From dhw@whistle.com  Wed Apr 25 12:11:20 2001
Return-Path: <dhw@whistle.com>
Received: from whistle.com (s205m131.whistle.com [207.76.205.131])
	by hub.freebsd.org (Postfix) with ESMTP id CAED437B496
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 25 Apr 2001 12:11:16 -0700 (PDT)
	(envelope-from dhw@whistle.com)
Received: (from smap@localhost)
	by whistle.com (8.10.0/8.10.0) id f3PJBGW18243;
	Wed, 25 Apr 2001 12:11:16 -0700 (PDT)
Received: from pau-amma.whistle.com( 207.76.205.64) by whistle.com via smap (V2.0)
	id xma018239; Wed, 25 Apr 2001 12:10:49 -0700
Received: (from dhw@localhost)
	by pau-amma.whistle.com (8.11.1/8.11.1) id f3PJAnR41838;
	Wed, 25 Apr 2001 12:10:49 -0700 (PDT)
Message-Id: <200104251910.f3PJAnR41838@pau-amma.whistle.com>
Date: Wed, 25 Apr 2001 12:10:49 -0700 (PDT)
From: dhw@whistle.com
Reply-To: dhw@whistle.com
To: FreeBSD-gnats-submit@freebsd.org
Cc: david@catwhisker.org
Subject: Buglet in cvsweb
X-Send-Pr-Version: 3.2

>Number:         26851
>Category:       ports
>Synopsis:       Buglet breaks cvsweb in Perl5 environment
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    knu
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Apr 25 12:20:02 PDT 2001
>Closed-Date:    Tue Jun 12 14:38:49 JST 2001
>Last-Modified:  Tue Jun 12 14:39:10 JST 2001
>Originator:     David Wolfskill
>Release:        FreeBSD 4.3-STABLE i386
>Organization:
Whistle Communications
>Environment:
System: FreeBSD m147.whistle.com 4.3-STABLE FreeBSD 4.3-STABLE #30: Wed Apr 25 06:43:02 PDT 2001 root@dhcp-140.catwhisker.org:/common/S1/obj/usr/src/sys/LAPTOP_30W i386

	Perl 5.005_03; versions of cvsweb since early March (probably
	earlier).

>Description:

	In Perl5, the construct found on line 1109 of cvsweb.cgi (in
	htmlify_sub) that reads "local @_" is not valid.

	Its use causes an unpatched cvsweb invocation to generate a page
	that reads:

Internal Server Error

The server encountered an internal error or misconfiguration and was
unable to complete your request.

Please contact the server administrator, you@your.address and inform
them of the time the error occurred, and anything you might have
done that may have caused the error.

More information about this error may be available in the server error
log.


Apache/1.3.19 Server at m147.whistle.com Port 80


	accompanied by a pair of lines appended to the Apache error log
	(/var/tmp/httpd-error.log):


Can't localize lexical variable @_ at /usr/local/www/cgi-bin/cvsweb.cgi line 1109.
[Wed Apr 25 10:45:45 2001] [error] [client 127.0.0.1] Premature end of script headers: /usr/local/www/cgi-bin/cvsweb.cgi


>How-To-Repeat:

	Install /usr/ports/devel/cvsweb on a system where the Perl
	interpreter runs Perl 5.005_03.  Then try to use it.

>Fix:

	The issue is that "local @_" is not valid.  So what I've done
	(since early March... and re-doing every time I upgrade cvsweb)
	is depicted by the following patch:

--- /usr/ports/devel/cvsweb/work/cvsweb/cvsweb.cgi	Wed Apr 25 10:40:40 2001
+++ cvsweb.cgi	Wed Apr 25 11:15:10 2001
@@ -87,6 +87,7 @@
     $use_moddate $has_zlib $gzip_open
     $allow_tar @tar_options @gzip_options @cvs_options
     $LOG_FILESEPARATOR $LOG_REVSEPARATOR
+    @h
 );
 
 sub printDiffSelect($);
@@ -1106,11 +1107,11 @@
 
 sub htmlify_sub(&$) {
     (my $proc, local $_) = @_;
-    local @_ = split(m`(<a [^>]+>[^<]*</a>)`i);
+    local @h = split(m`(<a [^>]+>[^<]*</a>)`i);
     my $linked;
     my $result = '';
 
-    while (($_, $linked) = splice(@_, 0, 2)) {
+    while (($_, $linked) = splice(@h, 0, 2)) {
 	&$proc();
 	$result .= $_ if defined($_);
 	$result .= $linked if defined($linked);
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-ports->knu 
Responsible-Changed-By: okazaki 
Responsible-Changed-When: Sat Apr 28 13:23:20 PDT 2001 
Responsible-Changed-Why:  
over to maintainer 

http://www.freebsd.org/cgi/query-pr.cgi?pr=26851 

From: Anton Berezin <tobez@tobez.org>
To: freebsd-gnats-submit@FreeBSD.org, dhw@whistle.com
Cc:  
Subject: Re: ports/26851: Buglet breaks cvsweb in Perl5 environment
Date: Sat, 28 Apr 2001 23:59:30 +0200

 Please don't use PERL_THREADED=true in production environments.  Thank
 you.  :-)
 
 Cheers,
 %Anton.
 -- 
 May the tuna salad be with you.

