This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
[perl #45167] Taint removal by sprintf
authorDavid Mitchell <davem@iabyn.com>
Sun, 21 Mar 2010 00:01:09 +0000 (00:01 +0000)
committerDavid Mitchell <davem@iabyn.com>
Sun, 21 Mar 2010 00:10:11 +0000 (00:10 +0000)
commit3e6bd4bfcd175c613d32ccb2eb2fde8ff580206a
treed201dbf1dcf2006795c2d1a70019879e157cd1e6
parentb112cff9879ef9e20ee30b1a9ec813b1336a3093
[perl #45167] Taint removal by sprintf

Under some circumstances the value returned by sprintf wasn't tainted,
even though its args were. While trying to fix this, I also came across
a second bug (which made fixing the first bug very confusing!) where
the TARG of the sprintf op, after getting tainted once, permanently
retained taint magic, which depending on circumstances, wasn't always set
to untainted (mg_len =0)

The original bug basically boiled down to parts of Perl_sv_vcatpvfn()
directly manipulating the target with SvGROW() / Copy(), which failed
to taint the target. Other parts used sv_catsv(), which did. So for
example:
    "%s%s" failed, (only SvGROW)
    "%s %s" worked (the space char was appended using sv_catsv).
pp.c
sv.c
t/op/taint.t