From martin.evans@easysoft.com

Created by martin.evans@easysoft.com

If I run the script below without taint mode (-t) it takes no time​:
$ time perl /tmp/taint.pl
data is tainted​: no
40960000

real 0m0.175s
user 0m0.048s
sys 0m0.096s

and if I run it in taint mode it takes ages​:

$ time perl -t /tmp/taint.pl
data is tainted​: yes
40960000

real 8m16.734s
user 1m29.482s
sys 6m47.257s

$ cat /tmp/taint.pl
use strict;
use warnings;
use Scalar​::Util qw(tainted);

my $fd;
open($fd, ">", "file.dat");
print $fd 'x' x 4096;
close $fd;

my $data;
{
  local $/;
  open ($fd, "<", "file.dat");
  $data = <$fd>;
  close $fd;
}
print "data is tainted​: ", tainted($data) ? 'yes' : 'no', "\n";

my %hash;
$hash{content} = '';

foreach (1..10000) {
  # comment following line out to make this fly
  my $ref = ref($hash{content});
  #if (!$ref) {
  $hash{content} .= $data;
  #}
}

print length($hash{content}), "\n";

I should point out that although PERL5LIB was set in this run I reran
with PERL5LIB unset and the same happens.

Flags:
    category=core
    severity=medium

Site configuration information for perl 5.12.1:

Configured by martin at Tue Jun 22 13:21:00 BST 2010.

Summary of my perl5 (revision 5 version 12 subversion 1) configuration:

  Platform:
    osname=linux, osvers=2.6.31-17-generic, archname=i686-linux
    uname='linux betdevel 2.6.31-17-generic #54-ubuntu smp thu dec 10
16:20:31 utc 2009 i686 gnulinux '
    config_args='-de -Dprefix=/home/martin/perl5121 -DDEBUGGING'
    hint=recommended, useposix=true, d_sigaction=define
    useithreads=undef, usemultiplicity=undef
    useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
    use64bitint=undef, use64bitall=undef, uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='cc', ccflags ='-DDEBUGGING -fno-strict-aliasing -pipe
-fstack-protector -I/usr/local/include -D_LARGEFILE_SOURCE
-D_FILE_OFFSET_BITS=64',
    optimize='-O2 -g',
    cppflags='-DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector
-I/usr/local/include'
    ccversion='', gccversion='4.4.1', gccosandvers=''
    intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t',
lseeksize=8
    alignbytes=4, prototype=define
  Linker and Libraries:
    ld='cc', ldflags =' -fstack-protector -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib /usr/lib64
    libs=-lnsl -ldb -ldl -lm -lcrypt -lutil -lc
    perllibs=-lnsl -ldl -lm -lcrypt -lutil -lc
    libc=/lib/libc-2.10.1.so, so=so, useshrplib=false, libperl=libperl.a
    gnulibc_version='2.10.1'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
    cccdlflags='-fPIC', lddlflags='-shared -O2 -g -L/usr/local/lib
-fstack-protector'

Locally applied patches:



@INC for perl 5.12.1:
    /home/martin/bet/tools/modules/BET/lib
    /home/martin/bet/cgi
    /home/martin/perl5121/lib/site_perl/5.12.1/i686-linux
    /home/martin/perl5121/lib/site_perl/5.12.1
    /home/martin/perl5121/lib/5.12.1/i686-linux
    /home/martin/perl5121/lib/5.12.1
    .


Environment for perl 5.12.1:
    HOME=/home/martin
    LANG=en_GB.UTF-8
    LANGUAGE (unset)
    LD_LIBRARY_PATH=:/home/oracle/instantclient_11_1/
    LOGDIR (unset)

PATH=/home/martin/perl5121/bin/:/home/oracle/instantclient_11_1/:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
    PERL5LIB=/home/martin/bet/tools/modules/BET/lib:/home/martin/bet/cgi
    PERL_BADLANG (unset)
    SHELL=/bin/bash

-- 
Martin J. Evans
Easysoft Limited
http://www.easysoft.com

From @nwc10

On Tue Jun 22 09​:29​:59 2010, martin.evans@​easysoft.com wrote​:

If I run the script below without taint mode (-t) it takes no time​:
$ time perl /tmp/taint.pl
data is tainted​: no
40960000

real 0m0.175s
user 0m0.048s
sys 0m0.096s

and if I run it in taint mode it takes ages​:

$ time perl -t /tmp/taint.pl
data is tainted​: yes
40960000

real 8m16.734s
user 1m29.482s
sys 6m47.257s

Site configuration information for perl 5.12.1​:

I can confirm that this problem was fixed in blead with commit
fd69380. I don't think that this is
merged to maint-5.12, and I don't know whether it would need
modification before being merged.

Nicholas Clark

The RT System itself - Status changed from 'new' to 'open'

From @iabyn

On Tue, Jun 22, 2010 at 01​:34​:53PM -0700, Nicholas Clark via RT wrote​:

On Tue Jun 22 09​:29​:59 2010, martin.evans@​easysoft.com wrote​:

If I run the script below without taint mode (-t) it takes no time​:
$ time perl /tmp/taint.pl
data is tainted​: no
40960000

real 0m0.175s
user 0m0.048s
sys 0m0.096s

and if I run it in taint mode it takes ages​:

$ time perl -t /tmp/taint.pl
data is tainted​: yes
40960000

real 8m16.734s
user 1m29.482s
sys 6m47.257s

Site configuration information for perl 5.12.1​:

I can confirm that this problem was fixed in blead with commit
fd69380. I don't think that this is
merged to maint-5.12, and I don't know whether it would need
modification before being merged.

Given that its quite a scary change, and that its not a 5.12.0 regression,
I'd recommend not including it in 5.12.2.

--
The crew of the Enterprise encounter an alien life form which is
surprisingly neither humanoid nor made from pure energy.
  -- Things That Never Happen in "Star Trek" #22

@iabyn - Status changed from 'open' to 'resolved'