From: David Wolfskill <dhw@whistle.com>
To: dhw@whistle.com, freebsd-gnats-submit@FreeBSD.org,
	tobez@tobez.org
Cc:  
Subject: Re: ports/26851: Buglet breaks cvsweb in Perl5 environment
Date: Mon, 30 Apr 2001 07:40:27 -0700 (PDT)

 >Date: Sat, 28 Apr 2001 23:59:30 +0200
 >From: Anton Berezin <tobez@tobez.org>
 
 >Please don't use PERL_THREADED=true in production environments.  Thank
 >you.  :-)
 
 OK; I've now tested the supplied cvsweb.cgi in a world that did not have
 "PERL_THREADED=true", and it does work; thank you!
 
 Although my PR can probably be closed as a result of this, I'm a little
 troubled that:
 
 * The comment in /etc/defaults/make.conf merely says
   # To build perl with thread support
   # PERL_THREADED= true
 
   That is, there's no hint there to indicate that this might possibly be
   something that causes something to break:  it looks like something to
   un-comment in order to allow more things to work.
 
 * The error message from Perl gave no hint (that I could see) that the
   problem involved this.  (From your answer, I would guess that this was
   not the first time you've encountered the situation.)
 
 * I saw nothing in the documentation for cvsweb to indicate that it was
   not compatible with "PERL_THREADED=true".  (Yes, I grepped for
   "threaded" in /usr/local/share/doc/cvsweb/*.  Case-insensitively.)
 
 Finally, I'll point out that with the change I made, cvsweb seemed to work
 just fine, even with "PERL_THREADED=true" in the environment where I was
 seeing the problem:  on my laptop.  (Whether or not that is a
 "production environment" is, I suppose, a matter of interpretation.
 Since I depend on it (at least, when I have it booted under -STABLE), I
 would consider it "production".  When it's running -CURRENT is rather
 more experimental....
 
 And it is Very Cool to be able to have a fairly complete environment on
 my laptop for building FreeBSD, and using cvsweb to be able to better
 see some of the changes, especially when I'm trying to understand the
 most recent reason -CURRENT is broken....  I appreciate the tool; I just
 want to make it (and the environment in which it runs) better.
 
 Thanks,
 david
 -- 
 David Wolfskill      dhw@whistle.com   UNIX System Administrator
 Desk: 650/577-7158   TIE: 8/499-7158   Cell: 650/759-0823

From: Anton Berezin <tobez@tobez.org>
To: David Wolfskill <dhw@whistle.com>, knu@freebsd.org
Cc: freebsd-gnats-submit@FreeBSD.org
Subject: Re: ports/26851: Buglet breaks cvsweb in Perl5 environment
Date: Mon, 30 Apr 2001 17:24:09 +0200

 On Mon, Apr 30, 2001 at 07:40:27AM -0700, David Wolfskill wrote:
 
 > >Please don't use PERL_THREADED=true in production environments.
 > >Thank you.  :-)
 > 
 > OK; I've now tested the supplied cvsweb.cgi in a world that did not
 > have "PERL_THREADED=true", and it does work; thank you!
 
 > Although my PR can probably be closed as a result of this, I'm a little
 > troubled that:
 > 
 > * The comment in /etc/defaults/make.conf merely says
 >   # To build perl with thread support
 >   # PERL_THREADED= true
 
 >   That is, there's no hint there to indicate that this might possibly
 >   be something that causes something to break:  it looks like
 >   something to un-comment in order to allow more things to work.
 
 Yeah, I think this should be fixed.  PERL_THREADED is really dangerous,
 especially on -stable (-current is better since PERL_THREADED leads to
 different compilation options;  to get the same bad effect on -current,
 one has to configure perl with -Duse5005threads in addition to
 -Dusethreads).  A note saying that PERL_THREADED will kill your cat is
 in order.
 
 > * The error message from Perl gave no hint (that I could see) that the
 > problem involved this.  (From your answer, I would guess that this was
 > not the first time you've encountered the situation.)
 
 Yeah, you've got to know that @_ in a threaded perl is localized
 (`local' like in `my') and therefore cannot be localized (`local' like
 in `local').
 
 > * I saw nothing in the documentation for cvsweb to indicate that it
 > was not compatible with "PERL_THREADED=true".  (Yes, I grepped for
 > "threaded" in /usr/local/share/doc/cvsweb/*.  Case-insensitively.)
 
 > Finally, I'll point out that with the change I made, cvsweb seemed to
 > work just fine, even with "PERL_THREADED=true" in the environment
 > where I was seeing the problem:  on my laptop.  (Whether or not that
 > is a "production environment" is, I suppose, a matter of
 > interpretation.  Since I depend on it (at least, when I have it booted
 > under -STABLE), I would consider it "production".  When it's running
 > -CURRENT is rather more experimental....
 
