Hello,
the following diff addresses CVE-2012-6329.
Index: gnu/usr.bin/perl/patchlevel.h
===================================================================
RCS file: /cvs/src/gnu/usr.bin/perl/patchlevel.h,v
retrieving revision 1.28
diff -u -p -r1.28 patchlevel.h
--- gnu/usr.bin/perl/patchlevel.h 26 Oct 2012 18:56:49 -0000 1.28
+++ gnu/usr.bin/perl/patchlevel.h 31 Jan 2013 13:10:16 -0000
@@ -135,6 +135,7 @@ static const char * const local_patches[
,"Updated Digest to 1.17"
,"CVE-2011-2939"
,"CVE-2012-5195"
+ ,"CVE-2012-6329"
#ifdef PERL_GIT_UNCOMMITTED_CHANGES
,"uncommitted-changes"
#endif
Index: gnu/usr.bin/perl/dist/Locale-Maketext/lib/Locale/Maketext/Guts.pm
===================================================================
RCS file:
/cvs/src/gnu/usr.bin/perl/dist/Locale-Maketext/lib/Locale/Maketext/Guts.pm,v
retrieving revision 1.1.1.1
diff -u -p -r1.1.1.1 Guts.pm
--- gnu/usr.bin/perl/dist/Locale-Maketext/lib/Locale/Maketext/Guts.pm 24 Sep
2010 14:48:48 -0000 1.1.1.1
+++ gnu/usr.bin/perl/dist/Locale-Maketext/lib/Locale/Maketext/Guts.pm 31 Jan
2013 13:10:17 -0000
@@ -140,20 +140,10 @@ sub _compile {
# 0-length method name means to just interpolate:
push @code, ' (';
}
- elsif($m =~ /^\w+(?:\:\:\w+)*$/s
- and $m !~ m/(?:^|\:)\d/s
- # exclude starting a (sub)package or symbol with a
digit
+ elsif($m =~ /^\w+$/s
+ # exclude anything fancy, especially fully-qualified
+ # module names
) {
- # Yes, it even supports the demented (and
undocumented?)
- # $obj->Foo::bar(...) syntax.
- $target->_die_pointing(
- $_[1], q{Can't use "SUPER::" in a bracket-group
method},
- 2 + length($c[-1])
- )
- if $m =~ m/^SUPER::/s;
- # Because for SUPER:: to work, we'd have to compile
this into
- # the right package, and that seems just not worth
the bother,
- # unless someone convinces me otherwise.
push @code, ' $_[0]->' . $m . '(';
}
@@ -208,7 +198,9 @@ sub _compile {
elsif(substr($1,0,1) ne '~') {
# it's stuff not containing "~" or "[" or "]"
# i.e., a literal blob
- $c[-1] .= $1;
+ my $text = $1;
+ $text =~ s/\\/\\\\/g;
+ $c[-1] .= $text;
}
elsif($1 eq '~~') { # "~~"
@@ -246,7 +238,9 @@ sub _compile {
else {
# It's a "~X" where X is not a special character.
# Consider it a literal ~ and X.
- $c[-1] .= $1;
+ my $text = $1;
+ $text =~ s/\\/\\\\/g;
+ $c[-1] .= $text;
}
}
}
Cheers,
Sebastian
[1]
http://perl5.git.perl.org/perl.git/commitdiff/1735f6f53ca19f99c6e9e39496c486af323ba6a8?hp=569ba91fcdabdc53eb4284f860a25273bd7fe4e1
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6329
