ae5aa7ac32
CVE-2005-3962 and CVE-2005-3912 and "Sys::Syslog security
vulnerabilities" issues.
- Fix bug 136009 / MakeMaker LD_RUN_PATH issue: restore previous default
Red Hat behavior of removing the MakeMaker generated LD_RUN_PATH
setting from the link command . Document this removal, as it
contravenes upstream default behavior, and provide a USE_MM_LD_RUN_PATH
MakeMaker member to enable use of the MakeMaker generated LD_RUN_PATH .
421 lines
15 KiB
Diff
421 lines
15 KiB
Diff
--- perl-5.8.7/t/lib/warnings/sv.CVE-2005-3962-bz174684 2004-03-18 07:51:14.000000000 -0500
|
|
+++ perl-5.8.7/t/lib/warnings/sv 2005-12-09 13:57:57.000000000 -0500
|
|
@@ -301,12 +301,12 @@
|
|
printf F "%\x02" ;
|
|
$a = sprintf "%\x02" ;
|
|
EXPECT
|
|
-Invalid conversion in sprintf: "%z" at - line 5.
|
|
-Invalid conversion in sprintf: end of string at - line 7.
|
|
-Invalid conversion in sprintf: "%\002" at - line 9.
|
|
Invalid conversion in printf: "%z" at - line 4.
|
|
+Invalid conversion in sprintf: "%z" at - line 5.
|
|
Invalid conversion in printf: end of string at - line 6.
|
|
+Invalid conversion in sprintf: end of string at - line 7.
|
|
Invalid conversion in printf: "%\002" at - line 8.
|
|
+Invalid conversion in sprintf: "%\002" at - line 9.
|
|
########
|
|
# sv.c
|
|
use warnings 'misc' ;
|
|
--- perl-5.8.7/t/op/sprintf.t.CVE-2005-3962-bz174684 2003-09-01 03:41:07.000000000 -0400
|
|
+++ perl-5.8.7/t/op/sprintf.t 2005-12-09 13:57:57.000000000 -0500
|
|
@@ -385,3 +385,6 @@
|
|
>%4$K %d< >[45, 67]< >%4$K 45 INVALID<
|
|
>%d %K %d< >[23, 45]< >23 %K 45 INVALID<
|
|
>%*v*999\$d %d %d< >[11, 22, 33]< >%*v*999\$d 11 22 INVALID<
|
|
+>%#b< >0< >0<
|
|
+>%#o< >0< >0<
|
|
+>%#x< >0< >0<
|
|
--- perl-5.8.7/t/op/sprintf2.t.CVE-2005-3962-bz174684 2004-02-09 16:37:13.000000000 -0500
|
|
+++ perl-5.8.7/t/op/sprintf2.t 2005-12-09 13:57:57.000000000 -0500
|
|
@@ -6,7 +6,7 @@
|
|
require './test.pl';
|
|
}
|
|
|
|
-plan tests => 3;
|
|
+plan tests => 7;
|
|
|
|
is(
|
|
sprintf("%.40g ",0.01),
|
|
@@ -26,3 +26,29 @@
|
|
q(width calculation under utf8 upgrade)
|
|
);
|
|
}
|
|
+
|
|
+# Used to mangle PL_sv_undef
|
|
+fresh_perl_is(
|
|
+ 'print sprintf "xxx%n\n"; print undef',
|
|
+ 'Modification of a read-only value attempted at - line 1.',
|
|
+ { switches => [ '-w' ] },
|
|
+ q(%n should not be able to modify read-only constants),
|
|
+);
|
|
+
|
|
+# check %NNN$ for range bounds, especially negative 2's complement
|
|
+{
|
|
+ my ($warn, $bad) = (0,0);
|
|
+ local $SIG{__WARN__} = sub {
|
|
+ if ($_[0] =~ /uninitialized/) {
|
|
+ $warn++
|
|
+ }
|
|
+ else {