 Your change has a style problem.  You unnecessarily introduce a global
 array @h.  Putting my @h instead of local @_ would fix the problem just
 as well, and would be much cleaner.
 
 In fact, cvsweb has quite a number of misuses of local().  I can only
 attribute it to the fact that the original Bill Fenner's cvsweb was pure
 perl4, and since then many things were added, but there was no real
 cleanup done.  Someone's got to do that at some point.  I am serisouly
 considering doing this myself;  I probably will have some time for this
 this week.
 
 Mind you, no offence to cvsweb authors/maintainers here.  The problems
 are mostly historical.
 
 Cheers,
 =Anton.
 -- 
 May the tuna salad be with you.

From: David Wolfskill <dhw@whistle.com>
To: dhw@whistle.com, knu@freebsd.org, tobez@tobez.org
Cc: freebsd-gnats-submit@freebsd.org
Subject: Re: ports/26851: Buglet breaks cvsweb in Perl5 environment
Date: Mon, 30 Apr 2001 08:42:33 -0700 (PDT)

 >Date: Mon, 30 Apr 2001 17:24:09 +0200
 >From: Anton Berezin <tobez@tobez.org>
 
 >>   That is, there's no hint there to indicate that this might possibly
 >>   be something that causes something to break:  it looks like
 >>   something to un-comment in order to allow more things to work.
 
 >Yeah, I think this should be fixed.  PERL_THREADED is really dangerous,
 >especially on -stable (-current is better since PERL_THREADED leads to
 >different compilation options;  to get the same bad effect on -current,
 >one has to configure perl with -Duse5005threads in addition to
 >-Dusethreads).  A note saying that PERL_THREADED will kill your cat is
 >in order.
 
 Ah.  (I had just built today's -STABLE before reporting the results, and
 I'm in the "building libraries" stage of building today's -CURRENT as I
 type.  I had commented out the PERL_THREADED line in the -CURRENT
 /etc/make.conf, too....)
 
 >> * The error message from Perl gave no hint (that I could see) that the
 >> problem involved this.  (From your answer, I would guess that this was
 >> not the first time you've encountered the situation.)
 
 >Yeah, you've got to know that @_ in a threaded perl is localized
 >(`local' like in `my') and therefore cannot be localized (`local' like
 >in `local').
 
 Indeed.  When I wrote scripts with Perl4, I tended to use "local", but
 I've been able to depend on Perl5 for the last couple of years, at
 least, so I'm in the habit of using "my".
 
 >> Finally, I'll point out that with the change I made, cvsweb seemed to
 >> work just fine, even with "PERL_THREADED=true" in the environment
 >> where I was seeing the problem:  on my laptop.  (Whether or not that
 >> is a "production environment" is, I suppose, a matter of
 >> interpretation.  Since I depend on it (at least, when I have it booted
 >> under -STABLE), I would consider it "production".  When it's running
 >> -CURRENT is rather more experimental....
 
 >Your change has a style problem.  You unnecessarily introduce a global
 >array @h.  Putting my @h instead of local @_ would fix the problem just
 >as well, and would be much cleaner.
 
 Yes, but since everything else was done as "local", I tried to follow
 the existing style.  :-}
 
 >In fact, cvsweb has quite a number of misuses of local().  I can only
 >attribute it to the fact that the original Bill Fenner's cvsweb was pure
 >perl4, and since then many things were added, but there was no real
 >cleanup done.
 
 Yeah, that's what I thought.
 
 >Someone's got to do that at some point.  I am serisouly considering doing
 >this myself;  I probably will have some time for this this week.
 
 If there's a way I can help with that -- I don't know the extent to
 which partitioning the work makes sense -- I'm willing to try.  In any
 case, I'm willing to test stuff.  (I rebuild -STABLE and -CURRENT daily
 already anyhow.)
 
 >Mind you, no offence to cvsweb authors/maintainers here.  The problems
 >are mostly historical.
 
 Perspective understood & shared.
 
 Thanks,
 david
 -- 
 David Wolfskill      dhw@whistle.com   UNIX System Administrator
 Desk: 650/577-7158   TIE: 8/499-7158   Cell: 650/759-0823
State-Changed-From-To: open->analyzed 
State-Changed-By: knu 
State-Changed-When: Fri May 18 05:04:14 JST 2001 
State-Changed-Why:  
The fix will be included in the next release, though I cannot guarantee 
if cvsweb works on threaded perl. 

By the way, using just "my @a" would be enough to fix this. 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=26851 
State-Changed-From-To: analyzed->closed 
State-Changed-By: knu 
State-Changed-When: Tue Jun 12 14:38:49 JST 2001 
State-Changed-Why:  
Fix included in the previous update, thanks. 

http://www.FreeBSD.org/cgi/query-pr.cgi?pr=26851 
>Unformatted:
