (Closes: #875597)
+ also includes a separate upstream fix from the 5.23 cycle
-- Niko Tyni <ntyni@debian.org> Tue, 12 Sep 2017 20:00:57 +0300
perl (5.20.2-3+deb8u8) jessie; urgency=medium
* Apply upstream base.pm no-dot-in-inc fix (from 5.24.2-RC1)
(Closes: #867170)
-- Dominic Hargreaves <dom@earth.li> Tue, 11 Jul 2017 17:05:53 +0100
perl (5.20.2-3+deb8u7) jessie-security; urgency=high
* [CVE-2017-6512] Fix file permissions race condition in File-Path;
patch from John Lightsey (Closes: #863870)
* Also fix test logic in ExtUtils-MakeMaker required for the above
-- Dominic Hargreaves <dom@earth.li> Sat, 03 Jun 2017 13:11:53 +0100
perl (5.20.2-3+deb8u6) jessie-security; urgency=high
[ Niko Tyni ]
* [SECURITY] CVE-2016-1238: opportunistic loading of optional
modules can make many programs unintentionally load code
from the current working directory (which might be changed to
another directory without the user realising).
+ allow user configurable removal of "." from @INC in
/etc/perl/sitecustomize.pl for a transitional period. (See: #588017)
+ backport patches from [perl #127834] to fix known vulnerabilities
even if the user does not configure "." to be removed from @INC
+ backport patches from [perl #127810] to fix various classes of
build failures in perl and CPAN modules if "." is removed from
@INC
[ Dominic Hargreaves ]
* [SECURITY] CVE-2016-6185: Make XSLoader skip relative paths not
on @INC. (Closes: #829578)
-- Dominic Hargreaves <dom@earth.li> Fri, 22 Jul 2016 16:30:45 +0100
perl (5.20.2-3+deb8u5) jessie; urgency=medium
* Apply patch from Niko Tyni fixing debugperl crashes with XS
modules (Closes: #816280)
* [SECURITY] CVE-2015-8853 fix regexp engine hang on illegal UTF8
input (Closes: #821848)
* Fix UTF8-related regexp engine crash (Closes: #820328)
* Apply selected bug-fix patches taken from 5.20.3 (Closes: #822336)
- /usr/share/doc/perl/perldebdelta.pod describes the changes in
more detail
-- Dominic Hargreaves <dom@earth.li> Mon, 23 May 2016 23:42:11 +0100
perl (5.20.2-3+deb8u4) jessie-security; urgency=high
* Work around a t/op/stat.t failure on GNU/kFreeBSD, possibly related
to softupdates. Fix by Steven Chamberlain. (Closes: #796798)
* [SECURITY] CVE-2016-2381 fix duplicate environment variable taint
checking issue
-- Dominic Hargreaves <dom@earth.li> Fri, 26 Feb 2016 21:41:47 +0000
perl (5.20.2-3+deb8u3) jessie; urgency=medium
* Backport Encode::Unicode BOM fix from Encode-2.77. (Closes: #798727)
+ break+replace libencode-perl (<< 2.63-1+deb8u1) accordingly
-- Dominic Hargreaves <dom@earth.li> Mon, 11 Jan 2016 23:06:58 +0000
perl (5.20.2-3+deb8u2) jessie-security; urgency=high
* [SECURITY] CVE-2015-8607 fix untaint issue with File::Spec::canonpath()
-- Dominic Hargreaves <dom@earth.li> Fri, 01 Jan 2016 12:36:39 +0000
perl (5.20.2-3+deb8u1) jessie; urgency=medium
* Make the perl debugger work with threaded programs again.
Thanks to James McCoy. (Closes: #779357)
-- Niko Tyni <ntyni@debian.org> Tue, 28 Apr 2015 22:41:15 +0300
perl (5.20.2-3) unstable; urgency=medium
* Improve the error message when a path is inaccessible during
......
......@@ -114,6 +114,7 @@ eval /bin/bash Configure \
-Dman3dir=/usr/share/man/man3 \
-Dsiteman1dir=/usr/local/man/man1 \
-Dsiteman3dir=/usr/local/man/man3 \
-Dusesitecustomize \
-Duse64bitint \
-Dman1ext=1 \
-Dman3ext=3perl \
......