|
|
+ $bad++
|
|
+ }
|
|
+ };
|
|
+ my $result = sprintf join('', map("%$_\$s%" . ~$_ . '$s', 1..20)),
|
|
+ qw(a b c d);
|
|
+ is($result, "abcd", "only four valid values");
|
|
+ is($warn, 36, "expected warnings");
|
|
+ is($bad, 0, "unexpected warnings");
|
|
+}
|
|
--- perl-5.8.7/opcode.h.CVE-2005-3962-bz174684 2005-05-27 12:29:50.000000000 -0400
|
|
+++ perl-5.8.7/opcode.h 2005-12-09 13:57:57.000000000 -0500
|
|
@@ -1585,7 +1585,7 @@
|
|
0x0022281c, /* vec */
|
|
0x0122291c, /* index */
|
|
0x0122291c, /* rindex */
|
|
- 0x0004280f, /* sprintf */
|
|
+ 0x0004280d, /* sprintf - WAS 0x0004280f before patch #26283 */
|
|
0x00042805, /* formline */
|
|
0x0001379e, /* ord */
|
|
0x0001378e, /* chr */
|
|
--- perl-5.8.7/op.c.CVE-2005-3962-bz174684 2005-04-22 10:12:32.000000000 -0400
|
|
+++ perl-5.8.7/op.c 2005-12-09 13:57:57.000000000 -0500
|
|
@@ -2076,7 +2076,9 @@
|
|
/* XXX might want a ck_negate() for this */
|
|
cUNOPo->op_first->op_private &= ~OPpCONST_STRICT;
|
|
break;
|
|
- case OP_SPRINTF:
|
|
+/* Removed as part of fix for CVE-2005-3962 / Upstream patch 26283 :
|
|
+ * case OP_SPRINTF:
|
|
+ */
|
|
case OP_UCFIRST:
|
|
case OP_LCFIRST:
|
|
case OP_UC:
|
|
--- perl-5.8.7/makedef.pl.CVE-2005-3962-bz174684 2005-05-09 09:27:41.000000000 -0400
|
|
+++ perl-5.8.7/makedef.pl 2005-12-09 13:57:57.000000000 -0500
|
|
@@ -635,11 +635,13 @@
|
|
)];
|
|
}
|
|
|
|
-if ($define{'PERL_MALLOC_WRAP'}) {
|
|
- emit_symbols [qw(
|
|
- PL_memory_wrap
|
|
- )];
|
|
-}
|
|
+# Removed as part of fix for CVE-2005-3962 / CVE-2005-3962 /
|
|
+# Upstream patch #26283
|
|
+# if ($define{'PERL_MALLOC_WRAP'}) {
|
|
+# emit_symbols [qw(
|
|
+# PL_memory_wrap
|
|
+# )];
|
|
+#}
|
|
|
|
unless ($define{'USE_5005THREADS'} || $define{'USE_ITHREADS'}) {
|
|
skip_symbols [qw(
|
|
--- perl-5.8.7/ext/Sys/Syslog/Syslog.pm.CVE-2005-3962-bz174684 2005-04-22 07:53:56.000000000 -0400
|
|
+++ perl-5.8.7/ext/Sys/Syslog/Syslog.pm 2005-12-09 13:57:57.000000000 -0500
|
|
@@ -1,14 +1,13 @@
|
|
package Sys::Syslog;
|
|
require 5.006;
|
|
require Exporter;
|
|
-require DynaLoader;
|
|
use Carp;
|
|
use strict;
|
|
|
|
-our @ISA = qw(Exporter DynaLoader);
|
|
+our @ISA = qw(Exporter);
|
|
our @EXPORT = qw(openlog closelog setlogmask syslog);
|
|
our @EXPORT_OK = qw(setlogsock);
|
|
-our $VERSION = '0.06';
|
|
+our $VERSION = '0.08';
|
|
|
|
# it would be nice to try stream/unix first, since that will be
|
|
# most efficient. However streams are dodgy - see _syslog_send_stream
|
|
@@ -54,26 +53,38 @@
|
|
|
|
=item openlog $ident, $logopt, $facility
|
|
|
|
+Opens the syslog.
