diff --git a/perl-5.24.1-perl-130814-update-pointer-into-PL_linestr-after-loo.patch b/perl-5.24.1-perl-130814-update-pointer-into-PL_linestr-after-loo.patch new file mode 100644 index 0000000..6a6df7f --- /dev/null +++ b/perl-5.24.1-perl-130814-update-pointer-into-PL_linestr-after-loo.patch @@ -0,0 +1,50 @@ +From 9df34f9c4701104a366e768237ca694411136d2a Mon Sep 17 00:00:00 2001 +From: Hugo van der Sanden +Date: Sun, 19 Feb 2017 10:46:09 +0000 +Subject: [PATCH] update pointer into PL_linestr after lookahead +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Ported to: 5.24.1: + +commit 90f2cc9a600117a49f8ee3e30cc681f062350c24 +Author: Hugo van der Sanden +Date: Sun Feb 19 10:46:09 2017 +0000 + + [perl #130814] update pointer into PL_linestr after lookahead + + Looking ahead for the "Missing $ on loop variable" diagnostic can reallocate + PL_linestr, invalidating our pointer. Save the offset so we can update it + in that case. + +Signed-off-by: Petr Písař +--- + toke.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/toke.c b/toke.c +index 630fc59..029d2ea 100644 +--- a/toke.c ++++ b/toke.c +@@ -7565,6 +7565,7 @@ Perl_yylex(pTHX) + s = skipspace(s); + if (PL_expect == XSTATE && isIDFIRST_lazy_if(s,UTF)) { + char *p = s; ++ SSize_t s_off = s - SvPVX(PL_linestr); + + if ((PL_bufend - p) >= 3 + && strnEQ(p, "my", 2) && isSPACE(*(p + 2))) +@@ -7582,6 +7583,9 @@ Perl_yylex(pTHX) + } + if (*p != '$') + Perl_croak(aTHX_ "Missing $ on loop variable"); ++ ++ /* The buffer may have been reallocated, update s */ ++ s = SvPVX(PL_linestr) + s_off; + } + OPERATOR(FOR); + +-- +2.7.4 + diff --git a/perl-5.25.10-fix-VMS-test-fail.patch b/perl-5.25.10-fix-VMS-test-fail.patch new file mode 100644 index 0000000..38cc190 --- /dev/null +++ b/perl-5.25.10-fix-VMS-test-fail.patch @@ -0,0 +1,44 @@ +From bce4a2abeb8652d19e97d3bf07dd2580a3cc2e6c Mon Sep 17 00:00:00 2001 +From: Hugo van der Sanden +Date: Sat, 25 Feb 2017 10:42:17 +0000 +Subject: [PATCH] fix VMS test fail +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +d7186add added a runperl() test that breaks command line length limits for +VMS. Switch to fresh_perl() instead, so the prog is put in a file for us. + +Signed-off-by: Petr Písař +--- + t/comp/parser_run.t | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/t/comp/parser_run.t b/t/comp/parser_run.t +index 2543f49..e74644d 100644 +--- a/t/comp/parser_run.t ++++ b/t/comp/parser_run.t +@@ -14,14 +14,14 @@ plan(1); + + # [perl #130814] can reallocate lineptr while looking ahead for + # "Missing $ on loop variable" diagnostic. +-my $result = runperl( +- prog => " foreach m0\n\$" . ("0" x 0x2000), +- stderr => 1, ++my $result = fresh_perl( ++ " foreach m0\n\$" . ("0" x 0x2000), ++ { stderr => 1 }, + ); +-is($result, < +Date: Sun, 19 Feb 2017 11:15:38 +0000 +Subject: [PATCH] [perl #130814] Add testcase, and new testfile + t/comp/parser_run.t +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Sometimes it's useful to have test.pl around, but it seems inappropriate +to pollute the existing t/comp/parser.t with that. + +Signed-off-by: Petr Písař +--- + t/comp/parser_run.t | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + create mode 100644 t/comp/parser_run.t + +diff --git a/t/comp/parser_run.t b/t/comp/parser_run.t +new file mode 100644 +index 0000000..2543f49 +--- /dev/null ++++ b/t/comp/parser_run.t +@@ -0,0 +1,28 @@ ++#!./perl ++ ++# Parser tests that want test.pl, eg to use runperl() for tests to show ++# reads through invalid pointers. ++# Note that this should still be runnable under miniperl. ++ ++BEGIN { ++ @INC = qw(. ../lib ); ++ chdir 't' if -d 't'; ++} ++ ++require './test.pl'; ++plan(1); ++ ++# [perl #130814] can reallocate lineptr while looking ahead for ++# "Missing $ on loop variable" diagnostic. ++my $result = runperl( ++ prog => " foreach m0\n\$" . ("0" x 0x2000), ++ stderr => 1, ++); ++is($result, < +Date: Sun, 10 Jul 2016 22:06:12 -0600 +Subject: [PATCH] t/test.pl: Add