......@@ -316,7 +316,7 @@ Breaks: perl-doc (<< ${Upstream-Version}-1),
libthreads-perl (<< 1.93),
libthreads-shared-perl (<< 1.46),
libtime-piece-perl (<< 1.27),
libencode-perl (<< 2.60),
libencode-perl (<< 2.63-1+deb8u1),
mrtg (<< 2.16.3-3.1),
libhtml-template-compiled-perl (<< 0.95-1),
libperl-apireference-perl (<< 0.09-1),
......
From 66d0cb1ccce13777092a7d0b0f002cc771e0459d Mon Sep 17 00:00:00 2001
From: Niko Tyni <ntyni@debian.org>
Date: Wed, 7 Jun 2017 21:45:48 +0300
Subject: Revert base.pm no-dot-in-inc fixes to make way for a better version
Patch-Name: debian/CVE-2016-1238/base-pm-amends-pt1.diff
---
dist/base/lib/base.pm | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/dist/base/lib/base.pm b/dist/base/lib/base.pm
index 2b1509620..5d1378786 100644
--- a/dist/base/lib/base.pm
+++ b/dist/base/lib/base.pm
@@ -96,11 +96,7 @@ sub import {
{
local $SIG{__DIE__};
my $fn = _module_to_filename($base);
- eval {
- local @INC = @INC;
- pop @INC if $INC[-1] eq '.';
- require $fn
- };
+ eval { require $fn };
# Only ignore "Can't locate" errors from our eval require.
# Other fatal errors (syntax etc) must be reported.
#
This diff is collapsed.
From e5548dc898b4bdba6c164f70e8c42827e414e7be Mon Sep 17 00:00:00 2001
From: Todd Rinaldo <toddr@cpan.org>
Date: Thu, 31 Mar 2016 17:04:47 -0500
Subject: Set PERL_USE_UNSAFE_INC for cpan usage
This change allows the majority of Perl modules to build/test/install from the
cpan client without having to modify them.
Bug: https://rt.perl.org/Public/Bug/Display.html?id=127810
Patch-Name: debian/CVE-2016-1238/cpan-without-dot.diff
---
cpan/CPAN/scripts/cpan | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/cpan/CPAN/scripts/cpan b/cpan/CPAN/scripts/cpan
index 664adcb3a..2dd25dc04 100644
--- a/cpan/CPAN/scripts/cpan
+++ b/cpan/CPAN/scripts/cpan
@@ -4,6 +4,11 @@ BEGIN { pop @INC if $INC[-1] eq '.' }
use strict;
use vars qw($VERSION);
+BEGIN {
+ # make sure we can install any modules from CPAN without patching them
+ $ENV{PERL_USE_UNSAFE_INC} = 1;
+}
+
use App::Cpan '1.60_02';
$VERSION = '1.61';
From f89ba93840393ade739b3a682eb9d0b3b858020f Mon Sep 17 00:00:00 2001
From: Todd Rinaldo <toddr@cpan.org>
Date: Thu, 31 Mar 2016 17:04:42 -0500
Subject: Add PERL_USE_UNSAFE_INC support to EU::MM for fortify_inc support.
This change allows the majority of Perl modules that cannot build/test/install
without . in INC to be able to do so, while maintaining a safer perl under
normal use.
(Backported by Debian 5.20 by Niko Tyni <ntyni@debian.org>)
Bug: https://rt.perl.org/Public/Bug/Display.html?id=127810
Patch-Name: debian/CVE-2016-1238/eumm-without-dot.diff
---
cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Unix.pm | 4 ++--
cpan/ExtUtils-MakeMaker/lib/ExtUtils/MakeMaker.pm | 5 +++++
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Unix.pm b/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Unix.pm
index 6328e26f5..1cd920a29 100644
--- a/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Unix.pm
+++ b/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MM_Unix.pm
@@ -3462,7 +3462,7 @@ PERL_DL_NONLAZY set for tests.
sub test_via_harness {
my($self, $perl, $tests) = @_;
- return $self->SUPER::test_via_harness("PERL_DL_NONLAZY=1 $perl", $tests);
+ return $self->SUPER::test_via_harness("PERL_DL_NONLAZY=1 PERL_USE_UNSAFE_INC=1 $perl", $tests);
}
=item test_via_script (override)
@@ -3473,7 +3473,7 @@ Again, the PERL_DL_NONLAZY thing.
sub test_via_script {
my($self, $perl, $script) = @_;
- return $self->SUPER::test_via_script("PERL_DL_NONLAZY=1 $perl", $script);
+ return $self->SUPER::test_via_script("PERL_DL_NONLAZY=1 PERL_USE_UNSAFE_INC=1 $perl", $script);
}
diff --git a/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MakeMaker.pm b/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MakeMaker.pm
index fabb0215a..e0f88d22e 100644
--- a/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MakeMaker.pm
+++ b/cpan/ExtUtils-MakeMaker/lib/ExtUtils/MakeMaker.pm
@@ -5,6 +5,11 @@ use strict;
BEGIN {require 5.006;}
+# Assure anything called from Makefile.PL is allowed to have . in @INC.
