Bug 26851

Summary: Buglet breaks cvsweb in Perl5 environment
Product: Ports & Packages Reporter: David Wolfskill <dhw>
Component: Individual Port(s)Assignee: Akinori MUSHA <knu>
Status: Closed FIXED    
Severity: Affects Only Me CC: david
Priority: Normal    
Version: Latest   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
file.diff none

Description David Wolfskill 2001-04-25 20:20:02 UTC
	In Perl5, the construct found on line 1109 of cvsweb.cgi (in
	htmlify_sub) that reads "local @_" is not valid.

	Its use causes an unpatched cvsweb invocation to generate a page
	that reads:

Internal Server Error

The server encountered an internal error or misconfiguration and was
unable to complete your request.

Please contact the server administrator, you@your.address and inform
them of the time the error occurred, and anything you might have
done that may have caused the error.

More information about this error may be available in the server error
log.


Apache/1.3.19 Server at m147.whistle.com Port 80


	accompanied by a pair of lines appended to the Apache error log
	(/var/tmp/httpd-error.log):


Can't localize lexical variable @_ at /usr/local/www/cgi-bin/cvsweb.cgi line 1109.
[Wed Apr 25 10:45:45 2001] [error] [client 127.0.0.1] Premature end of script headers: /usr/local/www/cgi-bin/cvsweb.cgi

Fix: The issue is that "local @_" is not valid.  So what I've done
	(since early March... and re-doing every time I upgrade cvsweb)
	is depicted by the following patch:
How-To-Repeat: 
	Install /usr/ports/devel/cvsweb on a system where the Perl
	interpreter runs Perl 5.005_03.  Then try to use it.
Comment 1 Tetsurou Okazaki freebsd_committer freebsd_triage 2001-04-28 21:23:20 UTC
Responsible Changed
From-To: freebsd-ports->knu

over to maintainer
Comment 2 Anton Berezin 2001-04-28 22:59:30 UTC
Please don't use PERL_THREADED=true in production environments.  Thank
you.  :-)

Cheers,
%Anton.
-- 
May the tuna salad be with you.
Comment 3 David Wolfskill 2001-04-30 15:40:27 UTC
>Date: Sat, 28 Apr 2001 23:59:30 +0200
>From: Anton Berezin <tobez@tobez.org>

>Please don't use PERL_THREADED=true in production environments.  Thank
>you.  :-)

OK; I've now tested the supplied cvsweb.cgi in a world that did not have
"PERL_THREADED=true", and it does work; thank you!

Although my PR can probably be closed as a result of this, I'm a little
troubled that:

* The comment in /etc/defaults/make.conf merely says
  # To build perl with thread support
  # PERL_THREADED= true

  That is, there's no hint there to indicate that this might possibly be
  something that causes something to break:  it looks like something to
  un-comment in order to allow more things to work.

* The error message from Perl gave no hint (that I could see) that the
  problem involved this.  (From your answer, I would guess that this was
  not the first time you've encountered the situation.)

* I saw nothing in the documentation for cvsweb to indicate that it was
  not compatible with "PERL_THREADED=true".  (Yes, I grepped for
  "threaded" in /usr/local/share/doc/cvsweb/*.  Case-insensitively.)

Finally, I'll point out that with the change I made, cvsweb seemed to work
just fine, even with "PERL_THREADED=true" in the environment where I was
seeing the problem:  on my laptop.  (Whether or not that is a
"production environment" is, I suppose, a matter of interpretation.
Since I depend on it (at least, when I have it booted under -STABLE), I
would consider it "production".  When it's running -CURRENT is rather
more experimental....

And it is Very Cool to be able to have a fairly complete environment on
my laptop for building FreeBSD, and using cvsweb to be able to better
see some of the changes, especially when I'm trying to understand the
most recent reason -CURRENT is broken....  I appreciate the tool; I just
want to make it (and the environment in which it runs) better.

Thanks,
david
-- 
David Wolfskill      dhw@whistle.com   UNIX System Administrator
Desk: 650/577-7158   TIE: 8/499-7158   Cell: 650/759-0823
Comment 4 Anton Berezin 2001-04-30 16:24:09 UTC
On Mon, Apr 30, 2001 at 07:40:27AM -0700, David Wolfskill wrote:

> >Please don't use PERL_THREADED=true in production environments.
> >Thank you.  :-)
> 
> OK; I've now tested the supplied cvsweb.cgi in a world that did not
> have "PERL_THREADED=true", and it does work; thank you!

> Although my PR can probably be closed as a result of this, I'm a little
> troubled that:
> 
> * The comment in /etc/defaults/make.conf merely says
>   # To build perl with thread support
>   # PERL_THREADED= true

>   That is, there's no hint there to indicate that this might possibly
>   be something that causes something to break:  it looks like
>   something to un-comment in order to allow more things to work.

Yeah, I think this should be fixed.  PERL_THREADED is really dangerous,
especially on -stable (-current is better since PERL_THREADED leads to
different compilation options;  to get the same bad effect on -current,
one has to configure perl with -Duse5005threads in addition to
-Dusethreads).  A note saying that PERL_THREADED will kill your cat is
in order.

