Fix #249629 - File::Path multiple symlink attack vulnerabilities

Package-Manager: portage-2.2_rc23/cvs/Linux i686

4 files changed, 950 insertions, 6 deletions

diff --git a/dev-lang/perl/ChangeLog b/dev-lang/perl/ChangeLog
index b1da17486866..182560d8e5d3 100644
--- a/dev-lang/perl/ChangeLog
+++ b/dev-lang/perl/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for dev-lang/perl
-# Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-lang/perl/ChangeLog,v 1.274 2008/08/23 05:33:18 jer Exp $
+# Copyright 1999-2009 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/dev-lang/perl/ChangeLog,v 1.275 2009/01/28 09:54:09 tove Exp $
+
+*perl-5.8.8-r6 (28 Jan 2009)
+
+  28 Jan 2009; Torsten Veller <tove@gentoo.org>
+  +files/perl-5.8.8-CAN-2005-0448-rmtree-2.patch, +perl-5.8.8-r6.ebuild:
+  Fix #249629 - File::Path multiple symlink attack vulnerabilities
 
   23 Aug 2008; Jeroen Roovers <jer@gentoo.org> metadata.xml:
   Add GLEP 56 USE flag descriptions. Remove empty tag.
diff --git a/dev-lang/perl/Manifest b/dev-lang/perl/Manifest
index ee3e1ff455d0..a46b50139d71 100644
--- a/dev-lang/perl/Manifest
+++ b/dev-lang/perl/Manifest
@@ -2,6 +2,7 @@
 Hash: SHA1
 
 AUX perl-5.8.7-MakeMaker-RUNPATH.patch 859 RMD160 b0e95fcd9b1bbc085e9986f8910e3fbcf3f78eb2 SHA1 1e7c2f05ffaf8f6aee753ab106a9798e6920ff06 SHA256 3d327c525e0cf57899eca48d417fa4363f40da9b0d6b70b61e951521749047ab
+AUX perl-5.8.8-CAN-2005-0448-rmtree-2.patch 8187 RMD160 db38f78ef5de917719c810595072929ecb11c93a SHA1 da502e4a524b4c86e24ad5e5a027657ebecb9bd5 SHA256 def78de69a0ef27204dfc1f5f39fcd4da1b38327f446e4dca1d37b9890b338e4
 AUX perl-5.8.8-CAN-2005-0448-rmtree.patch 6961 RMD160 bf242f32c1e1450a7d4d252cdc54cace36b50c62 SHA1 97d1f3a3b2d75b7a82983b1f98d4445ff82d2c19 SHA256 d6565afabbc35e0e1aeecfb469eaf037f892834312a7c2616357a309cd56e3f1
 AUX perl-5.8.8-CVE-2008-1927.patch 8129 RMD160 523467accd75f42ea254b1aed219efbfc2c32637 SHA1 0a36c92bb3c59064f3370376a76ef66c63fb1ba4 SHA256 614ebf7a0885fb5f7203627a3051f4df8fee2988d6bfec5a3d8fe70d97f9e45b
 AUX perl-5.8.8-USE_MM_LD_RUN_PATH.patch 4963 RMD160 96dfe54660afdcbd24007ffce886f667270694e7 SHA1 e6a28992b63762985846d10661352d40dbd61370 SHA256 49527cd4272ba177b39562363bf34ec6c7b6e709ee6ac770b7fccc302d18b459
@@ -29,12 +30,13 @@ EBUILD perl-5.8.8-r2.ebuild 18896 RMD160 50dea3ec5837278cae6a39da93f489e8044a278
 EBUILD perl-5.8.8-r3.ebuild 19135 RMD160 ca0b9eb44dc513f36d5c5f3e5737bb905302aa4e SHA1 89ad554b2a3b1d8ef68ab613a6f58879cece5615 SHA256 accc5dfa49afc829439d6a9bd4b1cb4de6752f4bada5800555c2f3511d782b09
 EBUILD perl-5.8.8-r4.ebuild 19134 RMD160 3e9ce03261a16fe7b7bf1a5f1d60e2b327baa47b SHA1 76c394bed4e3cecd186cb79e7e11d0bd07860705 SHA256 32664950c3a585ac8f3ab91df8528b9d8cb4974112df39123218960b68a03b95
 EBUILD perl-5.8.8-r5.ebuild 19212 RMD160 b693b4e8b81979178d2df73b26753652b19f60ca SHA1 0adc7b96cdca57bd2195e6c3f7df00415c7c446a SHA256 526506064432153284dc446d0f613104fbfabcff93ad917db7da920f9f296ad9
-MISC ChangeLog 59231 RMD160 351f1977cae75ac60952ad72739b5d0bcad6c5d5 SHA1 5aed92cc8ab49d04e46380d510c50a773a6f8218 SHA256 72a6f59e650cfdb95d62025ded1e765e10b63a5110a0cd0e0e8c847543f846fb
+EBUILD perl-5.8.8-r6.ebuild 19281 RMD160 4812f16b14d2508cb00fe57466f7803c13ad309b SHA1 93ef5256544180ae47df9afc21ba834dcacfc1f3 SHA256 c51e0666a11089e9a45d9785b0fadc91dfdaad1ff9c8124f0d98b5f6e7957ecc
+MISC ChangeLog 59451 RMD160 30c2aa531e971927bb5e6bc7b55541a0a7bb15bb SHA1 fea2dff710e636e8d814474e6269ace1f6f0baa6 SHA256 a318e4f285a48e76c39087d84969b5ccb54d126a05dc63ce01e1d01c326a4c30
 MISC metadata.xml 451 RMD160 8424230d79d13df7462c454050058b3526a78e92 SHA1 1ae85db5c1c1fc6413ca324ebc93b6894831b437 SHA256 49e06011c113616fa1f618cf58d42c2d6abbce5f71936f109b6ae3a5dfff587c
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.9 (GNU/Linux)
 
-iEYEARECAAYFAkkPwjcACgkQ67wieSYcaxcBGgCfbZUS32b+xgH0S3WPkwXeMaX7
-UY8AnjYwPB0ZoCEZPfV61UobwEfowDsH
-=xRbQ
+iEYEARECAAYFAkmAKycACgkQV3J2n04EauzY5wCfU64uC/FJiaaBbdSHS+0Q43E4
+SlgAn1KFY907+DjYTQgfoRGHEcvzxNxb
+=9+w7
 -----END PGP SIGNATURE-----
diff --git a/dev-lang/perl/files/perl-5.8.8-CAN-2005-0448-rmtree-2.patch b/dev-lang/perl/files/perl-5.8.8-CAN-2005-0448-rmtree-2.patch
new file mode 100644
index 000000000000..d29fc2522168
--- /dev/null
+++ b/dev-lang/perl/files/perl-5.8.8-CAN-2005-0448-rmtree-2.patch
@@ -0,0 +1,280 @@
+SECURITY [CAN-2005-0448]:
+
+Rewrite File::Path::rmtree to avoid race condition which allows an
+attacker with write permission on directories in the tree being
+removed to make files setuid or to remove arbitrary files (see
+http://bugs.debian.org/286905 and http://bugs.debian.org/286922).
+
+Revised for 5.8.8-7etch6 to avoid failure when rmtree removes the
+current directory.
+
+diff --git a/lib/File/Path.pm b/lib/File/Path.pm
+index 2e41ff3..fd32b96 100644
+--- a/lib/File/Path.pm
++++ b/lib/File/Path.pm
+@@ -72,33 +72,17 @@ or C<unlink> to remove it, or that it's skipping it.
+ 
+ =item *
+ 
+-a boolean value, which if TRUE will cause C<rmtree> to
+-skip any files to which you do not have delete access
+-(if running under VMS) or write access (if running
+-under another OS).  This will change in the future when
+-a criterion for 'delete permission' under OSs other
+-than VMS is settled.  (defaults to FALSE)
++a boolean value, which if FALSE (the default for non-root users) will
++cause C<rmtree> to adjust the mode of directories (if required) prior
++to attempting to remove the contents.  Note that on interruption or
++failure of C<rmtree>, directories may be left with more permissive
++modes for the owner.
+ 
+ =back
+ 
+ It returns the number of files successfully deleted.  Symlinks are
+ simply deleted and not followed.
+ 
+-B<NOTE:> There are race conditions internal to the implementation of
+-C<rmtree> making it unsafe to use on directory trees which may be
+-altered or moved while C<rmtree> is running, and in particular on any
+-directory trees with any path components or subdirectories potentially
+-writable by untrusted users.
+-
+-Additionally, if the third parameter is not TRUE and C<rmtree> is
+-interrupted, it may leave files and directories with permissions altered
+-to allow deletion (and older versions of this module would even set
+-files and directories to world-read/writable!)
+-
+-Note also that the occurrence of errors in C<rmtree> can be determined I<only>
+-by trapping diagnostic messages using C<$SIG{__WARN__}>; it is not apparent
+-from the return value.
+-
+ =head1 DIAGNOSTICS
+ 
+ =over 4
+@@ -172,111 +156,127 @@ sub mkpath {
+     @created;
+ }
+ 
+-sub rmtree {
+-    my($roots, $verbose, $safe) = @_;
+-    my(@files);
+-    my($count) = 0;
+-    $verbose ||= 0;
+-    $safe ||= 0;
++sub _rmtree;
++sub _rmtree
++{
++    my ($path, $prefix, $up, $up_dev, $up_ino, $verbose, $safe) = @_;
++    my $up_name = $up eq '..' ? 'parent' : 'initial';
++
++    my ($dev, $ino) = lstat $path or return 0;
++    unless (-d _)
++    {
++	print "unlink $prefix$path\n" if $verbose;
++	unless (unlink $path)
++	{
++	    carp "Can't remove file $prefix$path ($!)";
++	    return 0;
++	}
+ 
+-    if ( defined($roots) && length($roots) ) {
+-      $roots = [$roots] unless ref $roots;
++	return 1;
+     }
+-    else {
+-      carp "No root path(s) specified\n";
+-      return 0;
++
++    unless (chdir $path)
++    {
++	carp "Can't chdir to $prefix$path ($!)";
++	return 0;
+     }
+ 
+-    my($root);
+-    foreach $root (@{$roots}) {
+-    	if ($Is_MacOS) {
+-	    $root = ":$root" if $root !~ /:/;
+-	    $root =~ s#([^:])\z#$1:#;
+-	} else {
+-	    $root =~ s#/\z##;
+-	}
+-	(undef, undef, my $rp) = lstat $root or next;
+-	$rp &= 07777;	# don't forget setuid, setgid, sticky bits
+-	if ( -d _ ) {
+-	    # notabene: 0700 is for making readable in the first place,
+-	    # it's also intended to change it to writable in case we have
+-	    # to recurse in which case we are better than rm -rf for 
+-	    # subtrees with strange permissions
+-	    chmod($rp | 0700, ($Is_VMS ? VMS::Filespec::fileify($root) : $root))
+-	      or carp "Can't make directory $root read+writeable: $!"
+-		unless $safe;
+-
+-	    if (opendir my $d, $root) {
+-		no strict 'refs';
+-		if (!defined ${"\cTAINT"} or ${"\cTAINT"}) {
+-		    # Blindly untaint dir names
+-		    @files = map { /^(.*)$/s ; $1 } readdir $d;
+-		} else {
+-		    @files = readdir $d;
+-		}
+-		closedir $d;
+-	    }
+-	    else {
+-	        carp "Can't read $root: $!";
+-		@files = ();
+-	    }
++    # avoid a race condition where a directory may be replaced by a
++    # symlink between the lstat and the chdir
++    my ($new_dev, $new_ino, $perm) = stat '.';
++    unless ("$new_dev:$new_ino" eq "$dev:$ino")
++    {
++	croak "Directory $prefix$path changed before chdir, aborting";
++    }
+ 
+-	    # Deleting large numbers of files from VMS Files-11 filesystems
+-	    # is faster if done in reverse ASCIIbetical order 
+-	    @files = reverse @files if $Is_VMS;
+-	    ($root = VMS::Filespec::unixify($root)) =~ s#\.dir\z## if $Is_VMS;
+-	    if ($Is_MacOS) {
+-		@files = map("$root$_", @files);
+-	    } else {
+-		@files = map("$root/$_", grep $_!~/^\.{1,2}\z/s,@files);
+-	    }
+-	    $count += rmtree(\@files,$verbose,$safe);
+-	    if ($safe &&
+-		($Is_VMS ? !&VMS::Filespec::candelete($root) : !-w $root)) {
+-		print "skipped $root\n" if $verbose;
+-		next;
+-	    }
+-	    chmod $rp | 0700, $root
+-	      or carp "Can't make directory $root writeable: $!"
+-		if $force_writeable;
+-	    print "rmdir $root\n" if $verbose;
+-	    if (rmdir $root) {
+-		++$count;
+-	    }
+-	    else {
+-		carp "Can't remove directory $root: $!";
+-		chmod($rp, ($Is_VMS ? VMS::Filespec::fileify($root) : $root))
+-		    or carp("and can't restore permissions to "
+-		            . sprintf("0%o",$rp) . "\n");
+-	    }
+-	}
+-	else { 
+-	    if ($safe &&
+-		($Is_VMS ? !&VMS::Filespec::candelete($root)
+-		         : !(-l $root || -w $root)))
+-	    {
+-		print "skipped $root\n" if $verbose;
+-		next;
+-	    }
+-	    chmod $rp | 0600, $root
+-	      or carp "Can't make file $root writeable: $!"
+-		if $force_writeable;
+-	    print "unlink $root\n" if $verbose;
+-	    # delete all versions under VMS
+-	    for (;;) {
+-		unless (unlink $root) {
+-		    carp "Can't unlink file $root: $!";
+-		    if ($force_writeable) {
+-			chmod $rp, $root
+-			    or carp("and can't restore permissions to "
+-			            . sprintf("0%o",$rp) . "\n");
+-		    }
+-		    last;
+-		}
+-		++$count;
+-		last unless $Is_VMS && lstat $root;
+-	    }
++    $perm &= 07777;
++    my $nperm = $perm | 0700;
++    unless ($safe or $nperm == $perm or chmod $nperm, '.')
++    {
++	carp "Can't make directory $prefix$path read+writeable ($!)";
++	$nperm = $perm;
++    }
++
++    my $count = 0;
++    if (opendir my $dir, '.')
++    {
++	my $entry;
++	while (defined ($entry = readdir $dir))
++	{
++	    next if $entry =~ /^\.\.?$/;
++	    $entry =~ /^(.*)$/s; $entry = $1; # untaint
++	    $count += _rmtree $entry, "$prefix$path/", '..', $dev, $ino,
++		$verbose, $safe;
+ 	}
++
++	closedir $dir;
++    }
++
++    # restore directory permissions if required (in case the rmdir
++    # below fails) now, while we're still in the directory and may do
++    # so without a race via '.'
++    unless ($nperm == $perm or chmod $perm, '.')
++    {
++	carp "Can't restore permissions on directory $prefix$path ($!)";
++    }
++
++    # don't leave the caller in an unexpected directory
++    unless (chdir $up)
++    {
++	croak "Can't return to $up_name directory from $prefix$path ($!)";
++    }
++
++    # ensure that a chdir .. didn't take us somewhere other than
++    # where we expected (see CVE-2002-0435)
++    unless (($new_dev, $new_ino) = stat '.'
++	and "$new_dev:$new_ino" eq "$up_dev:$up_ino")
++    {
++	croak "\u$up_name directory changed since entering $prefix$path";
++    }
++
++    print "rmdir $prefix$path\n" if $verbose;
++    if (rmdir $path)
++    {
++	$count++;
++    }
++    else
++    {
++	carp "Can't remove directory $prefix$path ($!)";
++    }
++
++    return $count;
++}
++
++sub rmtree
++{
++    my ($p, $verbose, $safe) = @_;
++    $p = [] unless defined $p and length $p;
++    $p = [ $p ] unless ref $p;
++    my @paths = grep defined && length, @$p;
++
++    # default to "unsafe" for non-root (will chmod dirs)
++    $safe = $> ? 0 : 1 unless defined $safe;
++
++    unless (@paths)
++    {
++	carp "No root path(s) specified";
++	return;
++    }
++
++    opendir my $oldpwd, '.' or do {
++	carp "Can't fetch initial working directory";
++	return;
++    };
++
++    my ($dev, $ino) = stat '.' or do {
++	carp "Can't stat initial working directory";
++	return;
++    };
++
++    my $count = 0;
++    for my $path (@paths)
++    {
++	$count += _rmtree $path, '', $oldpwd, $dev, $ino, $verbose, $safe;
+     }
+ 
+     $count;