|
|
I<$ident> is prepended to every message. I<$logopt> contains zero or
|
|
more of the words I<pid>, I<ndelay>, I<nowait>. The cons option is
|
|
ignored, since the failover mechanism will drop down to the console
|
|
automatically if all other media fail. I<$facility> specifies the
|
|
part of the system to report about, for example LOG_USER or LOG_LOCAL0:
|
|
see your C<syslog(3)> documentation for the facilities available in
|
|
-your system.
|
|
+your system. This function will croak if it can't connect to the syslog
|
|
+daemon.
|
|
|
|
B<You should use openlog() before calling syslog().>
|
|
|
|
+=item syslog $priority, $message
|
|
+
|
|
=item syslog $priority, $format, @args
|
|
|
|
-If I<$priority> permits, logs I<($format, @args)>
|
|
-printed as by C<printf(3V)>, with the addition that I<%m>
|
|
-is replaced with C<"$!"> (the latest error message).
|
|
+If I<$priority> permits, logs I<$message> or I<sprintf($format, @args)>
|
|
+with the addition that I<%m> in $message or $format is replaced with
|
|
+C<"$!"> (the latest error message).
|
|
|
|
If you didn't use openlog() before using syslog(), syslog will try to
|
|
guess the I<$ident> by extracting the shortest prefix of I<$format>
|
|
that ends in a ":".
|
|
|
|
+Note that Sys::Syslog version v0.07 and older passed the $message as
|
|
+the formatting string to sprintf() even when no formatting arguments
|
|
+were provided. If the code calling syslog() might execute with older
|
|
+versions of this module, make sure to call the function as
|
|
+syslog($priority, "%s", $message) instead of syslog($priority,
|
|
+$message). This protects against hostile formatting sequences that
|
|
+might show up if $message contains tainted data.
|
|
+
|
|
=item setlogmask $mask_priority
|
|
|
|
Sets log mask I<$mask_priority> and returns the old mask.
|
|
@@ -175,7 +186,8 @@
|
|
goto &$AUTOLOAD;
|
|
}
|
|
|
|
-bootstrap Sys::Syslog $VERSION;
|
|
+require XSLoader;
|
|
+XSLoader::load('Sys::Syslog', $VERSION);
|
|
|
|
our $maskpri = &LOG_UPTO(&LOG_DEBUG);
|
|
|
|
@@ -316,9 +328,16 @@
|
|
|
|
$whoami .= "[$$]" if our $lo_pid;
|
|
|
|
- $mask =~ s/(?<!%)%m/$!/g;
|
|
+ if ($mask =~ /%m/) {
|
|
+ my $err = $!;
|
|
+ # escape percent signs if sprintf will be called
|
|
+ $err =~ s/%/%%/g if @_;
|
|
+ # replace %m with $err, if preceded by an even number of percent signs
|
|
+ $mask =~ s/(?<!%)((?:%%)*)%m/$1$err/g;
|
|
+ }
|
|
+
|
|
$mask .= "\n" unless $mask =~ /\n$/;
|
|
- $message = sprintf ($mask, @_);
|
|
+ $message = @_ ? sprintf($mask, @_) : $mask;
|
|
|
|
$sum = $numpri + $numfac;
|
|
my $buf = "<$sum>$whoami: $message\0";
|
|
--- perl-5.8.7/opcode.pl.CVE-2005-3962-bz174684 2004-12-01 08:54:30.000000000 -0500
|
|
+++ perl-5.8.7/opcode.pl 2005-12-09 13:57:57.000000000 -0500
|
|
@@ -606,7 +606,7 @@
|
|
index index ck_index isT@ S S S?
|
|
rindex rindex ck_index isT@ S S S?
