| Subject: | Use of the pdebug function causes crashes |
| Date: | Tue, 8 Nov 2016 01:04:33 -0800 |
| To: | bug-Net-ICAP [...] rt.cpan.org |
| From: | Mark Wagner <mark [...] carnildo.com> |
The Net::ICAP modules use the pdebug() function from Paranoid::Debug in
the form pdebug("message", level). Frequently, the message includes
user-supplied data.
The documentation of the pdebug() function in Paranoid::Debug 2.04
states, in part:
Show quoted text
> As an added benefit you can pass a printf template along with their
> values and they will be handled appropriately.
The heuristic that the pdebug() function uses to decide if a printf
template has been passed is the presence of a percent sign followed by
any character in the \w character class. This occurs frequently in
real-world data; if the string in question is "%n", the result is a
crash with the error message "Modification of a read-only value
attempted".
The correct way to use pdebug() with data not under the program's
control is in the form of pdebug("%s", level, "message"). This
prevents the message from being interpreted as a format string.