| 1 | =encoding utf8 |
| 2 | |
| 3 | =head1 NAME |
| 4 | |
| 5 | perl5144delta - what is new for perl v5.14.4 |
| 6 | |
| 7 | =head1 DESCRIPTION |
| 8 | |
| 9 | This document describes differences between the 5.14.3 release and |
| 10 | the 5.14.4 release. |
| 11 | |
| 12 | If you are upgrading from an earlier release such as 5.12.0, first read |
| 13 | L<perl5140delta>, which describes differences between 5.12.0 and |
| 14 | 5.14.0. |
| 15 | |
| 16 | =head1 Core Enhancements |
| 17 | |
| 18 | No changes since 5.14.0. |
| 19 | |
| 20 | =head1 Security |
| 21 | |
| 22 | This release contains one major, and medium, and a number of minor |
| 23 | security fixes. The latter are included mainly to allow the test suite to |
| 24 | pass cleanly with the clang compiler's address sanitizer facility. |
| 25 | |
| 26 | =head2 CVE-2013-1667: memory exhaustion with arbitrary hash keys |
| 27 | |
| 28 | With a carefully crafted set of hash keys (for example arguments on a |
| 29 | URL), it is possible to cause a hash to consume a large amount of memory |
| 30 | and CPU, and thus possibly to achieve a Denial-of-Service. |
| 31 | |
| 32 | This problem has been fixed. |
| 33 | |
| 34 | =head2 memory leak in Encode |
| 35 | |
| 36 | The UTF-8 encoding implementation in Encode.xs had a memory leak which has been |
| 37 | fixed. |
| 38 | |
| 39 | =head2 [perl #111594] Socket::unpack_sockaddr_un heap-buffer-overflow |
| 40 | |
| 41 | A read buffer overflow could occur when copying C<sockaddr> buffers. |
| 42 | Fairly harmless. |
| 43 | |
| 44 | This problem has been fixed. |
| 45 | |
| 46 | =head2 [perl #111586] SDBM_File: fix off-by-one access to global ".dir" |
| 47 | |
| 48 | An extra byte was being copied for some string literals. Fairly harmless. |
| 49 | |
| 50 | This problem has been fixed. |
| 51 | |
| 52 | =head2 off-by-two error in List::Util |
| 53 | |
| 54 | A string literal was being used that included two bytes beyond the |
| 55 | end of the string. Fairly harmless. |
| 56 | |
| 57 | This problem has been fixed. |
| 58 | |
| 59 | =head2 [perl #115994] fix segv in regcomp.c:S_join_exact() |
| 60 | |
| 61 | Under debugging builds, while marking optimised-out regex nodes as type |
| 62 | C<OPTIMIZED>, it could treat blocks of exact text as if they were nodes, |
| 63 | and thus SEGV. Fairly harmless. |
| 64 | |
| 65 | This problem has been fixed. |
| 66 | |
| 67 | =head2 [perl #115992] PL_eval_start use-after-free |
| 68 | |
| 69 | The statement C<local $[;>, when preceded by an C<eval>, and when not part |
| 70 | of an assignment, could crash. Fairly harmless. |
| 71 | |
| 72 | This problem has been fixed. |
| 73 | |
| 74 | =head2 wrap-around with IO on long strings |
| 75 | |
| 76 | Reading or writing strings greater than 2**31 bytes in size could segfault |
| 77 | due to integer wraparound. |
| 78 | |
| 79 | This problem has been fixed. |
| 80 | |
| 81 | =head1 Incompatible Changes |
| 82 | |
| 83 | There are no changes intentionally incompatible with 5.14.0. If any |
| 84 | exist, they are bugs and reports are welcome. |
| 85 | |
| 86 | =head1 Deprecations |
| 87 | |
| 88 | There have been no deprecations since 5.14.0. |
| 89 | |
| 90 | =head1 Modules and Pragmata |
| 91 | |
| 92 | =head2 New Modules and Pragmata |
| 93 | |
| 94 | None |
| 95 | |
| 96 | =head2 Updated Modules and Pragmata |
| 97 | |
| 98 | The following modules have just the minor code fixes as listed above in |
| 99 | L</Security> (version numbers have not changed): |
| 100 | |
| 101 | =over 4 |
| 102 | |
| 103 | =item Socket |
| 104 | |
| 105 | =item SDBM_File |
| 106 | |
| 107 | =item List::Util |
| 108 | |
| 109 | =back |
| 110 | |
| 111 | L<Encode> has been upgraded from version 2.42_01 to version 2.42_02. |
| 112 | |
| 113 | L<Module::CoreList> has been updated to version 2.49_06 to add data for |
| 114 | this release. |
| 115 | |
| 116 | =head2 Removed Modules and Pragmata |
| 117 | |
| 118 | None. |
| 119 | |
| 120 | =head1 Documentation |
| 121 | |
| 122 | =head2 New Documentation |
| 123 | |
| 124 | None. |
| 125 | |
| 126 | =head2 Changes to Existing Documentation |
| 127 | |
| 128 | None. |
| 129 | |
| 130 | =head1 Diagnostics |
| 131 | |
| 132 | No new or changed diagnostics. |
| 133 | |
| 134 | =head1 Utility Changes |
