This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
Earlier safety check for @INC entry in pp_require.
authorCraig A. Berry <craigberry@mac.com>
Sat, 14 Sep 2013 23:25:58 +0000 (18:25 -0500)
committerCraig A. Berry <craigberry@mac.com>
Tue, 17 Sep 2013 02:06:53 +0000 (21:06 -0500)
In order to make sure we find embedded NULs early enough, before
the directories in @INC have been through library calls that use C
strings, check each directory in pp_require before concatenating
a filename onto it.

pp_ctl.c
t/op/require_errors.t

index 5eebe24..c4123d2 100644 (file)
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -3969,6 +3969,8 @@ PP(pp_require)
                        dirlen = 0;
                    }
 
+                   if (!IS_SAFE_SYSCALL(dir, dirlen, "@INC entry", "require"))
+                       continue;
 #ifdef VMS
                    if (((unixdirbuf = SvPVX(sv_2mortal(newSVpv("", VMS_MAXRSS-1)))) == NULL)
                        || ((unixdir = tounixpath(dir, unixdirbuf)) == NULL))
index 28a52e3..ec7a122 100644 (file)
@@ -128,7 +128,7 @@ like $@, qr/^Can't locate strict\.pm\\0invalid: /, 'do nul check';
   local @INC = @INC;
   unshift @INC, "lib\0invalid";
   eval { require "unknown.pm" };
-  like $WARN, qr{^Invalid \\0 character in pathname for require: lib\\0invalid/unknown\.pm at }, 'nul warning';
+  like $WARN, qr{^Invalid \\0 character in \@INC entry for require: lib\\0invalid at }, 'nul warning';
 }
 eval "require strict\0::invalid;";
 like $@, qr/^syntax error at \(eval \d+\) line 1/, 'parse error with \0 in barewords module names';