perl-FCGI/cve-2011-2766.patch
2011-09-23 11:51:42 +02:00

37 lines
1.1 KiB
Diff

For some reason the global hash was not working as expected. This patch
replaces it with a global hashref. Tests show behavior as expected:
diff --git a/perl/FCGI.PL b/perl/FCGI.PL
index 746aaf3..ce0d70b 100644
--- a/perl/FCGI.PL
+++ b/perl/FCGI.PL
@@ -295,14 +295,14 @@ sub Request(;***$*$) {
sub accept() {
warn "accept called as a method; you probably wanted to call Accept" if @_;
- if (%FCGI::ENV) {
- %ENV = %FCGI::ENV;
+ if (defined $FCGI::ENV) {
+ %ENV = %$FCGI::ENV;
} else {
- %FCGI::ENV = %ENV;
+ $FCGI::ENV = {%ENV};
}
my $rc = Accept($global_request);
- for (keys %FCGI::ENV) {
- $ENV{$_} = $FCGI::ENV{$_} unless exists $ENV{$_};
+ for (keys %$FCGI::ENV) {
+ $ENV{$_} = $FCGI::ENV->{$_} unless exists $ENV{$_};
}
# not SFIO
@@ -314,7 +314,7 @@ sub accept() {
sub finish() {
warn "finish called as a method; you probably wanted to call Finish" if @_;
- %ENV = %FCGI::ENV if %FCGI::ENV;
+ %ENV = %$FCGI::ENV if (defined $FCGI::ENV);
# not SFIO
if (tied (*STDIN)) {