On Thu, Oct 12, 2006 at 01:01:36PM +0900, Nobuyoshi Nakada wrote:
>
> I can't reproduce your result with your code.
> 
> It must occur iff the regexp is tainted, and it would be possibly
> caused because it was created when $SAFE >= 3 or created from a string
> read from outside.

$SAFE = 1

And I can't reproduce the result either if I run the given piece of
code only. 

But then, when I do all the other things before which I do in that 
particular program (calling external programs, accessing a MySQL
database, Querying DNS), then the problem occurs, even when testing on
a second machine.

I guess there is a bug somewhere hidden which causes future Regular
Expressions to assign wrong taint values. I had a similar problem some
time ago with another program run from command line.

I'll try to isolate what causes this problem to occur.

But it smells like a bug.

regards
Hadmut