[perl #24674]

stop $^O getting tainted on read access, and disallow tainted
assignment to it

p4raw-id: //depot/perl@22071

1 files changed, 6 insertions, 2 deletions

diff --git a/mg.c b/mg.c
index 66e02b7a4c..f79210e5f0 100644
--- a/mg.c
+++ b/mg.c
@@ -648,8 +648,10 @@ Perl_magic_get(pTHX_ SV *sv, MAGIC *mg)
 	    sv_setsv(sv, &PL_sv_undef);
 	break;
     case '\017':		/* ^O & ^OPEN */
-	if (*(mg->mg_ptr+1) == '\0')
+	if (*(mg->mg_ptr+1) == '\0') {
 	    sv_setpv(sv, PL_osname);
+	    SvTAINTED_off(sv);
+	}
 	else if (strEQ(mg->mg_ptr, "\017PEN")) {
 	    if (!PL_compiling.cop_io)
 		sv_setsv(sv, &PL_sv_undef);
@@ -2091,8 +2093,10 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
 	if (*(mg->mg_ptr+1) == '\0') {
 	    if (PL_osname)
 		Safefree(PL_osname);
-	    if (SvOK(sv))
+	    if (SvOK(sv)) {
+		TAINT_PROPER("assigning to $^O");
 		PL_osname = savepv(SvPV(sv,len));
+	    }
 	    else
 		PL_osname = Nullch;
 	}