diff --git a/dev-lang/perl/perl-5.8.8-r6.ebuild b/dev-lang/perl/perl-5.8.8-r6.ebuild
new file mode 100644
index 000000000000..7ac0c9eab671
--- /dev/null
+++ b/dev-lang/perl/perl-5.8.8-r6.ebuild
@@ -0,0 +1,656 @@
+# Copyright 1999-2009 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-lang/perl/perl-5.8.8-r6.ebuild,v 1.1 2009/01/28 09:54:09 tove Exp $
+
+inherit eutils flag-o-matic toolchain-funcs multilib
+
+# The slot of this binary compat version of libperl.so
+PERLSLOT="1"
+
+SHORT_PV="${PV%.*}"
+MY_P="perl-${PV/_rc/-RC}"
+MY_PV="${PV%_rc*}"
+DESCRIPTION="Larry Wall's Practical Extraction and Report Language"
+S="${WORKDIR}/${MY_P}"
+SRC_URI="mirror://cpan/src/${MY_P}.tar.bz2"
+HOMEPAGE="http://www.perl.org/"
+LIBPERL="libperl$(get_libname ${PERLSLOT}.${SHORT_PV})"
+
+LICENSE="|| ( Artistic GPL-2 )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~sparc-fbsd ~x86 ~x86-fbsd"
+IUSE="berkdb debug doc gdbm ithreads perlsuid build elibc_FreeBSD"
+PERL_OLDVERSEN="5.8.0 5.8.2 5.8.4 5.8.5 5.8.6 5.8.7"
+
+DEPEND="berkdb? ( sys-libs/db )
+	gdbm? ( >=sys-libs/gdbm-1.8.3 )
+	>=sys-devel/libperl-${PV}-r1
+	elibc_FreeBSD? ( sys-freebsd/freebsd-mk-defs )
+	<sys-devel/libperl-5.9
+	!<perl-core/File-Spec-0.87
+	!<perl-core/Test-Simple-0.47-r1"
+
+RDEPEND="~sys-devel/libperl-${PV}
+	berkdb? ( sys-libs/db )
+	gdbm? ( >=sys-libs/gdbm-1.8.3 )
+	build? (
+		!perl-core/Test-Harness
+		!perl-core/PodParser
+		!dev-perl/Locale-gettext
+	)"
+
+PDEPEND=">=app-admin/perl-cleaner-1.03
+		!build? (
+			>=perl-core/PodParser-1.32
+			>=perl-core/Test-Harness-2.56
+		)"
+
+pkg_setup() {
+	# I think this should rather be displayed if you *have* 'ithreads'
+	# in USE if it could break things ...
+	if use ithreads
+	then
+		ewarn "PLEASE NOTE: You are compiling ${MY_P} with"
+		ewarn "interpreter-level threading enabled."
+		ewarn "Threading is not supported by all applications "
+		ewarn "that compile against perl. You use threading at "
+		ewarn "your own discretion. "
+		epause 5
+	fi
+
+	if [[ ! -f "${ROOT}/usr/$(get_libdir)/${LIBPERL}" ]]
+	then
+		# Make sure we have libperl installed ...
+		eerror "Cannot find ${ROOT}/usr/$(get_libdir)/${LIBPERL}!  Make sure that you"
+		eerror "have sys-libs/libperl installed properly ..."
+		die "Cannot find ${ROOT}/usr/$(get_libdir)/${LIBPERL}!"
+	fi
+}
+
+src_unpack() {
+	unpack ${A}
+
+	# Get -lpthread linked before -lc.  This is needed
+	# when using glibc >= 2.3, or else runtime signal
+	# handling breaks.  Fixes bug #14380.
+	# <rac@gentoo.org> (14 Feb 2003)
+	# reinstated to try to avoid sdl segfaults 03.10.02
+	cd "${S}"; epatch "${FILESDIR}"/${PN}-prelink-lpthread.patch
+
+	# Patch perldoc to not abort when it attempts to search
+	# nonexistent directories; fixes bug #16589.
+	# <rac@gentoo.org> (28 Feb 2003)
+
+	cd "${S}"; epatch "${FILESDIR}"/${PN}-perldoc-emptydirs.patch
+
+	# this lays the groundwork for solving the issue of what happens
+	# when people (or ebuilds) install different versiosn of modules
+	# that are in the core, by rearranging the @INC directory to look
+	# site -> vendor -> core.
+	cd "${S}"; epatch "${FILESDIR}"/${P}-reorder-INC.patch
+
+	# some well-intentioned stuff in http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&selm=Pine.SOL.4.10.10205231231200.5399-100000%40maxwell.phys.lafayette.edu
+	# attempts to avoid bringing cccdlflags to bear on static
+	# extensions (like DynaLoader).  i believe this is
+	# counterproductive on a Gentoo system which has both a shared
+	# and static libperl, so effectively revert this here.
+	cd "${S}"; epatch "${FILESDIR}"/${PN}-picdl.patch
+
+	# Configure makes an unwarranted assumption that /bin/ksh is a
+	# good shell. This patch makes it revert to using /bin/sh unless
+	# /bin/ksh really is executable. Should fix bug 42665.
+	# rac 2004.06.09
+	cd "${S}"; epatch "${FILESDIR}"/${PN}-noksh.patch
+
+	# makedepend.SH contains a syntax error which is ignored by bash but causes
+	# dash to abort
+	epatch "${FILESDIR}"/${P}-makedepend-syntax.patch
+
+	# We do not want the build root in the linked perl module's RUNPATH, so
+	# strip paths containing PORTAGE_TMPDIR if its set.  This is for the
+	# MakeMaker module, bug #105054.
+	epatch "${FILESDIR}"/${PN}-5.8.7-MakeMaker-RUNPATH.patch
+
+	# Starting and hopefully ending with 5.8.7 we observe stack
+	# corruption with the regexp handling in perls DynaLoader code
+	# with ssp enabled. This become fatal during compile time so we
+	# temporally disable ssp on two regexp files till upstream has a
+	# chance to work it out. Bug #97452
+	[[ -n $(test-flags -fno-stack-protector) ]] && \
+		epatch "${FILESDIR}"/${PN}-regexp-nossp.patch
+
+	# On PA7200, uname -a contains a single quote and we need to
+	# filter it otherwise configure fails. See #125535.