> * The error message from Perl gave no hint (that I could see) that the
> problem involved this.  (From your answer, I would guess that this was
> not the first time you've encountered the situation.)

Yeah, you've got to know that @_ in a threaded perl is localized
(`local' like in `my') and therefore cannot be localized (`local' like
in `local').

> * I saw nothing in the documentation for cvsweb to indicate that it
> was not compatible with "PERL_THREADED=true".  (Yes, I grepped for
> "threaded" in /usr/local/share/doc/cvsweb/*.  Case-insensitively.)

> Finally, I'll point out that with the change I made, cvsweb seemed to
> work just fine, even with "PERL_THREADED=true" in the environment
> where I was seeing the problem:  on my laptop.  (Whether or not that
> is a "production environment" is, I suppose, a matter of
> interpretation.  Since I depend on it (at least, when I have it booted
> under -STABLE), I would consider it "production".  When it's running
> -CURRENT is rather more experimental....

Your change has a style problem.  You unnecessarily introduce a global
array @h.  Putting my @h instead of local @_ would fix the problem just
as well, and would be much cleaner.

In fact, cvsweb has quite a number of misuses of local().  I can only
attribute it to the fact that the original Bill Fenner's cvsweb was pure
perl4, and since then many things were added, but there was no real
cleanup done.  Someone's got to do that at some point.  I am serisouly
considering doing this myself;  I probably will have some time for this
this week.

Mind you, no offence to cvsweb authors/maintainers here.  The problems
are mostly historical.

Cheers,
=Anton.
-- 
May the tuna salad be with you.
Comment 5 David Wolfskill 2001-04-30 16:42:33 UTC
>Date: Mon, 30 Apr 2001 17:24:09 +0200
>From: Anton Berezin <tobez@tobez.org>

>>   That is, there's no hint there to indicate that this might possibly
>>   be something that causes something to break:  it looks like
>>   something to un-comment in order to allow more things to work.

>Yeah, I think this should be fixed.  PERL_THREADED is really dangerous,
>especially on -stable (-current is better since PERL_THREADED leads to
>different compilation options;  to get the same bad effect on -current,
>one has to configure perl with -Duse5005threads in addition to
>-Dusethreads).  A note saying that PERL_THREADED will kill your cat is
>in order.

Ah.  (I had just built today's -STABLE before reporting the results, and
I'm in the "building libraries" stage of building today's -CURRENT as I
type.  I had commented out the PERL_THREADED line in the -CURRENT
/etc/make.conf, too....)

>> * The error message from Perl gave no hint (that I could see) that the
>> problem involved this.  (From your answer, I would guess that this was
>> not the first time you've encountered the situation.)

>Yeah, you've got to know that @_ in a threaded perl is localized
>(`local' like in `my') and therefore cannot be localized (`local' like
>in `local').

Indeed.  When I wrote scripts with Perl4, I tended to use "local", but
I've been able to depend on Perl5 for the last couple of years, at
least, so I'm in the habit of using "my".

>> Finally, I'll point out that with the change I made, cvsweb seemed to
>> work just fine, even with "PERL_THREADED=true" in the environment
>> where I was seeing the problem:  on my laptop.  (Whether or not that
>> is a "production environment" is, I suppose, a matter of
>> interpretation.  Since I depend on it (at least, when I have it booted
>> under -STABLE), I would consider it "production".  When it's running
>> -CURRENT is rather more experimental....

>Your change has a style problem.  You unnecessarily introduce a global
>array @h.  Putting my @h instead of local @_ would fix the problem just
>as well, and would be much cleaner.

Yes, but since everything else was done as "local", I tried to follow
the existing style.  :-}

>In fact, cvsweb has quite a number of misuses of local().  I can only
>attribute it to the fact that the original Bill Fenner's cvsweb was pure
>perl4, and since then many things were added, but there was no real
>cleanup done.

Yeah, that's what I thought.

>Someone's got to do that at some point.  I am serisouly considering doing
>this myself;  I probably will have some time for this this week.

If there's a way I can help with that -- I don't know the extent to
which partitioning the work makes sense -- I'm willing to try.  In any
case, I'm willing to test stuff.  (I rebuild -STABLE and -CURRENT daily
already anyhow.)

>Mind you, no offence to cvsweb authors/maintainers here.  The problems
>are mostly historical.

Perspective understood & shared.

Thanks,
david
-- 
David Wolfskill      dhw@whistle.com   UNIX System Administrator
Desk: 650/577-7158   TIE: 8/499-7158   Cell: 650/759-0823
Comment 6 Akinori MUSHA freebsd_committer freebsd_triage 2001-05-17 21:04:14 UTC
State Changed
From-To: open->analyzed

The fix will be included in the next release, though I cannot guarantee 
if cvsweb works on threaded perl. 

By the way, using just "my @a" would be enough to fix this.
Comment 7 Akinori MUSHA freebsd_committer freebsd_triage 2001-06-12 06:38:49 UTC
State Changed
From-To: analyzed->closed

Fix included in the previous update, thanks.