|
|
|
|
-sprintf sprintf ck_fun mfst@ S L
|
|
+sprintf sprintf ck_fun mst@ S L
|
|
formline formline ck_fun ms@ S L
|
|
ord ord ck_fun ifsTu% S?
|
|
chr chr ck_fun fsTu% S?
|
|
--- perl-5.8.7/handy.h.CVE-2005-3962-bz174684 2005-04-20 12:33:28.000000000 -0400
|
|
+++ perl-5.8.7/handy.h 2005-12-09 13:57:57.000000000 -0500
|
|
@@ -598,91 +598,65 @@
|
|
|
|
=cut */
|
|
|
|
-#ifndef lint
|
|
-
|
|
#define NEWSV(x,len) newSV(len)
|
|
|
|
#ifdef PERL_MALLOC_WRAP
|
|
#define MEM_WRAP_CHECK(n,t) \
|
|
- (void)((n)>((MEM_SIZE)~0)/sizeof(t)?(Perl_croak_nocontext(PL_memory_wrap),0):0)
|
|
+ (void)((sizeof(t)>1?(n):1)>((MEM_SIZE)~0)/sizeof(t)?(Perl_croak_nocontext(PL_memory_wrap),0):0)
|
|
#define MEM_WRAP_CHECK_1(n,t,a) \
|
|
- (void)((n)>((MEM_SIZE)~0)/sizeof(t)?(Perl_croak_nocontext(a),0):0)
|
|
+ (void)((sizeof(t)>1?(n):1)>((MEM_SIZE)~0)/sizeof(t)?(Perl_croak_nocontext(a),0):0)
|
|
#define MEM_WRAP_CHECK_2(n,t,a,b) \
|
|
- (void)((n)>((MEM_SIZE)~0)/sizeof(t)?(Perl_croak_nocontext(a,b),0):0)
|
|
+ (void)((sizeof(t)>1?(n):1)>((MEM_SIZE)~0)/sizeof(t)?(Perl_croak_nocontext(a,b),0):0)
|
|
+#define MEM_WRAP_CHECK_(n,t) MEM_WRAP_CHECK(n,t),
|
|
|
|
-#define New(x,v,n,t) (v = (MEM_WRAP_CHECK(n,t), (t*)safemalloc((MEM_SIZE)((n)*sizeof(t)))))
|
|
-#define Newc(x,v,n,t,c) (v = (MEM_WRAP_CHECK(n,t), (c*)safemalloc((MEM_SIZE)((n)*sizeof(t)))))
|
|
-#define Newz(x,v,n,t) (v = (MEM_WRAP_CHECK(n,t), (t*)safemalloc((MEM_SIZE)((n)*sizeof(t))))), \
|
|
- memzero((char*)(v), (n)*sizeof(t))
|
|
-#define Renew(v,n,t) \
|
|
- (v = (MEM_WRAP_CHECK(n,t), (t*)saferealloc((Malloc_t)(v),(MEM_SIZE)((n)*sizeof(t)))))
|
|
-#define Renewc(v,n,t,c) \
|
|
- (v = (MEM_WRAP_CHECK(n,t), (c*)saferealloc((Malloc_t)(v),(MEM_SIZE)((n)*sizeof(t)))))
|
|
-#define Safefree(d) safefree((Malloc_t)(d))
|
|
-
|
|
-#define Move(s,d,n,t) (MEM_WRAP_CHECK(n,t), (void)memmove((char*)(d),(char*)(s), (n) * sizeof(t)))
|
|
-#define Copy(s,d,n,t) (MEM_WRAP_CHECK(n,t), (void)memcpy((char*)(d),(char*)(s), (n) * sizeof(t)))
|
|
-#define Zero(d,n,t) (MEM_WRAP_CHECK(n,t), (void)memzero((char*)(d), (n) * sizeof(t)))
|
|
-
|
|
-#define MoveD(s,d,n,t) (MEM_WRAP_CHECK(n,t), memmove((char*)(d),(char*)(s), (n) * sizeof(t)))
|
|