+	epatch "${FILESDIR}"/perl-hppa-pa7200-configure.patch
+
+	#[[ ${get_libdir} == lib64 ]] && cd ${S} && epatch ${FILESDIR}/${P}-lib64.patch
+	use amd64 || use ppc64 && cd "${S}" && epatch "${FILESDIR}"/${P}-lib64.patch
+
+	[[ ${CHOST} == *-dragonfly* ]] && cd "${S}" && epatch "${FILESDIR}"/${P}-dragonfly-clean.patch
+	[[ ${CHOST} == *-freebsd* ]] && cd "${S}" && epatch "${FILESDIR}"/${P}-fbsdhints.patch
+	cd "${S}"; epatch "${FILESDIR}"/${P}-USE_MM_LD_RUN_PATH.patch
+	cd "${S}"; epatch "${FILESDIR}"/${P}-links.patch
+	# c++ patch - should address swig related items
+	cd "${S}"; epatch "${FILESDIR}"/${P}-cplusplus.patch
+
+	epatch "${FILESDIR}"/${P}-gcc42-command-line.patch
+
+	# Newer linux-headers don't include asm/page.h. Fix this.
+	# Patch from bug 168312, thanks Peter!
+	has_version '>sys-kernel/linux-headers-2.6.20' && epatch "${FILESDIR}"/${P}-asm-page-h-compile-failure.patch
+
+	# perlcc fix patch - bug #181229
+	epatch "${FILESDIR}"/${P}-perlcc.patch
+
+	# patch to fix bug #198196
+	# UTF/Regular expressions boundary error (CVE-2007-5116)
+	epatch "${FILESDIR}"/${P}-utf8-boundary.patch
+
+	# patch to fix bug #219203
+	epatch "${FILESDIR}"/${P}-CVE-2008-1927.patch
+
+	epatch "${FILESDIR}"/${P}-CAN-2005-0448-rmtree-2.patch
+}
+
+myconf() {
+	# the myconf array is declared in src_configure
+	myconf=( "${myconf[@]}" "$@" )
+}
+
+src_configure() {
+	declare -a myconf
+
+	# some arches and -O do not mix :)
+	use arm && replace-flags -O? -O1
+	use ppc && replace-flags -O? -O1
+	use ia64 && replace-flags -O? -O1
+	# Perl has problems compiling with -Os in your flags with glibc
+	use elibc_uclibc || replace-flags "-Os" "-O2"
+	( gcc-specs-ssp && use ia64 ) && append-flags -fno-stack-protector
+	# This flag makes compiling crash in interesting ways
+	filter-flags -malign-double
+	# Fixes bug #97645
+	use ppc && filter-flags -mpowerpc-gpopt
+	# Fixes bug #143895 on gcc-4.1.1
+	filter-flags "-fsched2-use-superblocks"
+
+	export LC_ALL="C"
+
+	case ${CHOST} in
+		*-freebsd*) osname="freebsd" ;;
+		*-dragonfly*) osname="dragonfly" ;;
+		*-netbsd*) osname="netbsd" ;;
+		*-openbsd*) osname="openbsd" ;;
+		*-darwin*) osname="darwin" ;;
+
+		*) osname="linux" ;;
+	esac
+
+	if use ithreads
+	then
+		einfo "using ithreads"
+		mythreading="-multi"
+		myconf -Dusethreads
+		myarch=${CHOST}
+		myarch="${myarch%%-*}-${osname}-thread"
+	else
+		myarch=${CHOST}
+		myarch="${myarch%%-*}-${osname}"
+	fi
+
+	local inclist=$(for v in $PERL_OLDVERSEN; do echo -n "$v $v/$myarch$mythreading "; done)
+
+	# allow either gdbm to provide ndbm (in <gdbm/ndbm.h>) or db1
+
+	myndbm='U'
+	mygdbm='U'
+	mydb='U'
+
+	if use gdbm
+	then
+		mygdbm='D'
+		myndbm='D'
+	fi
+	if use berkdb
+	then
+		mydb='D'
+		has_version '=sys-libs/db-1*' && myndbm='D'
+	fi
+
+	myconf "-${myndbm}i_ndbm" "-${mygdbm}i_gdbm" "-${mydb}i_db"
+
+	if use mips
+	then
+		# this is needed because gcc 3.3-compiled kernels will hang
+		# the machine trying to run this test - check with `Kumba
+		# <rac@gentoo.org> 2003.06.26
+		myconf -Dd_u32align
+	fi
+
+	if use perlsuid
+	then
+		myconf -Dd_dosuid
+		ewarn "You have enabled Perl's suid compile. Please"
+		ewarn "read http://search.cpan.org/~nwclark/perl-5.8.8/INSTALL#suidperl"
+		epause 3
+	fi
+
+	if use debug
+	then
+		CFLAGS="${CFLAGS} -g"
+		myconf -DDEBUGGING
+	fi
+
+	if use sparc
+	then
+		myconf -Ud_longdbl
+	fi
+
+	if use alpha && "$(tc-getCC)" == "ccc"
+	then
+		ewarn "Perl will not be built with berkdb support, use gcc if you needed it..."
+		myconf -Ui_db -Ui_ndbm
+	fi
+
+	[[ -n "${ABI}" ]] && myconf "-Dusrinc=$(get_ml_incdir)"
+
+	[[ ${ELIBC} == "FreeBSD" ]] && myconf "-Dlibc=/usr/$(get_libdir)/libc.a"
+
+	if [[ $(get_libdir) != "lib" ]] ; then
+		# We need to use " and not ', as the written config.sh use ' ...
