in reply to eval() and security
$ perl -e 'print q{(}x20000' | perl -e 'my $x=<STDIN>; eval{q{bla} =~ +/$x/}' Segmentation fault
("works" with 5.8.4, 5.8.8, 5.10.0, 5.10.1, on Linux)
Sure, a segfault isn't necessarily an exploit in itself, but skilled crackers can sometimes turn it into one, depending on the execution context of the program... In other words, although you could easily take care of this particular one by limiting the length of the input, I wouldn't feel all that sure someone determined couldn't come up with a shorter one.
|
|---|