-#define CopyD(s,d,n,t) (MEM_WRAP_CHECK(n,t), memcpy((char*)(d),(char*)(s), (n) * sizeof(t)))
|
|
-#ifdef HAS_MEMSET
|
|
-#define ZeroD(d,n,t) (MEM_WRAP_CHECK(n,t), memzero((char*)(d), (n) * sizeof(t)))
|
|
-#else
|
|
-/* Using bzero(), which returns void. */
|
|
-#define ZeroD(d,n,t) (MEM_WRAP_CHECK(n,t), memzero((char*)(d), (n) * sizeof(t)),d)
|
|
-#endif
|
|
-
|
|
-#define Poison(d,n,t) (MEM_WRAP_CHECK(n,t), (void)memset((char*)(d), 0xAB, (n) * sizeof(t)))
|
|
+#define PERL_STRLEN_ROUNDUP(n) ((void)(((n) > (MEM_SIZE)~0 - 2 * PERL_STRLEN_ROUNDUP_QUANTUM) ? (Perl_croak_nocontext(PL_memory_wrap),0):0),((n-1+PERL_STRLEN_ROUNDUP_QUANTUM)&~((MEM_SIZE)PERL_STRLEN_ROUNDUP_QUANTUM-1)))
|
|
|
|
#else
|
|
|
|
#define MEM_WRAP_CHECK(n,t)
|
|
#define MEM_WRAP_CHECK_1(n,t,a)
|
|
#define MEM_WRAP_CHECK_2(n,t,a,b)
|
|
+#define MEM_WRAP_CHECK_(n,t)
|
|
+
|
|
+#define PERL_STRLEN_ROUNDUP(n) (((n-1+PERL_STRLEN_ROUNDUP_QUANTUM)&~((MEM_SIZE)PERL_STRLEN_ROUNDUP_QUANTUM-1)))
|
|
|
|
-#define New(x,v,n,t) (v = (t*)safemalloc((MEM_SIZE)((n)*sizeof(t))))
|
|
-#define Newc(x,v,n,t,c) (v = (c*)safemalloc((MEM_SIZE)((n)*sizeof(t))))
|
|
-#define Newz(x,v,n,t) (v = (t*)safemalloc((MEM_SIZE)((n)*sizeof(t)))), \
|
|
+#endif
|
|
+
|
|
+#define Newx(v,n,t) (v = (MEM_WRAP_CHECK_(n,t) (t*)safemalloc((MEM_SIZE)((n)*sizeof(t)))))
|
|
+#define Newxc(v,n,t,c) (v = (MEM_WRAP_CHECK_(n,t) (c*)safemalloc((MEM_SIZE)((n)*sizeof(t)))))
|
|
+#define Newxz(v,n,t) (v = (MEM_WRAP_CHECK_(n,t) (t*)safemalloc((MEM_SIZE)((n)*sizeof(t))))), \
|
|
memzero((char*)(v), (n)*sizeof(t))
|
|
+/* pre 5.9.x compatibility */
|
|
+#define New(x,v,n,t) Newx(v,n,t)
|
|
+#define Newc(x,v,n,t,c) Newxc(v,n,t,c)
|
|
+#define Newz(x,v,n,t) Newxz(v,n,t)
|
|
+
|
|
#define Renew(v,n,t) \
|
|
- (v = (t*)saferealloc((Malloc_t)(v),(MEM_SIZE)((n)*sizeof(t))))
|
|
+ (v = (MEM_WRAP_CHECK_(n,t) (t*)saferealloc((Malloc_t)(v),(MEM_SIZE)((n)*sizeof(t)))))
|
|
#define Renewc(v,n,t,c) \
|
|
- (v = (c*)saferealloc((Malloc_t)(v),(MEM_SIZE)((n)*sizeof(t))))
|
|
-#define Safefree(d) safefree((Malloc_t)(d))
|
|
-
|
|
-#define Move(s,d,n,t) (void)memmove((char*)(d),(char*)(s), (n) * sizeof(t))
|
|
-#define Copy(s,d,n,t) (void)memcpy((char*)(d),(char*)(s), (n) * sizeof(t))
|
|