+		myconf "-Dlibpth=/usr/local/$(get_libdir) /$(get_libdir) /usr/$(get_libdir)"
+	fi
+
+		sh Configure -des \
+		-Darchname="${myarch}" \
+		-Dcccdlflags='-fPIC' \
+		-Dccdlflags='-rdynamic' \
+		-Dcc="$(tc-getCC)" \
+		-Dprefix='/usr' \
+		-Dvendorprefix='/usr' \
+		-Dsiteprefix='/usr' \
+		-Dlocincpth=' ' \
+		-Doptimize="${CFLAGS}" \
+		-Duselargefiles \
+		-Dd_semctl_semun \
+		-Dscriptdir=/usr/bin \
+		-Dman1dir=/usr/share/man/man1 \
+		-Dman3dir=/usr/share/man/man3 \
+		-Dinstallman1dir=/usr/share/man/man1 \
+		-Dinstallman3dir=/usr/share/man/man3 \
+		-Dman1ext='1' \
+		-Dman3ext='3pm' \
+		-Dinc_version_list="$inclist" \
+		-Dcf_by='Gentoo' \
+		-Ud_csh \
+		-Dusenm \
+		"${myconf[@]}" || die "Unable to configure"
+}
+
+src_compile() {
+
+	# would like to bracket this with a test for the existence of a
+	# dotfile, but can't clean it automatically now.
+
+	src_configure
+
+	emake -j1 || die "Unable to make"
+}
+
+src_test() {
+	use elibc_uclibc && export MAKEOPTS="${MAKEOPTS} -j1"
+	emake -i test CCDLFLAGS= || die "test failed"
+}
+
+src_install() {
+
+	export LC_ALL="C"
+
+	# Need to do this, else apps do not link to dynamic version of
+	# the library ...
+	local coredir="/usr/$(get_libdir)/perl5/${MY_PV}/${myarch}${mythreading}/CORE"
+	dodir ${coredir}
+	dosym ../../../../../$(get_libdir)/${LIBPERL} ${coredir}/${LIBPERL}
+	dosym ../../../../../$(get_libdir)/${LIBPERL} ${coredir}/libperl$(get_libname ${PERLSLOT})
+	dosym ../../../../../$(get_libdir)/${LIBPERL} ${coredir}/libperl$(get_libname)
+
+	# Fix for "stupid" modules and programs
+	dodir /usr/$(get_libdir)/perl5/site_perl/${MY_PV}/${myarch}${mythreading}
+
+	local installtarget=install
+	if use build ; then
+		installtarget=install.perl
+	fi
+	make DESTDIR="${D}" ${installtarget} || die "Unable to make ${installtarget}"
+
+	rm "${D}"/usr/bin/perl
+	ln -s perl${MY_PV} "${D}"/usr/bin/perl
+
+	cp -f utils/h2ph utils/h2ph_patched
+	epatch "${FILESDIR}"/${PN}-h2ph-ansi-header.patch
+
+	LD_LIBRARY_PATH=. ./perl -Ilib utils/h2ph_patched \
+		-a -d "${D}"/usr/$(get_libdir)/perl5/${MY_PV}/${myarch}${mythreading} <<EOF
+asm/termios.h
+syscall.h
+syslimits.h
+syslog.h
+sys/ioctl.h
+sys/socket.h
+sys/time.h
+wait.h
+EOF
+
+	# This is to fix a missing c flag for backwards compat
+	for i in `find "${D}"/usr/$(get_libdir)/perl5 -iname "Config.pm"`;do
+		sed -e "s:ccflags=':ccflags='-DPERL5 :" \
+		    -e "s:cppflags=':cppflags='-DPERL5 :" \
+			${i} > ${i}.new &&\
+			mv ${i}.new ${i} || die "Sed failed"
+	done
+
+	# A poor fix for the miniperl issues
+	dosed 's:./miniperl:/usr/bin/perl:' /usr/$(get_libdir)/perl5/${MY_PV}/ExtUtils/xsubpp
+	fperms 0444 /usr/$(get_libdir)/perl5/${MY_PV}/ExtUtils/xsubpp
+	dosed 's:./miniperl:/usr/bin/perl:' /usr/bin/xsubpp
+	fperms 0755 /usr/bin/xsubpp
+
+	# This removes ${D} from Config.pm and .packlist
+	for i in `find "${D}" -iname "Config.pm"` `find "${D}" -iname ".packlist"`;do
+		einfo "Removing ${D} from ${i}..."
+		sed -e "s:${D}::" ${i} > ${i}.new &&\
+			mv ${i}.new ${i} || die "Sed failed"
+	done
+
+	# Note: find out from psm why we would need/want this.
+	# ( use berkdb && has_version '=sys-libs/db-1*' ) ||
+	#	find ${D} -name "*NDBM*" | xargs rm -f
+
+	dodoc Changes* Artistic Copying README Todo* AUTHORS
+
+	if use doc
+	then
+		# HTML Documentation
+		# We expect errors, warnings, and such with the following.
+
+		dodir /usr/share/doc/${PF}/html
+		./perl installhtml \
+			--podroot='.' \
+			--podpath='lib:ext:pod:vms' \
+			--recurse \
+			--htmldir="${D}/usr/share/doc/${PF}/html" \
+			--libpods='perlfunc:perlguts:perlvar:perlrun:perlop'
+	fi
+	cd `find "${D}" -name Path.pm|sed -e 's/Path.pm//'`
+	# CAN patch in bug 79685
+	#epatch "${FILESDIR}"/${P}-CAN-2005-0448-rmtree-2.patch
+
+	# Remove those items we PDPEND on
+	rm -f "${D}"/usr/bin/pod2usage
+	rm -f "${D}"/usr/bin/podchecker
+	rm -f "${D}"/usr/bin/podselect
+	rm -f "${D}"/usr/bin/prove
+	rm -f "${D}"/usr/share/man/man1/pod2usage*
+	rm -f "${D}"/usr/share/man/man1/podchecker*
+	rm -f "${D}"/usr/share/man/man1/podselect*
+	rm -f "${D}"/usr/share/man/man1/prove*
+	if use build ; then
+		src_remove_extra_files
+	fi
+
+}
+
+src_remove_extra_files()
+{
+	local prefix="./usr" # ./ is important
+	local bindir="${prefix}/bin"
+	local perlroot="${prefix}/$(get_libdir)/perl5" # perl installs per-arch dirs
+	local prV="${perlroot}/${MY_PV}"
+	# myarch and mythreading are defined inside src_configure()
+	local prVA="${prV}/${myarch}${mythreading}"
+
+	# I made this list from the Mandr*, Debian and ex-Connectiva perl-base list
+	# Then, I added several files to get GNU autotools running
+	# FIXME: should this be in a separated file to be sourced?