+BEGIN {
+ $ENV{PERL_USE_UNSAFE_INC} = 1;
+}
+
require Exporter;
use ExtUtils::MakeMaker::Config;
use Carp;
From fe67e31bb17f54b6dae8ca495e36edcd517f0bb6 Mon Sep 17 00:00:00 2001
From: Niko Tyni <ntyni@debian.org>
Date: Fri, 8 Jul 2016 13:42:02 +0200
Subject: Make Module::Build set PERL_USE_UNSAFE_INC
Author: Todd Rinaldo <toddr@cpan.org>
Origin: https://gist.githubusercontent.com/toddr/d77d8d5fa9caa8f96b7758a126caa4dc/raw/3b1a327efdd9a6babf5eed8fb9c241a6d4909be6/fix.patch
Patch-Name: debian/CVE-2016-1238/mb-without-dot.diff
---
cpan/Module-Build/lib/Module/Build/Base.pm | 2 ++
1 file changed, 2 insertions(+)
diff --git a/cpan/Module-Build/lib/Module/Build/Base.pm b/cpan/Module-Build/lib/Module/Build/Base.pm
index 4422cd432..4a8fb92c4 100644
--- a/cpan/Module-Build/lib/Module/Build/Base.pm
+++ b/cpan/Module-Build/lib/Module/Build/Base.pm
@@ -1860,6 +1860,8 @@ BEGIN {
(
$quoted_INC
);
+ push \@INC, "." unless grep { \$_ eq "." } \@INC; # Force my process to include . in \@INC.
+ \$ENV{"PERL_USE_UNSAFE_INC"} = 1; # Force all child processes to include . in \@INC.
}
close(*DATA) unless eof(*DATA); # ensure no open handles to this script
From 9c50d8a810833abd3915702d4025ed3e4ff188b5 Mon Sep 17 00:00:00 2001
From: Niko Tyni <ntyni@debian.org>
Date: Tue, 5 Jul 2016 15:47:40 +0200
Subject: Look for sitecustomize.pl in /etc/perl rather than sitelib on Debian
systems
Debian uses this sitecustomize.pl as a transition mechanism for removing
the current working directory (".") from @INC by default while leaving
the local administrator a temporary means of re-adding it back.
This mechanism is expected to be removed after one Debian stable release.
Patch-Name: debian/CVE-2016-1238/sitecustomize-in-etc.diff
---
perl.c | 5 +++++
pod/perlrun.pod | 5 +++++
2 files changed, 10 insertions(+)
diff --git a/perl.c b/perl.c
index 26aeb91b3..fefc3aa5b 100644
--- a/perl.c
+++ b/perl.c
@@ -2085,7 +2085,12 @@ S_parse_body(pTHX_ char **env, XSINIT_t xsinit)
}
# else
/* SITELIB_EXP is a function call on Win32. */
+#ifdef DEBIAN
+ /* temporary transition mechanism for dropping "." from @INC */
+ const char *const raw_sitelib = "/etc/perl";
+#else
const char *const raw_sitelib = SITELIB_EXP;
+#endif
if (raw_sitelib) {
/* process .../.. if PERL_RELOCATABLE_INC is defined */
SV *sitelib_sv = mayberelocate(raw_sitelib, strlen(raw_sitelib),
diff --git a/pod/perlrun.pod b/pod/perlrun.pod
index acf270221..f43cfe993 100644
--- a/pod/perlrun.pod
+++ b/pod/perlrun.pod
@@ -489,6 +489,11 @@ blocks will be likewise executed very late.
To determine at runtime if this capability has been compiled in your
perl, you can check the value of C<$Config{usesitecustomize}>.
+Note: on Debian based systems, the system perl currently uses
+C</etc/perl/sitecustomize.pl> rather than C<$Config{sitelib}/sitecustomize.pl>.
