diff -cr perl-5.8.0/op.c perl-5.8.0.patched/op.c *** perl-5.8.0/op.c Wed Jul 10 00:36:04 2002 --- perl-5.8.0.patched/op.c Mon Dec 12 18:33:03 2005 *************** *** 2445,2451 **** /* XXX might want a ck_negate() for this */ cUNOPo->op_first->op_private &= ~OPpCONST_STRICT; break; - case OP_SPRINTF: case OP_UCFIRST: case OP_LCFIRST: case OP_UC: --- 2445,2450 ---- diff -cr perl-5.8.0/opcode.h perl-5.8.0.patched/opcode.h *** perl-5.8.0/opcode.h Fri Jun 21 14:52:13 2002 --- perl-5.8.0.patched/opcode.h Mon Dec 12 18:33:03 2005 *************** *** 1584,1590 **** 0x0022281c, /* vec */ 0x0122291c, /* index */ 0x0122291c, /* rindex */ ! 0x0004280f, /* sprintf */ 0x00042805, /* formline */ 0x0001379e, /* ord */ 0x0001378e, /* chr */ --- 1584,1590 ---- 0x0022281c, /* vec */ 0x0122291c, /* index */ 0x0122291c, /* rindex */ ! 0x0004280d, /* sprintf */ 0x00042805, /* formline */ 0x0001379e, /* ord */ 0x0001378e, /* chr */ diff -cr perl-5.8.0/opcode.pl perl-5.8.0.patched/opcode.pl *** perl-5.8.0/opcode.pl Sat Jun 1 18:03:34 2002 --- perl-5.8.0.patched/opcode.pl Mon Dec 12 18:33:03 2005 *************** *** 599,605 **** index index ck_index isT@ S S S? rindex rindex ck_index isT@ S S S? ! sprintf sprintf ck_fun mfst@ S L formline formline ck_fun ms@ S L ord ord ck_fun ifsTu% S? chr chr ck_fun fsTu% S? --- 599,605 ---- index index ck_index isT@ S S S? rindex rindex ck_index isT@ S S S? ! sprintf sprintf ck_fun mst@ S L formline formline ck_fun ms@ S L ord ord ck_fun ifsTu% S? chr chr ck_fun fsTu% S? diff -cr perl-5.8.0/patchlevel.h perl-5.8.0.patched/patchlevel.h *** perl-5.8.0/patchlevel.h Fri Jul 19 00:08:27 2002 --- perl-5.8.0.patched/patchlevel.h Mon Dec 12 18:33:03 2005 *************** *** 82 **** ! ,NULL --- 82,83 ---- ! ,"SPRINTF0 - fixes for sprintf formatting issues - CVE-2005-3962" ! ,NULL diff -cr perl-5.8.0/perl.h perl-5.8.0.patched/perl.h *** perl-5.8.0/perl.h Thu Jun 20 14:30:34 2002 --- perl-5.8.0.patched/perl.h Mon Dec 12 18:33:03 2005 *************** *** 2919,2924 **** --- 2919,2926 ---- INIT("The %s function is unimplemented"); EXTCONST char PL_no_myglob[] INIT("\"my\" variable %s can't be in a package"); + EXTCONST char PL_memory_wrap[] + INIT("panic: memory wrap"); EXTCONST char PL_uuemap[65] INIT("`!\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_"); diff -cr perl-5.8.0/sv.c perl-5.8.0.patched/sv.c *** perl-5.8.0/sv.c Wed Jul 17 23:52:14 2002 --- perl-5.8.0.patched/sv.c Mon Dec 12 18:34:01 2005 *************** *** 7849,7857 **** if (vectorarg) { if (args) vecsv = va_arg(*args, SV*); ! else ! vecsv = (evix ? evix <= svmax : svix < svmax) ? ! svargs[ewix ? ewix-1 : svix++] : &PL_sv_undef; dotstr = SvPVx(vecsv, dotstrlen); if (DO_UTF8(vecsv)) is_utf8 = TRUE; --- 7849,7860 ---- if (vectorarg) { if (args) vecsv = va_arg(*args, SV*); ! else if (evix) { ! vecsv = (evix > 0 && evix <= svmax) ! ? svargs[evix-1] : &PL_sv_undef; ! } else { ! vecsv = svix < svmax ? svargs[svix++] : &PL_sv_undef; ! } dotstr = SvPVx(vecsv, dotstrlen); if (DO_UTF8(vecsv)) is_utf8 = TRUE; *************** *** 7861,7872 **** vecstr = (U8*)SvPVx(vecsv,veclen); vec_utf8 = DO_UTF8(vecsv); } ! else if (efix ? efix <= svmax : svix < svmax) { vecsv = svargs[efix ? efix-1 : svix++]; vecstr = (U8*)SvPVx(vecsv,veclen); vec_utf8 = DO_UTF8(vecsv); } else { vecstr = (U8*)""; veclen = 0; } --- 7864,7876 ---- vecstr = (U8*)SvPVx(vecsv,veclen); vec_utf8 = DO_UTF8(vecsv); } ! else if (efix ? (efix > 0 && efix <= svmax) : svix < svmax) { vecsv = svargs[efix ? efix-1 : svix++]; vecstr = (U8*)SvPVx(vecsv,veclen); vec_utf8 = DO_UTF8(vecsv); } else { + vecsv = &PL_sv_undef; vecstr = (U8*)""; veclen = 0; } *************** *** 7967,7975 **** if (vectorize) argsv = vecsv; ! else if (!args) ! argsv = (efix ? efix <= svmax : svix < svmax) ? ! svargs[efix ? efix-1 : svix++] : &PL_sv_undef; switch (c = *q++) { --- 7971,7985 ---- if (vectorize) argsv = vecsv; ! else if (!args) { ! if (efix) { ! const I32 i = efix-1; ! argsv = (i >= 0 && i < svmax) ? svargs[i] : &PL_sv_undef; ! } else { ! argsv = (svix >= 0 && svix < svmax) ! ? svargs[svix++] : &PL_sv_undef; ! } ! } switch (c = *q++) { *************** *** 8211,8216 **** --- 8221,8228 ---- *--eptr = '0'; break; case 2: + if (!uv) + alt = FALSE; do { dig = uv & 1; *--eptr = '0' + dig; *************** *** 8446,8454 **** --- 8458,8470 ---- } have = esignlen + zeros + elen; + if (have < zeros) + Perl_croak_nocontext(PL_memory_wrap); need = (have > width ? have : width); gap = need - have; + if (need >= (((STRLEN)~0) - SvCUR(sv) - dotstrlen - 1)) + Perl_croak_nocontext(PL_memory_wrap); SvGROW(sv, SvCUR(sv) + need + dotstrlen + 1); p = SvEND(sv); if (esignlen && fill == '0') { diff -cr perl-5.8.0/t/lib/warnings/sv perl-5.8.0.patched/t/lib/warnings/sv *** perl-5.8.0/t/lib/warnings/sv Sat Jun 1 18:03:48 2002 --- perl-5.8.0.patched/t/lib/warnings/sv Mon Dec 12 18:33:03 2005 *************** *** 281,292 **** printf F "%\x02" ; $a = sprintf "%\x02" ; EXPECT - Invalid conversion in sprintf: "%z" at - line 5. - Invalid conversion in sprintf: end of string at - line 7. - Invalid conversion in sprintf: "%\002" at - line 9. Invalid conversion in printf: "%z" at - line 4. Invalid conversion in printf: end of string at - line 6. Invalid conversion in printf: "%\002" at - line 8. ######## # sv.c use warnings 'misc' ; --- 281,292 ---- printf F "%\x02" ; $a = sprintf "%\x02" ; EXPECT Invalid conversion in printf: "%z" at - line 4. + Invalid conversion in sprintf: "%z" at - line 5. Invalid conversion in printf: end of string at - line 6. + Invalid conversion in sprintf: end of string at - line 7. Invalid conversion in printf: "%\002" at - line 8. + Invalid conversion in sprintf: "%\002" at - line 9. ######## # sv.c use warnings 'misc' ; diff -cr perl-5.8.0/t/op/sprintf.t perl-5.8.0.patched/t/op/sprintf.t *** perl-5.8.0/t/op/sprintf.t Sun Jul 14 19:31:13 2002 --- perl-5.8.0.patched/t/op/sprintf.t Mon Dec 12 18:33:21 2005 *************** *** 367,369 **** --- 367,374 ---- >%vp< >''< >%vp INVALID< >%vs,%d< >[1, 2, 3]< >1,2< >%v_< >''< >%v_ INVALID< + >%#b< >0< >0< + >%#o< >0< >0< + >%#x< >0< >0< + >%2918905856$v2d< >''< >< + >%*2918905856$v2d< >''< > UNINIT< *** perl-5.8.0/globvar.sym Mon Aug 14 16:22:14 2000 --- perl-5.8.0.patched/globvar.sym Mon Dec 12 21:04:34 2005 *************** *** 66,68 **** --- 66,69 ---- vtbl_collxfrm vtbl_amagic vtbl_amagicelem + memory_wrap