-#define Zero(d,n,t) (void)memzero((char*)(d), (n) * sizeof(t))
|
|
+ (v = (MEM_WRAP_CHECK_(n,t) (c*)saferealloc((Malloc_t)(v),(MEM_SIZE)((n)*sizeof(t)))))
|
|
|
|
-#define MoveD(s,d,n,t) memmove((char*)(d),(char*)(s), (n) * sizeof(t))
|
|
-#define CopyD(s,d,n,t) memcpy((char*)(d),(char*)(s), (n) * sizeof(t))
|
|
-#ifdef HAS_MEMSET
|
|
-#define ZeroD(d,n,t) memzero((char*)(d), (n) * sizeof(t))
|
|
+#ifdef PERL_POISON
|
|
+#define Safefree(d) \
|
|
+ (d ? (void)(safefree((Malloc_t)(d)), Poison(&(d), 1, Malloc_t)) : (void) 0)
|
|
#else
|
|
-#define ZeroD(d,n,t) ((void)memzero((char*)(d), (n) * sizeof(t)),d)
|
|
+#define Safefree(d) safefree((Malloc_t)(d))
|
|
#endif
|
|
|
|
-#define Poison(d,n,t) (void)memset((char*)(d), 0xAB, (n) * sizeof(t))
|
|
+#define Move(s,d,n,t) (MEM_WRAP_CHECK_(n,t) (void)memmove((char*)(d),(const char*)(s), (n) * sizeof(t)))
|
|
+#define Copy(s,d,n,t) (MEM_WRAP_CHECK_(n,t) (void)memcpy((char*)(d),(const char*)(s), (n) * sizeof(t)))
|
|
+#define Zero(d,n,t) (MEM_WRAP_CHECK_(n,t) (void)memzero((char*)(d), (n) * sizeof(t)))
|
|
|
|
+#define MoveD(s,d,n,t) (MEM_WRAP_CHECK_(n,t) memmove((char*)(d),(const char*)(s), (n) * sizeof(t)))
|
|
+#define CopyD(s,d,n,t) (MEM_WRAP_CHECK_(n,t) memcpy((char*)(d),(const char*)(s), (n) * sizeof(t)))
|
|
+#ifdef HAS_MEMSET
|
|
+#define ZeroD(d,n,t) (MEM_WRAP_CHECK_(n,t) memzero((char*)(d), (n) * sizeof(t)))
|
|
+#else
|
|
+/* Using bzero(), which returns void. */
|
|
+#define ZeroD(d,n,t) (MEM_WRAP_CHECK_(n,t) memzero((char*)(d), (n) * sizeof(t)),d)
|
|
#endif
|
|
|
|
-#else /* lint */
|
|
-
|
|
-#define New(x,v,n,s) (v = Null(s *))
|
|
-#define Newc(x,v,n,s,c) (v = Null(s *))
|
|
-#define Newz(x,v,n,s) (v = Null(s *))
|
|
-#define Renew(v,n,s) (v = Null(s *))
|
|
-#define Move(s,d,n,t)
|
|
-#define Copy(s,d,n,t)
|
|
-#define Zero(d,n,t)
|
|
-#define MoveD(s,d,n,t) d
|
|
-#define CopyD(s,d,n,t) d
|
|
-#define ZeroD(d,n,t) d
|
|
-#define Poison(d,n,t)
|
|
-#define Safefree(d) (d) = (d)
|
|
-
|
|
-#endif /* lint */
|
|
+#define Poison(d,n,t) (MEM_WRAP_CHECK_(n,t) (void)memset((char*)(d), 0xAB, (n) * sizeof(t)))
|
|
|
|
#ifdef USE_STRUCT_COPY
|
|
#define StructCopy(s,d,t) (*((t*)(d)) = *((t*)(s)))
|
|