+This may change in the future and is only provided as a temporary transition
+mechanism for removing the current working directory from C<@INC>.
+
=item B<-F>I<pattern>
X<-F>
From 8cbf26c9fdc4e6d7dc617e34ce203b8adbf540a8 Mon Sep 17 00:00:00 2001
From: Todd Rinaldo <toddr@cpan.org>
Date: Thu, 31 Mar 2016 17:04:29 -0500
Subject: Patch unit tests to explicitly insert "." into @INC when needed.
(Backported to Debian 5.20 by Niko Tyni <ntyni@debian.org>)
Bug: https://rt.perl.org/Public/Bug/Display.html?id=127810
Patch-Name: debian/CVE-2016-1238/test-suite-without-dot.diff
---
Makefile.SH | 2 +-
Porting/pod_rules.pl | 2 +-
TestInit.pm | 2 +-
lib/strict.t | 2 +-
lib/warnings.t | 2 +-
makedef.pl | 2 +-
regen.pl | 2 +-
regen/genpacksizetables.pl | 2 +-
regen/mg_vtable.pl | 2 +-
t/comp/line_debug.t | 2 ++
t/lib/warnings/op | 1 +
t/op/goto.t | 2 +-
t/porting/regen.t | 2 +-
t/re/pat.t | 2 +-
t/run/switches.t | 6 +++---
t/test.pl | 3 ++-
16 files changed, 20 insertions(+), 16 deletions(-)
diff --git a/Makefile.SH b/Makefile.SH
index dbff8122b..01c1dca8f 100755
--- a/Makefile.SH
+++ b/Makefile.SH
@@ -324,7 +324,7 @@ RUN_PERL = \$(LDLIBPTH) \$(RUN) $perl\$(EXE_EXT)
$spitshell >>$Makefile <<!GROK!THIS!
# Macros to invoke a copy of our fully operational perl during the build.
PERL_EXE = perl\$(EXE_EXT)
-RUN_PERL = \$(LDLIBPTH) \$(RUN) ./perl\$(EXE_EXT) -Ilib
+RUN_PERL = \$(LDLIBPTH) \$(RUN) ./perl\$(EXE_EXT) -Ilib -I.
!GROK!THIS!
;;
esac
diff --git a/Porting/pod_rules.pl b/Porting/pod_rules.pl
index 18abe878d..775311faf 100644
--- a/Porting/pod_rules.pl
+++ b/Porting/pod_rules.pl
@@ -26,7 +26,7 @@ use Getopt::Long;
# plan9 => 'plan9/mkfile',
);
-require 'Porting/pod_lib.pl';
+require './Porting/pod_lib.pl';
sub my_die;
# process command-line switches
diff --git a/TestInit.pm b/TestInit.pm
index 16eb318cc..b00e59f37 100644
--- a/TestInit.pm
+++ b/TestInit.pm
@@ -47,7 +47,7 @@ sub import {
} elsif ($_ eq 'T') {
$chdir = '..'
unless -f 't/TEST' && -f 'MANIFEST' && -d 'lib' && -d 'ext';
- @INC = 'lib';
+ @INC = qw/ lib . /;
$setopt = 1;
} else {
die "Unknown option '$_'";
diff --git a/lib/strict.t b/lib/strict.t
index e067793b8..d252c8da9 100644
--- a/lib/strict.t
+++ b/lib/strict.t
@@ -1,7 +1,7 @@
#!./perl
chdir 't' if -d 't';
-@INC = '../lib';
+@INC = ( '.', '../lib' );
our $local_tests = 4;
require "../t/lib/common.pl";
diff --git a/lib/warnings.t b/lib/warnings.t
index ee696fe2a..7c24f3af2 100644
--- a/lib/warnings.t
+++ b/lib/warnings.t
@@ -1,7 +1,7 @@
#!./perl
chdir 't' if -d 't';
-@INC = '../lib';
+@INC = ( '.', '../lib' );
our $UTF8 = (${^OPEN} || "") =~ /:utf8/;
require "../t/lib/common.pl";
diff --git a/makedef.pl b/makedef.pl
index a44c014e2..a21e20872 100644
--- a/makedef.pl
+++ b/makedef.pl
@@ -59,7 +59,7 @@ while (@ARGV) {
}
}
-require "$ARGS{TARG_DIR}regen/embed_lib.pl";
+require "./$ARGS{TARG_DIR}regen/embed_lib.pl";
{
my @PLATFORM = qw(aix win32 wince os2 netware vms test);
diff --git a/regen.pl b/regen.pl
index 878866835..71a6eda60 100644
--- a/regen.pl
+++ b/regen.pl
@@ -15,7 +15,7 @@ use strict;
my $tap = $ARGV[0] && $ARGV[0] eq '--tap' ? '# ' : '';
foreach my $pl (map {chomp; "regen/$_"} <DATA>) {
- my @command = ($^X, $pl, @ARGV);
+ my @command = ($^X, '-I.', $pl, @ARGV);
print "$tap@command\n";
system @command
and die "@command failed: $?"
