Change 26410: [perl #8262] //g loops infinitely on tainted data

[Dave Mitchell]

Change 26410 by [EMAIL PROTECTED] on 2005/12/19 22:07:49

        [perl #8262] //g loops infinitely on tainted data
        make the LHS of expr =~ /foo/g an lvalue, so that any pos magic
        attached to it stays attached.

Affected files ...

... //depot/perl/op.c#732 edit
... //depot/perl/t/op/taint.t#69 edit

Differences ...

==== //depot/perl/op.c#732 (text) ====
Index: perl/op.c
--- perl/op.c#731~26402~        2005-12-19 10:17:19.000000000 -0800
+++ perl/op.c   2005-12-19 14:07:49.000000000 -0800
@@ -1142,8 +1142,9 @@
        /* FALL THROUGH */
     default:
       nomod:
-       /* grep, foreach, subcalls, refgen */
-       if (type == OP_GREPSTART || type == OP_ENTERSUB || type == OP_REFGEN)
+       /* grep, foreach, subcalls, refgen, m//g */
+       if (type == OP_GREPSTART || type == OP_ENTERSUB || type == OP_REFGEN
+           || type == OP_MATCH)
            break;
        yyerror(Perl_form(aTHX_ "Can't modify %s in %s",
                     (o->op_type == OP_NULL && (o->op_flags & OPf_SPECIAL)
@@ -1822,9 +1823,14 @@
     }
     if (!(right->op_flags & OPf_STACKED) && ismatchop) {
        right->op_flags |= OPf_STACKED;
-       if (right->op_type != OP_MATCH &&
-            ! (right->op_type == OP_TRANS &&
-               right->op_private & OPpTRANS_IDENTICAL))
+       /* s/// and tr/// modify their arg.
+        * m//g also indirectly modifies the arg by setting pos magic on it */
+       if (   (right->op_type == OP_MATCH &&
+                   (cPMOPx(right)->op_pmflags & PMf_GLOBAL))
+           || (right->op_type == OP_SUBST)
+           || (right->op_type == OP_TRANS &&
+               ! (right->op_private & OPpTRANS_IDENTICAL))
+       )
            left = mod(left, right->op_type);
        if (right->op_type == OP_TRANS)
            o = newBINOP(OP_NULL, OPf_STACKED, scalar(left), right);

==== //depot/perl/t/op/taint.t#69 (xtext) ====
Index: perl/t/op/taint.t
--- perl/t/op/taint.t#68~25094~ 2005-07-07 07:47:51.000000000 -0700
+++ perl/t/op/taint.t   2005-12-19 14:07:49.000000000 -0800
@@ -17,7 +17,7 @@
 use File::Spec::Functions;
 
 BEGIN { require './test.pl'; }
-plan tests => 244;
+plan tests => 245;
 
 
 $| = 1;
@@ -1135,3 +1135,17 @@
     eval { local $0, eval '1' };
     test $@ eq '';
 }
+
+# [perl #8262] //g loops infinitely on tainted data
+
+{
+    my @a;
+    $a[0] = $^X;
+    my $i = 0;
+    while($a[0]=~ m/(.)/g ) {
+       last if $i++ > 10000;
+    }
+    test $i < 10000, "infinite m//g";
+    
+}
+
End of Patch.