--- perl-5.8.7/perl.h.CVE-2005-3962-bz174684 2005-12-09 13:57:57.000000000 -0500
|
|
+++ perl-5.8.7/perl.h 2005-12-09 13:57:57.000000000 -0500
|
|
@@ -720,6 +720,13 @@
|
|
|
|
#define MEM_SIZE Size_t
|
|
|
|
+/* Round all values passed to malloc up, by default to a multiple of
|
|
+ sizeof(size_t)
|
|
+*/
|
|
+#ifndef PERL_STRLEN_ROUNDUP_QUANTUM
|
|
+#define PERL_STRLEN_ROUNDUP_QUANTUM Size_t_size
|
|
+#endif
|
|
+
|
|
#if defined(STANDARD_C) && defined(I_STDDEF)
|
|
# include <stddef.h>
|
|
# define STRUCT_OFFSET(s,m) offsetof(s,m)
|
|
@@ -3332,10 +3339,8 @@
|
|
INIT("\"my\" variable %s can't be in a package");
|
|
EXTCONST char PL_no_localize_ref[]
|
|
INIT("Can't localize through a reference");
|
|
-#ifdef PERL_MALLOC_WRAP
|
|
EXTCONST char PL_memory_wrap[]
|
|
INIT("panic: memory wrap");
|
|
-#endif
|
|
|
|
EXTCONST char PL_uuemap[65]
|
|
INIT("`!\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_");
|
|
--- perl-5.8.7/sv.c.CVE-2005-3962-bz174684 2005-05-27 06:38:11.000000000 -0400
|
|
+++ perl-5.8.7/sv.c 2005-12-09 13:58:10.000000000 -0500
|
|
@@ -8707,9 +8707,15 @@
|
|
|
|
if (vectorize)
|
|
argsv = vecsv;
|
|
- else if (!args)
|
|
- argsv = (efix ? efix <= svmax : svix < svmax) ?
|
|
- svargs[efix ? efix-1 : svix++] : &PL_sv_undef;
|
|
+ else if (!args) {
|
|
+ if (efix) {
|
|
+ const I32 i = efix-1;
|
|
+ argsv = (i >= 0 && i < svmax) ? svargs[i] : &PL_sv_undef;
|
|
+ } else {
|
|
+ argsv = (svix >= 0 && svix < svmax)
|
|
+ ? svargs[svix++] : &PL_sv_undef;
|
|
+ }
|
|
+ }
|
|
|
|
switch (c = *q++) {
|
|
|
|
@@ -8972,6 +8978,8 @@
|
|
*--eptr = '0';
|
|
break;
|
|
case 2:
|
|
+ if (!uv)
|
|
+ alt = FALSE;
|
|
do {
|
|
dig = uv & 1;
|
|
*--eptr = '0' + dig;
|
|
@@ -9274,6 +9282,8 @@
|
|
|
|
/* calculate width before utf8_upgrade changes it */
|
|
have = esignlen + zeros + elen;
|
|
+ if (have < zeros)
|
|
+ Perl_croak_nocontext(PL_memory_wrap);
|
|
|
|
if (is_utf8 != has_utf8) {
|
|
if (is_utf8) {
|
|
@@ -9301,6 +9311,9 @@
|
|
need = (have > width ? have : width);
|
|
gap = need - have;
|
|
|
|
+ if (need >= (((STRLEN)~0) - SvCUR(sv) - dotstrlen - 1))
|
|
+ Perl_croak_nocontext(PL_memory_wrap);
|
|
+
|
|
SvGROW(sv, SvCUR(sv) + need + dotstrlen + 1);
|
|
p = SvEND(sv);
|
|
if (esignlen && fill == '0') {
|