diff --git a/regen/genpacksizetables.pl b/regen/genpacksizetables.pl
index 742eb6fb3..2e3bec580 100644
--- a/regen/genpacksizetables.pl
+++ b/regen/genpacksizetables.pl
@@ -3,7 +3,7 @@
# it will generate EBCDIC too. (TODO)
use strict;
use Encode;
-require 'regen/regen_lib.pl';
+require './regen/regen_lib.pl';
sub make_text {
my ($chrmap, $letter, $unpredictable, $nocsum, $size, $condition) = @_;
diff --git a/regen/mg_vtable.pl b/regen/mg_vtable.pl
index 0bbfbfdf6..df9adb640 100644
--- a/regen/mg_vtable.pl
+++ b/regen/mg_vtable.pl
@@ -20,7 +20,7 @@ require 5.004;
BEGIN {
# Get function prototypes
- require 'regen/regen_lib.pl';
+ require './regen/regen_lib.pl';
}
my %mg =
diff --git a/t/comp/line_debug.t b/t/comp/line_debug.t
index 8361194bb..71626bbf3 100644
--- a/t/comp/line_debug.t
+++ b/t/comp/line_debug.t
@@ -1,5 +1,7 @@
#!./perl
+BEGIN { unshift @INC, '.' }
+
chdir 't' if -d 't';
sub ok {
diff --git a/t/lib/warnings/op b/t/lib/warnings/op
index bca28186a..5a01b9958 100644
--- a/t/lib/warnings/op
+++ b/t/lib/warnings/op
@@ -1472,6 +1472,7 @@ END { print "in end\n"; }
print "in mainline\n";
1;
--FILE--
+BEGIN { unshift @INC, '.' }
require abc;
do "abc.pm";
EXPECT
diff --git a/t/op/goto.t b/t/op/goto.t
index 13e6b042a..32684bfb9 100644
--- a/t/op/goto.t
+++ b/t/op/goto.t
@@ -240,7 +240,7 @@ YYY: print "OK\n";
EOT
close $f;
-$r = runperl(prog => 'use Op_goto01; print qq[DONE\n]');
+$r = runperl(prog => 'BEGIN { unshift @INC, q[.] } use Op_goto01; print qq[DONE\n]');
is($r, "OK\nDONE\n", "goto within use-d file");
unlink_all "Op_goto01.pm";
diff --git a/t/porting/regen.t b/t/porting/regen.t
index 048a0c0e7..93ac58b76 100644
--- a/t/porting/regen.t
+++ b/t/porting/regen.t
@@ -78,7 +78,7 @@ OUTER: foreach my $file (@files) {
}
foreach (@progs) {
- my $command = "$^X $_ --tap";
+ my $command = "$^X -I. $_ --tap";
system $command
and die "Failed to run $command: $?";
}
diff --git a/t/re/pat.t b/t/re/pat.t
index 6e694d743..0442ca9ce 100644
--- a/t/re/pat.t
+++ b/t/re/pat.t
@@ -1607,7 +1607,7 @@ EOP
# #123562]
my $code='
- BEGIN{require q(test.pl);}
+ BEGIN{require q(./test.pl);}
use Encode qw(_utf8_on);
my $malformed = "a\x80\n";
_utf8_on($malformed);
diff --git a/t/run/switches.t b/t/run/switches.t
index a2e4bad47..2d88c23cb 100644
--- a/t/run/switches.t
+++ b/t/run/switches.t
@@ -193,12 +193,12 @@ sub import { print map "<\$_>", \@_ }
SWTESTPM
close $f or die "Could not close: $!";
$r = runperl(
- switches => [ "-M$package" ],
+ switches => [ "-I.", "-M$package" ],
prog => '1',