Security Advisories (9)
CVE-2015-2325 (2020-01-14)

The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.

CVE-2015-2326 (2020-01-14)

The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".

CVE-2015-8382 (2015-12-02)

The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.

CVE-2007-1659 (2007-11-07)

Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via regex patterns containing unmatched "\Q\E" sequences with orphan "\E" codes.

CVE-2007-1661 (2007-11-07)

Perl-Compatible Regular Expression (PCRE) library before 7.3 backtracks too far when matching certain input bytes against some regex patterns in non-UTF-8 mode, which allows context-dependent attackers to obtain sensitive information or cause a denial of service (crash), as demonstrated by the "\X?\d" and "\P{L}?\d" patterns.

CVE-2007-1662 (2007-11-07)

Perl-Compatible Regular Expression (PCRE) library before 7.3 reads past the end of the string when searching for unmatched brackets and parentheses, which allows context-dependent attackers to cause a denial of service (crash), possibly involving forward references.

CVE-2007-4766 (2007-11-07)

Multiple integer overflows in Perl-Compatible Regular Expression (PCRE) library before 7.3 allow context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via unspecified escape (backslash) sequences.

CVE-2007-4767 (2007-11-07)

Perl-Compatible Regular Expression (PCRE) library before 7.3 does not properly compute the length of (1) a \p sequence, (2) a \P sequence, or (3) a \P{x} sequence, which allows context-dependent attackers to cause a denial of service (infinite loop or crash) or execute arbitrary code.

CVE-2007-4768 (2007-11-07)

Heap-based buffer overflow in Perl-Compatible Regular Expression (PCRE) library before 7.3 allows context-dependent attackers to execute arbitrary code via a singleton Unicode sequence in a character class in a regex pattern, which is incorrectly optimized.

NAME

pugs::run - How to execute Pugs

SYNOPSYS

pugs [ -h ] [ -v ] [ -V[:configvar] ] [ -c [file] ] [ -Cbackend [file] ] [ -Bbackend [file] ] [ -Mmodule ] [ --external [file] ] [ -e program ]

DESCRIPTION

The normal way to run a Perl program is by making it directly executable, or else by passing the name of the source file as an argument on the command line. An interactive Pugs environment is also available, by starting pugs with no program source. Upon startup, Pugs looks for your program in one of the following places:

WRITEME

Command line options

You can pass various command line options to Pugs.

-e program

causes Pugs to not look for any program files in the command line options, but instead run the one-line program specified. Multiple -e commands work too.

-n

causes Pugs to assume the following loop around your program, which makes it iterate over filename arguments somewhat like sed -n or awk:

while =<> {
    ...your program here...
}
-p

causes Pugs to assume the following loop around your program, which makes it iterate over filename arguments somewhat like sed:

while =<> {
    ...your program here...
    say;
}
-c

causes Pugs to not run the program, but merely check its syntax.

Note that BEGIN {...} and CHECK {...} blocks, as well as use Module, are still executed, because these might change the grammar or create new operators, etc. So the following is not safe:

pugs -c 'BEGIN { system "evil command" }'

If you want to run a potentially unsafe program safely, see the safemode Pugs provides.

-Bbackend

causes Pugs to execute the program using backend. Currently, valid backends are Pugs, Parrot, and Haskell.

-Cbackend

causes Pugs to compile the program using backend. Currently, valid backends are Pugs, Parrot, and Haskell.

Note that, as with -c, BEGIN {...} and CHECK {...} blocks, as well as use Module, are still executed. So don't try to compile potentially unsafe code!

-Mmodule

causes Pugs to load module before executing your program:

use module;
...your code here...
-h or --help

outputs a short summary of the available command line options. No programs are executed.

-V

outputs the version of Pugs you're running and long configuration information.

-V:item

outputs short configuration information for item.

$ pugs -V:pugs_version
pugs_versnum: 6.2.6
-v or --version

outputs the version of Pugs you're running.

-l, -d, and -w

are ignored for compatibility with Perl 5.

ENVIRONMENT

The Pugs runtime environment is affected by several environment variables.

The build environment is likewise controlled by several environment variables; since Pugs is still in heavy development, they will be listed here as well.

HARNESS_PERL [BUILD]

This does not affect pugs itself at all. When building Pugs from source, the Perl 5 test system should be instructed to use your copy of Pugs. If you use make test or make smoke, you should not need to set this manually; but if you want to use prove, set it to ./pugs (or pugs.exe on Windows).

PERL6LIB

A list of directories in which to look for Perl library files before looking in the standard library and the current directory. Any architecture-specific directories under the specified locations are automatically included if they exist. If PERL6LIB is not defined, PERLLIB is used. Directories are separated (like in PATH) by a colon on unixish platforms and by a semicolon on Windows (the proper path separator being given by the command pugs -V:path_sep).

When building your own pugs, set PERL6LIB to blib6/lib to make tests use the correct version of the libraries. make test and make smoke should do this for you.

PERLLIB

A list of directories in which to look for Perl library files before looking in the standard library and the current directory. Not consulted if PERL6LIB is defined. See PERL6LIB for details on paths.

PUGS_BYPASS_PRELUDE

Many Perl functions are provided to Pugs by a library called the Standard Prelude, which is inlined into the pugs executable and loaded by default on each startup of pugs. If PUGS_BYPASS_PRELUDE is set to anything except "" or "0", then pugs will not load the Prelude automatically. This gives a minor speedup on startup, as well as allowing you to load your alternate version of Prelude.pm like this:

# in this example, Prelude.pm will be searched for in @*INC
$ env PUGS_BYPASS_PRELUDE=1 pugs -MPrelude -e '...'
PUGS_SAFEMODE

Pugs provides a global "safe mode" which makes many operations that are deemed "unsafe", i.e. operations which use IO, unavailable to a Perl program.

$ env PUGS_SAFEMODE=1 pugs -e 'say "I am unsafe"'
*** No compatible subroutine found: "&say"
    at -e line 1, column 1-9
PUGS_SMOKE_UPLOAD [BUILD]

If set, util/run-smoke.pl (make smoke) uses this to upload your smoke tests results automatically. Set this to a command to run, e.g.

rsync -avz smoke.html perlcabal.org:public_html
PUGS_TESTS_CONCURRENT [BUILD]

Smoke tests can take quite some time to complete. If you have a multiprocessor machine, you can set this to a small integer value, and util/yaml_harness.pl will run that amount of tests in parallel.

On a single-processor hyper-threading machine that is otherwise unused, 2 is a good value. On real multiprocessor machines, one more than the CPU count is suggested.

Equivalent to running util/yaml_harness.pl -j number .

[Has no effect on Windows.]

SEE ALSO

Perl6::Pugs