+	local MINIMAL_PERL_INSTALL="
+	${bindir}/h2ph
+	${bindir}/perl
+	${bindir}/perl${MY_PV}
+	${bindir}/pod2man
+	${prV}/attributes.pm
+	${prV}/AutoLoader.pm
+	${prV}/autouse.pm
+	${prV}/base.pm
+	${prV}/bigint.pm
+	${prV}/bignum.pm
+	${prV}/bigrat.pm
+	${prV}/blib.pm
+	${prV}/bytes_heavy.pl
+	${prV}/bytes.pm
+	${prV}/Carp/Heavy.pm
+	${prV}/Carp.pm
+	${prV}/charnames.pm
+	${prV}/Class/Struct.pm
+	${prV}/constant.pm
+	${prV}/diagnostics.pm
+	${prV}/DirHandle.pm
+	${prV}/Exporter/Heavy.pm
+	${prV}/Exporter.pm
+	${prV}/ExtUtils/Command.pm
+	${prV}/ExtUtils/Constant.pm
+	${prV}/ExtUtils/Embed.pm
+	${prV}/ExtUtils/Installed.pm
+	${prV}/ExtUtils/Install.pm
+	${prV}/ExtUtils/Liblist.pm
+	${prV}/ExtUtils/MakeMaker.pm
+	${prV}/ExtUtils/Manifest.pm
+	${prV}/ExtUtils/Mkbootstrap.pm
+	${prV}/ExtUtils/Mksymlists.pm
+	${prV}/ExtUtils/MM_Any.pm
+	${prV}/ExtUtils/MM_MacOS.pm
+	${prV}/ExtUtils/MM.pm
+	${prV}/ExtUtils/MM_Unix.pm
+	${prV}/ExtUtils/MY.pm
+	${prV}/ExtUtils/Packlist.pm
+	${prV}/ExtUtils/testlib.pm
+	${prV}/ExtUtils/Miniperl.pm
+	${prV}/ExtUtils/Command/MM.pm
+	${prV}/ExtUtils/Constant/Base.pm
+	${prV}/ExtUtils/Constant/Utils.pm
+	${prV}/ExtUtils/Constant/XS.pm
+	${prV}/ExtUtils/Liblist/Kid.pm
+	${prV}/ExtUtils/MakeMaker/bytes.pm
+	${prV}/ExtUtils/MakeMaker/vmsish.pm
+	${prV}/fields.pm
+	${prV}/File/Basename.pm
+	${prV}/File/Compare.pm
+	${prV}/File/Copy.pm
+	${prV}/File/Find.pm
+	${prV}/FileHandle.pm
+	${prV}/File/Path.pm
+	${prV}/File/Spec.pm
+	${prV}/File/Spec/Unix.pm
+	${prV}/File/stat.pm
+	${prV}/filetest.pm
+	${prVA}/attrs.pm
+	${prVA}/auto/attrs
+	${prVA}/auto/Cwd/Cwd$(get_libname)
+	${prVA}/auto/Data/Dumper/Dumper$(get_libname)
+	${prVA}/auto/DynaLoader/dl_findfile.al
+	${prVA}/auto/Fcntl/Fcntl$(get_libname)
+	${prVA}/auto/File/Glob/Glob$(get_libname)
+	${prVA}/auto/IO/IO$(get_libname)
+	${prVA}/auto/POSIX/autosplit.ix
+	${prVA}/auto/POSIX/fstat.al
+	${prVA}/auto/POSIX/load_imports.al
+	${prVA}/auto/POSIX/POSIX.bs
+	${prVA}/auto/POSIX/POSIX$(get_libname)
+	${prVA}/auto/POSIX/assert.al
+	${prVA}/auto/POSIX/stat.al
+	${prVA}/auto/POSIX/tmpfile.al
+	${prVA}/auto/re/re$(get_libname)
+	${prVA}/auto/Socket/Socket$(get_libname)
+	${prVA}/auto/Storable/autosplit.ix
+	${prVA}/auto/Storable/_retrieve.al
+	${prVA}/auto/Storable/retrieve.al
+	${prVA}/auto/Storable/Storable$(get_libname)
+	${prVA}/auto/Storable/_store.al
+	${prVA}/auto/Storable/store.al
+	${prVA}/B/Deparse.pm
+	${prVA}/B.pm
+	${prVA}/Config.pm
+	${prVA}/Config_heavy.pl
+	${prVA}/CORE/libperl$(get_libname)
+	${prVA}/Cwd.pm
+	${prVA}/Data/Dumper.pm
+	${prVA}/DynaLoader.pm
+	${prVA}/encoding.pm
+	${prVA}/Errno.pm
+	${prVA}/Fcntl.pm
+	${prVA}/File/Glob.pm
+	${prVA}/_h2ph_pre.ph
+	${prVA}/IO/File.pm
+	${prVA}/IO/Handle.pm
+	${prVA}/IO/Pipe.pm
+	${prVA}/IO.pm
+	${prVA}/IO/Seekable.pm
+	${prVA}/IO/Select.pm
+	${prVA}/IO/Socket.pm
+	${prVA}/lib.pm
+	${prVA}/NDBM_File.pm
+	${prVA}/ops.pm
+	${prVA}/POSIX.pm
+	${prVA}/re.pm
+	${prVA}/Socket.pm
+	${prVA}/Storable.pm
+	${prVA}/threads
+	${prVA}/threads.pm
+	${prVA}/XSLoader.pm
+	${prV}/Getopt/Long.pm
+	${prV}/Getopt/Std.pm
+	${prV}/if.pm
+	${prV}/integer.pm
+	${prV}/IO/Socket/INET.pm
+	${prV}/IO/Socket/UNIX.pm
+	${prV}/IPC/Open2.pm
+	${prV}/IPC/Open3.pm
+	${prV}/less.pm
+	${prV}/List/Util.pm
+	${prV}/locale.pm
+	${prV}/open.pm
+	${prV}/overload.pm
+	${prV}/Pod/InputObjects.pm
+	${prV}/Pod/Man.pm
+	${prV}/Pod/ParseLink.pm
+	${prV}/Pod/Parser.pm
+	${prV}/Pod/Select.pm
