Re: FW: Localizing %SIG in Safe.pm 2.{35,36,37} crashes POE::Wheel::Run ...

2013-07-17 Thread Rafael Garcia-Suarez
On 17 July 2013 09:40, Markus Jansen wrote: > Hi Rafael, > > I agree the signal code in Safe should stay ... however, on both 5.18.0 > (Linux) and 5.10.1 (Solaris SPARC) I have found > that the "local %SIG;" code snippet obviously leads to non-execution of the > registered signal subroutines, >

Re: FW: Localizing %SIG in Safe.pm 2.{35,36,37} crashes POE::Wheel::Run ...

2013-07-17 Thread Rafael Garcia-Suarez
Hi all Breaking out a Safe compartment is all about compiling code that will be executed later. It happens that there are working exploits that use a combination of %SIG and eval inside the safe-evaled block to execute such compilations; then arbitrary commands can be run on any signal received by

RE: FW: Localizing %SIG in Safe.pm 2.{35,36,37} crashes POE::Wheel::Run ...

2013-07-17 Thread Markus Jansen
Hi Rafael, I agree the signal code in Safe should stay ... however, on both 5.18.0 (Linux) and 5.10.1 (Solaris SPARC) I have found that the "local %SIG;" code snippet obviously leads to non-execution of the registered signal subroutines, and instead to Perl bailing out. For which Perl versions