1

I'm using Perl for the first time for production software and I have some trust issues with it. When I use the unpack() function, is it safe to use user input in the TEMPLATE string? I'm using a TEMPLATE like "Z$user_controlled" to read a string value to a variable. The constant $user_controlled is defined external source that the user can control. Am I taking a risk? Can an attacker do something bad if he changes the TEMPLATE string into something weird?

EDIT: Changed the wording to be more generic.

Juha Kivekäs
  • 326
  • 2
  • 7

1 Answers1

1

The "p" template parameter will interpret its part of the input string as a memory address (available to the Perl interpreter's process), and copy all characters from that address, up to the next null character, into the returned string. This might also cause a segfault/access violation if memory at this address is not readable.

The "P" template parameter is similar, but the length of the copied string is fixed, and provided in the template.

These parameters exist to allow access to data outside of the input string, so you should probably check into how they could be abused on your platform.

Christopher Oicles
  • 111
  • 2