Turn of tainting locally inside swash_init(), as the internal

implementation of the regexp engine has nothing to do with user data,
so when and where it happens to call require is agnostic of the current
expression's taintedness.

p4raw-id: //depot/perl@27221

1 files changed, 4 insertions, 0 deletions

diff --git a/utf8.c b/utf8.c
index 992629db67..9dc57a2e7f 100644
--- a/utf8.c
+++ b/utf8.c
@@ -1592,6 +1592,10 @@ Perl_swash_init(pTHX_ const char* pkg, const char* name, SV *listsv, I32 minbits
     ENTER;
     SAVEI32(PL_hints);
     PL_hints = 0;
+    /* It is assumed that callers of this routine are not passing in any
+       user derived data.  */
+    SAVEBOOL(PL_tainted);
+    PL_tainted = 0;
     save_re_context();
     if (!gv_fetchmeth(stash, "SWASHNEW", 8, -1)) {	/* demand load utf8 */
 	ENTER;