| 135 | |
| 136 | None |
| 137 | |
| 138 | =head1 Configuration and Compilation |
| 139 | |
| 140 | No changes. |
| 141 | |
| 142 | =head1 Platform Support |
| 143 | |
| 144 | =head2 New Platforms |
| 145 | |
| 146 | None. |
| 147 | |
| 148 | =head2 Discontinued Platforms |
| 149 | |
| 150 | None. |
| 151 | |
| 152 | =head2 Platform-Specific Notes |
| 153 | |
| 154 | =over 4 |
| 155 | |
| 156 | =item VMS |
| 157 | |
| 158 | 5.14.3 failed to compile on VMS due to incomplete application of a patch |
| 159 | series that allowed C<userelocatableinc> and C<usesitecustomize> to be |
| 160 | used simultaneously. Other platforms were not affected and the problem |
| 161 | has now been corrected. |
| 162 | |
| 163 | =back |
| 164 | |
| 165 | =head1 Selected Bug Fixes |
| 166 | |
| 167 | =over 4 |
| 168 | |
| 169 | =item * |
| 170 | |
| 171 | In Perl 5.14.0, C<$tainted ~~ @array> stopped working properly. Sometimes |
| 172 | it would erroneously fail (when C<$tainted> contained a string that occurs |
| 173 | in the array I<after> the first element) or erroneously succeed (when |
| 174 | C<undef> occurred after the first element) [perl #93590]. |
| 175 | |
| 176 | =back |
| 177 | |
| 178 | =head1 Known Problems |
| 179 | |
| 180 | None. |
| 181 | |
| 182 | =head1 Acknowledgements |
| 183 | |
| 184 | Perl 5.14.4 represents approximately 5 months of development since Perl 5.14.3 |
| 185 | and contains approximately 1,700 lines of changes across 49 files from 12 |
| 186 | authors. |
| 187 | |
| 188 | Perl continues to flourish into its third decade thanks to a vibrant community |
| 189 | of users and developers. The following people are known to have contributed the |
| 190 | improvements that became Perl 5.14.4: |
| 191 | |
| 192 | Andy Dougherty, Chris 'BinGOs' Williams, Christian Hansen, Craig A. Berry, |
| 193 | Dave Rolsky, David Mitchell, Dominic Hargreaves, Father Chrysostomos, |
| 194 | Florian Ragwitz, Reini Urban, Ricardo Signes, Yves Orton. |
| 195 | |
| 196 | |
| 197 | The list above is almost certainly incomplete as it is automatically generated |
| 198 | from version control history. In particular, it does not include the names of |
| 199 | the (very much appreciated) contributors who reported issues to the Perl bug |
| 200 | tracker. |
| 201 | |
| 202 | For a more complete list of all of Perl's historical contributors, please see |
| 203 | the F<AUTHORS> file in the Perl source distribution. |
| 204 | |
| 205 | |
| 206 | =head1 Reporting Bugs |
| 207 | |
| 208 | If you find what you think is a bug, you might check the articles |
| 209 | recently posted to the comp.lang.perl.misc newsgroup and the perl |
| 210 | bug database at http://rt.perl.org/perlbug/ . There may also be |
| 211 | information at http://www.perl.org/ , the Perl Home Page. |
| 212 | |
| 213 | If you believe you have an unreported bug, please run the L<perlbug> |
| 214 | program included with your release. Be sure to trim your bug down |
| 215 | to a tiny but sufficient test case. Your bug report, along with the |
| 216 | output of C<perl -V>, will be sent off to perlbug@perl.org to be |
| 217 | analysed by the Perl porting team. |
| 218 | |
| 219 | If the bug you are reporting has security implications, which make it |
| 220 | inappropriate to send to a publicly archived mailing list, then please send |
| 221 | it to perl5-security-report@perl.org. This points to a closed subscription |
| 222 | unarchived mailing list, which includes all the core committers, who be able |
| 223 | to help assess the impact of issues, figure out a resolution, and help |
| 224 | co-ordinate the release of patches to mitigate or fix the problem across all |
| 225 | platforms on which Perl is supported. Please only use this address for |
| 226 | security issues in the Perl core, not for modules independently |
| 227 | distributed on CPAN. |
| 228 | |
| 229 | =head1 SEE ALSO |
| 230 | |
| 231 | The F<Changes> file for an explanation of how to view exhaustive details |
| 232 | on what changed. |
| 233 | |
| 234 | The F<INSTALL> file for how to build Perl. |
| 235 | |
| 236 | The F<README> file for general stuff. |
| 237 | |
| 238 | The F<Artistic> and F<Copying> files for copyright information. |
| 239 | |
| 240 | =cut |