/ 
Tk-804.036
/ Tk::Event
Security Advisories (3)
CVE-2007-4772 (2008-01-09)

The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted regular expression.

CVE-2007-6067 (2008-01-09)

Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states.

CVE-2017-12652 (2019-07-10)

libpng before 1.6.32 does not properly check the length of chunks against the user limit.

NAME

Tk::Event - ToolKit for Events

SYNOPSIS

use Tk::Event;

Tk::Event->fileevent(\*FH, 'readable' => callback);

Tk::Event->lineavail(\*FH, callback);

use Tk::Event::Signal qw(INT);

$SIG{'INT'} = callback;

use Tk::Event::process;

Tk::Event->proc($pid, callback);

QueueEvent(callback [, position])

DESCRIPTION

That is better than nothing but still hard to use. Most scripts want higher level result (a line, a "block" of data etc.)

So it has occured to me that we could use new-ish TIEHANDLE thus:

my $obj = tie SOMEHANDLE,Tk::Event::IO;

while (<SOMEHANDLE>)
 {
 }

Then the READLINE routine registers a callback and looks something like:

sub READLINE
 {
  my $obj = shift;
  Event->io(*$obj,'readable',sub { sysread(*$obj,${*$obj},1,length(${*$obj}) });
  my $pos;
  while (($pos = index(${*$obj},$/) < 0)
   {
    DoOneEvent();
   }
  Event->io(*$obj,'readable',''); # unregister
  $pos += length($/);
  my $result = substr(${*$obj},0,$pos);
  substr(${*$obj},0,$pos) = '';
  return $result;
 }

This is using the scalar part of the glob representing the _inner_ IO as a buffer in which to accumulate chars.