ikegami at adaelis
Nov 7, 2009, 4:01 PM
Post #3 of 9
(514 views)
Permalink
|
|
Re: [perl #67838] [PATCH] lvalue substr keeping lexical alive
[In reply to]
|
|
On Sat, Nov 7, 2009 at 6:13 PM, yves orton via RT <perlbug-followup [at] perl
> wrote:
> Just out of curiosity why does that code decontaminate differently in
> the two cases? One time it "decontaminates" taint and utf8, and one
> time it just does taint. Is that a bug?
>
Some opcodes always return the result in the same SV to avoid having to
create a new SV everytime the opcode is encountered. This SV is known as
TARG.
The problem with these ops is
1) that they reference their last return value since they use TARG, and
2) that their return value references one of the opcode's arguments when
they are used as lvalues.
{
my $x = "abc"; # REFCOUNT($x) = 1 (pad)
substr($x, 1, 1) = "d"; # REFCOUNT($x) = 2 (pad,substr)
print($x); # REFCOUNT($x) = 2 (pad,substr)
}
# LEAK! # REFCOUNT($x) = 1 (substr)
The mem will relacaimed the next time that substr instance is called.
The patch has the ops use a fresh SV instead of TARG when they're used as
lvalues, making it so the arg never contains a reference to a variable.
Now to answer your question.
Before TARG is reused by the op, it's untainted. There's no use untaintaing
a freshly created variable, and there's no use untainting TARG when TARG
isn't used, so I moved the untainting into the branch where TARG is used.
ELB
|
0001-Tests-to-detect-mem-leaks-in-lvalue-ops-RT-67838.patch
