From david@kineticode.com

Subject​: Bug in Code Refs Generated by Safe.pm 2.20
Message-Id​: <5.10.1_31343_1263414654@​kineticode.com>
Reply-To​: david@​kineticode.com
To​: perlbug@​perl.org

This is a bug report for perl from david@​kineticode.com,
generated with the help of perlbug 1.39 running under perl 5.10.1.

Safe 2.20 has a bug I first noticed in PL/Perl​: An anonymous sub created by
the Safe container will have bogus arguments passed to it. In PL/Perl the
characters included things like NULLs, which was really annoying​:

  postgres=# create or replace function wtf(text) returns text language plperl as $$
  postgres$# join '', map { '{' . ord() . '}' } split // => shift;
  postgres$# $$;
  CREATE FUNCTION
  Time​: 30.829 ms
  postgres=#
  postgres=# select wtf('foo');
  wtf
  -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
  {0}{0}{0}{15}{0}{0}{0}{0}{0}{0}{0}{0}{0}{0}{32}{0}{0}{12}{0}{0}{0}{144}{4}{128}{2}{236}{132}{247}{255}{239}{255}{255}{255}{255}{255}{255}{255}{7}{242}{255}{143}{255}{255}{255}{127}{0}

I was able to fix this by downgrading to Safe.pm 2.19. So somthing changed. I
was able to replicate the failure to a certain degree in pure Perl​:

  # cat ~/bin/try
  #!/usr/local/bin/perl -w

  use strict;
  use warnings;
  require Safe;
  use feature '​:5.10';

  my $PLContainer = new Safe('PLPerl');
  $PLContainer->permit_only('​:default');
  my $sub = $PLContainer->reval(qq[
  sub { join '', map { '{' . ord() . '}' } split // => shift; }
  ]);
  say $sub->('foo');

  # cd Safe-2.20
  Safe-2.20# sudo make install UNINST=1
  Installing /usr/local/lib/perl5/5.10.1/darwin-thread-multi-2level/Safe.pm
  Installing /usr/local/share/man/man3/Safe.3
  Appending installation info to /usr/local/lib/perl5/5.10.1/darwin-thread-multi-2level/perllocal.pod

  Safe-2.20# try
  {80}{76}{80}{101}{114}{108}

  Safe-2.20# cd ../Safe-2.19
  Safe-2.19# sudo make install UNINST=1
  Installing /usr/local/lib/perl5/5.10.1/darwin-thread-multi-2level/Safe.pm
  Installing /usr/local/share/man/man3/Safe.3
  Appending installation info to /usr/local/lib/perl5/5.10.1/darwin-thread-multi-2level/perllocal.pod

  Safe-2.19# try
  {102}{111}{111}

I turns out that 2.20 is returning the string "PLPerl" from the sub call,
rather than crazy binary shit, but still, this appears to be the same bug.

Flags​:
  category=library
  severity=high
  module=Safe

Site configuration information for perl 5.10.1​:

Configured by david at Thu Dec 24 13​:23​:17 PST 2009.

Summary of my perl5 (revision 5 version 10 subversion 1) configuration​:
 
  Platform​:
  osname=darwin, osvers=10.2.0, archname=darwin-thread-multi-2level
  uname='darwin benedict.local 10.2.0 darwin kernel version 10.2.0​: tue nov 3 10​:37​:10 pst 2009; root​:xnu-1486.2.11~1release_i386 i386 '
  config_args='-des -Duseshrplib -Dusemultiplicity -Duseithreads -Dperladmin=david@​kineticode.com -Dcf_email=david@​kineticode.com'
  hint=recommended, useposix=true, d_sigaction=define
  useithreads=define, usemultiplicity=define
  useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
  use64bitint=define, use64bitall=define, uselongdouble=undef
  usemymalloc=n, bincompat5005=undef
  Compiler​:
  cc='cc', ccflags ='-fno-common -DPERL_DARWIN -no-cpp-precomp -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include',
  optimize='-O3',
  cppflags='-no-cpp-precomp -fno-common -DPERL_DARWIN -no-cpp-precomp -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include'
  ccversion='', gccversion='4.2.1 (Apple Inc. build 5646) (dot 1)', gccosandvers=''
  intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678
  d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
  ivtype='long', ivsize=8, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
  alignbytes=8, prototype=define
  Linker and Libraries​:
  ld='env MACOSX_DEPLOYMENT_TARGET=10.3 cc', ldflags =' -fstack-protector -L/usr/local/lib'
  libpth=/usr/local/lib /usr/lib
  libs=-ldbm -ldl -lm -lutil -lc
  perllibs=-ldl -lm -lutil -lc
  libc=/usr/lib/libc.dylib, so=dylib, useshrplib=true, libperl=libperl.dylib
  gnulibc_version=''
  Dynamic Linking​:
  dlsrc=dl_dlopen.xs, dlext=bundle, d_dlsymun=undef, ccdlflags=' '
  cccdlflags=' ', lddlflags=' -bundle -undefined dynamic_lookup -L/usr/local/lib -fstack-protector'

Locally applied patches​:
 

@​INC for perl 5.10.1​:
  /usr/local/lib/perl5/5.10.1/darwin-thread-multi-2level
  /usr/local/lib/perl5/5.10.1
  /usr/local/lib/perl5/site_perl/5.10.1/darwin-thread-multi-2level
  /usr/local/lib/perl5/site_perl/5.10.1
  /usr/local/lib/perl5/site_perl/5.10.0/darwin-thread-multi-2level
  /usr/local/lib/perl5/site_perl/5.10.0
  /usr/local/lib/perl5/site_perl
  .

Environment for perl 5.10.1​:
  DYLD_LIBRARY_PATH (unset)
  HOME=/Users/david
  LANG=en_US.UTF-8
  LANGUAGE (unset)
  LD_LIBRARY_PATH (unset)
  LOGDIR (unset)
  PATH=/opt/local/bin​:/usr/local/bin​:/usr/local/sbin​:/usr/bin​:/bin​:/usr/sbin​:/sbin​:/usr/local/bin​:/usr/X11/bin​:/opt/local/bin​:/usr/local/sbin​:/Developer/Tools​:/Users/david/bin​:/usr/local/pgsql/bin​:/usr/local/mysql/bin​:/Developer/Tools​:/Users/david/bin​:/usr/local/pgsql/bin​:/usr/local/mysql/bin
  PERL_BADLANG (unset)
  SHELL=/bin/zsh

From @timbunce

I've fixed this on my github fork and sent a pull request
http​://github.com/timbunce/Safe/commits/master

A new Safe release is needed that should then be included in 5.12.

Tim.

The RT System itself - Status changed from 'new' to 'open'

From david@kineticode.com

On Jan 14, 2010, at 7​:14 AM, Tim Bunce wrote​:

I've fixed this on my github fork and sent a pull request
http​://github.com/timbunce/Safe/commits/master

A new Safe release is needed that should then be included in 5.12.

Fix confirmed, including in PL/Perl. Thanks!

David

From @rgarcia

2010/1/14 David E. Wheeler <david@​kineticode.com>​:

On Jan 14, 2010, at 7​:14 AM, Tim Bunce wrote​:

I've fixed this on my github fork and sent a pull request
http​://github.com/timbunce/Safe/commits/master

A new Safe release is needed that should then be included in 5.12.

Fix confirmed, including in PL/Perl. Thanks!

Thanks, applied to blead, Safe 2.21 on its way to the CPAN.

@rgs - Status changed from 'open' to 'resolved'