+	${prV}/Pod/Text.pm
+	${prV}/Pod/Usage.pm
+	${prV}/PerlIO.pm
+	${prV}/Scalar/Util.pm
+	${prV}/SelectSaver.pm
+	${prV}/sigtrap.pm
+	${prV}/sort.pm
+	${prV}/stat.pl
+	${prV}/strict.pm
+	${prV}/subs.pm
+	${prV}/Symbol.pm
+	${prV}/Text/ParseWords.pm
+	${prV}/Text/Tabs.pm
+	${prV}/Text/Wrap.pm
+	${prV}/Time/Local.pm
+	${prV}/unicore/Canonical.pl
+	${prV}/unicore/Exact.pl
+	${prV}/unicore/lib/gc_sc/Digit.pl
+	${prV}/unicore/lib/gc_sc/Word.pl
+	${prV}/unicore/PVA.pl
+	${prV}/unicore/To/Fold.pl
+	${prV}/unicore/To/Lower.pl
+	${prV}/unicore/To/Upper.pl
+	${prV}/utf8_heavy.pl
+	${prV}/utf8.pm
+	${prV}/vars.pm
+	${prV}/vmsish.pm
+	${prV}/warnings
+	${prV}/warnings.pm
+	${prV}/warnings/register.pm"
+
+	if use perlsuid ; then
+		MINIMAL_PERL_INSTALL="${MINIMAL_PERL_INSTALL}
+		${bindir}/suidperl
+		${bindir}/sperl${MY_PV}"
+	fi
+
+	pushd "${D}" > /dev/null
+	# Remove cruft
+	einfo "Removing files that are not in the minimal install"
+	echo "${MINIMAL_PERL_INSTALL}"
+	for f in $(find . -type f); do
+		has ${f} ${MINIMAL_PERL_INSTALL} || rm -f ${f}
+	done
+	# Remove empty directories
+	find . -depth -type d | xargs -r rmdir &> /dev/null
+	popd > /dev/null
+}
+
+pkg_postinst() {
+	INC=$(perl -e 'for $line (@INC) { next if $line eq "."; next if $line =~ m/'${MY_PV}'|etc|local|perl$/; print "$line\n" }')
+	if [[ "${ROOT}" = "/" ]]
+	then
+		ebegin "Removing old .ph files"
+		for DIR in $INC; do
+			if [[ -d "${ROOT}"/$DIR ]]; then
+				for file in $(find "${ROOT}"/$DIR -name "*.ph" -type f); do
+					rm "${ROOT}"/$file
+					einfo "<< $file"
+				done
+			fi
+		done
+		# Silently remove the now empty dirs
+		for DIR in $INC; do
+		   if [[ -d "${ROOT}"/$DIR ]]; then
+		   	find "${ROOT}"/$DIR -depth -type d | xargs -r rmdir &> /dev/null
+		   fi
+		done
+		ebegin "Generating ConfigLocal.pm (ignore any error)"
+		enc2xs -C
+		ebegin "Converting C header files to the corresponding Perl format"
+		cd /usr/include;
+		h2ph *
+		h2ph -r sys/* arpa/* netinet/* bits/* security/* asm/* gnu/* linux/* gentoo*
+		cd /usr/include/linux
+		h2ph *
+	fi
+
+# This has been moved into a function because rumor has it that a future release
+# of portage will allow us to check what version was just removed - which means
+# we will be able to invoke this only as needed :)
+	# Tried doing this via  -z, but $INC is too big...
+	if [[ "${INC}x" != "x" ]]; then
+		cleaner_msg
+		epause 5
+	fi
+}
+
+cleaner_msg() {
+	eerror "You have had multiple versions of perl. It is recommended"
+	eerror "that you run perl-cleaner now. perl-cleaner will"
+	eerror "assist with this transition. This script is capable"
+	eerror "of cleaning out old .ph files, rebuilding modules for "
+	eerror "your new version of perl, as well as re-emerging"
+	eerror "applications that compiled against your old libperl$(get_libname)"
+	eerror
+	eerror "PLEASE DO NOT INTERRUPT THE RUNNING OF THIS SCRIPT."
+	eerror "Part of the rebuilding of applications compiled against "
+	eerror "your old libperl involves temporarily unmerging"
+	eerror "them - interruptions could leave you with unmerged"
+	eerror "packages before they can be remerged."
+	eerror ""
+	eerror "If you have run perl-cleaner and a package still gives"
+	eerror "you trouble, and re-emerging it fails to correct"
+	eerror "the problem, please check http://bugs.gentoo.org/"
+	eerror "for more information or to report a bug."
+	eerror ""
+	eerror ""
+
+}