Below is code chunk? line 275 is marked with line ***LINE 275***

the BuildFormat function is the second function which is called

Thanks Robert Walkup

sub PrintToStdOut{
        $utlp->LogFile ("FUNCTION=PrintToStdOut\n") if($DEBUG);
        my($msg,@list)=@_;

        if(scalar(@list)){
                my(@flist);
***LINE 275*** eval($utlp->BuildFormat($fields,"STDOUT",0,\@titles,\@l
+engths));


                $- = 0;
                $^L="\n";

                 if(scalar(@list)){
                        print STDOUT ("$msg");
                        if(scalar(@{$list[0]}) > 1){ #if >1 then it is
+ a multi array
                                @flist=@list;
                        }
                        else{ #is it is a array
                                push @flist,[ @list ];

                        }

                        for my $ref (@flist){
                                @cols = @$ref;
                                
                                write STDOUT;
                        }
                }


        }
        else{
                 print STDOUT ("$msg");
        }
}



sub BuildFormat{
        my $self = shift;
        my($fld_cnt,$fmt,$ext,$titles,$lengths)=@_;
        $self->LogFile ("FUNCTION=BuildFormat\n") if($self->{DEBUG});
        $ext=0 if(!$ext);
        my(@titles)=@$titles;
        my(@lengths)=@$lengths;
        my($format_top) = "format ${fmt}_TOP =\n";
        my($format) ="format $fmt =\n";
        my($fmtStr);
        my($colStr);
        my($headerStr);
        my($lines);
        my($i);
        for ($i=0;$i<$fld_cnt;$i++){
                my $strLen=$lengths[$i];
                my $tmp=$strLen;
                $strLen=length($titles[$i]) if(length($titles[$i])>$st
+rLen);
                $strLen=$strLen+$ext;
                $headerStr="$headerStr" . " " if($i);
                $lines="$lines" . " " if($i);
                $fmtStr="$fmtStr" . " " if($i);
                $colStr="$colStr" . " " if($i);

                $colStr="$colStr" . $self->rpad('@',$strLen+1,'<');
                $headerStr="$headerStr" . $self->rpad($titles[$i],$str
+Len+1);
                $lines="$lines" . $self->rpad("-",$strLen+1,"-");
                $fmtStr="$fmtStr" . "\$cols[$i]";
                $fmtStr="$fmtStr," if($i < $fld_cnt-1);
        }
        $format_top="$format_top" . "$headerStr\n" .  "$lines\n" . ".\
+n\n";
        $format="$format" . "$colStr\n"  . "$fmtStr" .  "\n.\n\n";
        $format="$format_top" . "$format";
        $self->Log("FORMAT -> $format")  if($self->{DEBUG});
        print("FORMAT -> $format")  if($self->{DEBUG});
        #print STDOUT ("FORMAT -> $format");
        return($format);
}
[download]

When faced with a strange problem like this, it helps to strip as much out as possible, to try to get to a small example that demonstrates the problem.

Here's the example I came up with:

#/usr/bin/perl -T

$insecure = $ARGV[0];

eval makeformat($insecure);
write;

sub makeformat {
    my($name) = @_;        # note: $name is tainted

    return "format = \n" .
           "\@<<<<\n" .
           '$' . $name . "\n" .
           ".\n"

    # the returned format string is tainted
}
[download]

The implication is that you're constructing one of your format strings using a variable (or variables) that are still tainted.