diff options
Diffstat (limited to 'meta/recipes-devtools/perl/perl-5.14.3/0001-Fix-misparsing-of-maketext-strings.patch')
| -rw-r--r-- | meta/recipes-devtools/perl/perl-5.14.3/0001-Fix-misparsing-of-maketext-strings.patch | 86 |
1 files changed, 0 insertions, 86 deletions
diff --git a/meta/recipes-devtools/perl/perl-5.14.3/0001-Fix-misparsing-of-maketext-strings.patch b/meta/recipes-devtools/perl/perl-5.14.3/0001-Fix-misparsing-of-maketext-strings.patch deleted file mode 100644 index 89ec6eff0f..0000000000 --- a/meta/recipes-devtools/perl/perl-5.14.3/0001-Fix-misparsing-of-maketext-strings.patch +++ /dev/null | |||
| @@ -1,86 +0,0 @@ | |||
| 1 | From 1735f6f53ca19f99c6e9e39496c486af323ba6a8 Mon Sep 17 00:00:00 2001 | ||
| 2 | From: Brian Carlson <brian.carlson@cpanel.net> | ||
| 3 | Date: Wed, 28 Nov 2012 08:54:33 -0500 | ||
| 4 | Subject: [PATCH] Fix misparsing of maketext strings. | ||
| 5 | |||
| 6 | Case 61251: This commit fixes a misparse of maketext strings that could | ||
| 7 | lead to arbitrary code execution. Basically, maketext was compiling | ||
| 8 | bracket notation into functions, but neglected to escape backslashes | ||
| 9 | inside the content or die on fully-qualified method names when | ||
| 10 | generating the code. This change escapes all such backslashes and dies | ||
| 11 | when a method name with a colon or apostrophe is specified. | ||
| 12 | --- | ||
| 13 | AUTHORS | 1 + | ||
| 14 | dist/Locale-Maketext/lib/Locale/Maketext.pm | 24 ++++++++---------------- | ||
| 15 | 2 files changed, 9 insertions(+), 16 deletions(-) | ||
| 16 | |||
| 17 | Upstream-Status: Backport | ||
| 18 | |||
| 19 | Signed-off-by: Saul Wold <sgw@linux.intel.com> | ||
| 20 | |||
| 21 | |||
| 22 | diff --git a/AUTHORS b/AUTHORS | ||
| 23 | index 70734b0..009dea0 100644 | ||
| 24 | --- a/AUTHORS | ||
| 25 | +++ b/AUTHORS | ||
| 26 | @@ -154,6 +154,7 @@ Breno G. de Oliveira <garu@cpan.org> | ||
| 27 | Brent Dax <brentdax@cpan.org> | ||
| 28 | Brooks D Boyd | ||
| 29 | Brian Callaghan <callagh@itginc.com> | ||
| 30 | +Brian Carlson <brian.carlson@cpanel.net> | ||
| 31 | Brian Clarke <clarke@appliedmeta.com> | ||
| 32 | brian d foy <brian.d.foy@gmail.com> | ||
| 33 | Brian Fraser <fraserbn@gmail.com> | ||
| 34 | diff --git a/dist/Locale-Maketext/lib/Locale/Maketext.pm b/dist/Locale-Maketext/lib/Locale/Maketext.pm | ||
| 35 | index 4822027..63e5fba 100644 | ||
| 36 | --- a/dist/Locale-Maketext/lib/Locale/Maketext.pm | ||
| 37 | +++ b/dist/Locale-Maketext/lib/Locale/Maketext.pm | ||
| 38 | @@ -625,21 +625,9 @@ sub _compile { | ||
| 39 | # 0-length method name means to just interpolate: | ||
| 40 | push @code, ' ('; | ||
| 41 | } | ||
| 42 | - elsif($m =~ /^\w+(?:\:\:\w+)*$/s | ||
| 43 | - and $m !~ m/(?:^|\:)\d/s | ||
| 44 | - # exclude starting a (sub)package or symbol with a digit | ||
| 45 | + elsif($m =~ /^\w+$/s | ||
| 46 | + # exclude anything fancy, especially fully-qualified module names | ||
| 47 | ) { | ||
| 48 | - # Yes, it even supports the demented (and undocumented?) | ||
| 49 | - # $obj->Foo::bar(...) syntax. | ||
| 50 | - $target->_die_pointing( | ||
| 51 | - $string_to_compile, q{Can't use "SUPER::" in a bracket-group method}, | ||
| 52 | - 2 + length($c[-1]) | ||
| 53 | - ) | ||
| 54 | - if $m =~ m/^SUPER::/s; | ||
| 55 | - # Because for SUPER:: to work, we'd have to compile this into | ||
| 56 | - # the right package, and that seems just not worth the bother, | ||
| 57 | - # unless someone convinces me otherwise. | ||
| 58 | - | ||
| 59 | push @code, ' $_[0]->' . $m . '('; | ||
| 60 | } | ||
| 61 | else { | ||
| 62 | @@ -693,7 +681,9 @@ sub _compile { | ||
| 63 | elsif(substr($1,0,1) ne '~') { | ||
| 64 | # it's stuff not containing "~" or "[" or "]" | ||
| 65 | # i.e., a literal blob | ||
| 66 | - $c[-1] .= $1; | ||
| 67 | + my $text = $1; | ||
| 68 | + $text =~ s/\\/\\\\/g; | ||
| 69 | + $c[-1] .= $text; | ||
| 70 | |||
| 71 | } | ||
| 72 | elsif($1 eq '~~') { # "~~" | ||
| 73 | @@ -731,7 +721,9 @@ sub _compile { | ||
| 74 | else { | ||
| 75 | # It's a "~X" where X is not a special character. | ||
| 76 | # Consider it a literal ~ and X. | ||
| 77 | - $c[-1] .= $1; | ||
| 78 | + my $text = $1; | ||
| 79 | + $text =~ s/\\/\\\\/g; | ||
| 80 | + $c[-1] .= $text; | ||
| 81 | } | ||
| 82 | } | ||
| 83 | } | ||
| 84 | -- | ||
| 85 | 1.8.3.1 | ||
| 86 | |||