fresh_perl() function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This will be useful for cases where the results don't readily fall into +fresh_perl_is and fresh_perl_like, such as when a bunch of massaging of +the results is needed before it is convenient to test them. +fresh_perl_like() could be used, but in the case of failure there could +be lines and lines of noise output. + +Signed-off-by: Petr Písař +--- + t/test.pl | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +diff --git a/t/test.pl b/t/test.pl +index 41b77f4..20d08e9 100644 +--- a/t/test.pl ++++ b/t/test.pl +@@ -953,11 +953,16 @@ sub register_tempfile { + return $count; + } + +-# This is the temporary file for _fresh_perl ++# This is the temporary file for fresh_perl + my $tmpfile = tempfile(); + +-sub _fresh_perl { +- my($prog, $action, $expect, $runperl_args, $name) = @_; ++sub fresh_perl { ++ my($prog, $runperl_args) = @_; ++ ++ # Run 'runperl' with the complete perl program contained in '$prog', and ++ # arguments in the hash referred to by '$runperl_args'. The results are ++ # returned, with $? set to the exit code. Unless overridden, stderr is ++ # redirected to stdout. + + # Given the choice of the mis-parsable {} + # (we want an anon hash, but a borked lexer might think that it's a block) +@@ -975,7 +980,8 @@ sub _fresh_perl { + close TEST or die "Cannot close $tmpfile: $!"; + + my $results = runperl(%$runperl_args); +- my $status = $?; ++ my $status = $?; # Not necessary to save this, but it makes it clear to ++ # future maintainers. + + # Clean up the results into something a bit more predictable. + $results =~ s/\n+$//; +@@ -994,6 +1000,17 @@ sub _fresh_perl { + $results =~ s/\n\n/\n/g; + } + ++ $? = $status; ++ return $results; ++} ++ ++ ++sub _fresh_perl { ++ my($prog, $action, $expect, $runperl_args, $name) = @_; ++ ++ my $results = fresh_perl($prog, $runperl_args); ++ my $status = $?; ++ + # Use the first line of the program as a name if none was given + unless( $name ) { + ($first_line, $name) = $prog =~ /^((.{1,50}).*)/; +-- +2.7.4 + diff --git a/perl.spec b/perl.spec index e01514a..96d3127 100644 --- a/perl.spec +++ b/perl.spec @@ -313,6 +313,16 @@ Patch88: perl-5.24.1-perl-129340-copy-the-source-when-inside-the-dest-in- # in upstream after 5.25.10 Patch89: perl-5.24.1-perl-130822-fix-an-AV-leak-in-Perl_reg_named_buff_fe.patch +# Fix an invalid memory read when parsing a loop variable, RT#130814, +# in upstream after 5.25.10 +Patch90: perl-5.25.10-perl-130814-Add-testcase-and-new-testfile-t-comp-par.patch +# in upstream after 5.25.10 +Patch91: perl-5.24.1-perl-130814-update-pointer-into-PL_linestr-after-loo.patch +# in upstream after 5.25.2 +Patch92: perl-5.25.2-t-test.pl-Add-fresh_perl-function.patch +# in upstream after 5.25.10 +Patch93: perl-5.25.10-fix-VMS-test-fail.patch + # Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048 Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch @@ -3028,6 +3038,10 @@ popd %patch87 -p1 %patch88 -p1 %patch89 -p1 +%patch90 -p1 +%patch91 -p1 +%patch92 -p1 +%patch93 -p1 %patch200 -p1 %patch201 -p1 @@ -3102,6 +3116,7 @@ perl -x patchlevel.h \ 'Fedora Patch87: Fix a null-pointer dereference on malformed code (RT#130815)' \ 'Fedora Patch88: Fix an use-after-free in substr() that modifies a magic variable (RT#129340)' \ 'Fedora Patch89: Fix a memory leak leak in Perl_reg_named_buff_fetch() (RT#130822)' \ + 'Fedora Patch90: Fix an invalid memory read when parsing a loop variable (RT#130814)' \ 'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \ 'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \ %{nil} @@ -5382,6 +5397,7 @@ popd - Fix a null-pointer dereference on malformed code (RT#130815) - Fix an use-after-free in substr() that modifies a magic variable (RT#129340) - Fix a memory leak leak in Perl_reg_named_buff_fetch() (RT#130822) +- Fix an invalid memory read when parsing a loop variable (RT#130814) * Fri Feb 17 2017 Petr Pisar - 4:5.24.1-389 - Adapt Compress::Raw::Zlib to zlib-1.2.11 (bug #1420326)