This patch is an update of Data-Dumper to version 2.154 that comes from:

http://search.cpan.org/~smueller/Data-Dumper-2.154/Dumper.pm

diff -ur --new-file perl-5.12.5/dist/Data-Dumper/Changes perl-5.12.5_dumper/dist/Data-Dumper/Changes

--- perl-5.12.5/dist/Data-Dumper/Changes	2012-11-03 19:25:59.000000000 -0400

+++ perl-5.12.5_dumper/dist/Data-Dumper/Changes	2014-10-09 15:06:36.166260359 -0400

@@ -1,11 +1,165 @@

 =head1 NAME

-HISTORY - public release history for Data::Dumper

+Changes - public release history for Data::Dumper

 =head1 DESCRIPTION

 =over 8

+=item 2.154 (Sep 18 2014)

+

+Most notably, this release fixes CVE-2014-4330:

+

+  Don't recurse infinitely in Data::Dumper

+

+  Add a configuration variable/option to limit recursion when dumping

+  deep data structures.

+  [...]

+  This patch addresses CVE-2014-4330.  This bug was found and

+  reported by: LSE Leading Security Experts GmbH employee Markus

+  Vervier.

+

+On top of that, there are several minor big fixes and improvements,

+see "git log" if the core perl distribution for details.

+

+=item 2.151 (Mar 7 2014)

+

+A "useqq" implementation for the XS version of Data::Dumper.

+

+Better compatibility wrt. hash key quoting between PP and XS

+versions of Data::Dumper.

+

+EBCDIC fixes.

+

+64bit safety fixes (for very large arrays).

+

+Build fixes for threaded perls.

+

+clang warning fixes.

+

+Warning fixes in tests on older perls.

+

+Typo fixes in documentation.

+

+=item 2.145 (Mar 15 2013)

+

+Test refactoring and fixing wide and far.

+

+Various old-perl compat fixes.

+

+=item 2.143 (Feb 26 2013)

+

+Address vstring related test failures on 5.8: Skip tests for

+obscure case.

+

+Major improvements to test coverage and significant refactoring.

+

+Make Data::Dumper XS ignore Freezer return value. Fixes RT #116364.

+

+Change call of isALNUM to equivalent but more clearly named isWORDCHAR

+

+=item 2.139 (Dec 12 2012)

+

+Supply an explicit dynamic_config => 0 in META

+

+Properly list BUILD_REQUIRES prereqs (P5-RT#116028)

+

+Some optimizations. Removed useless "register" declarations.

+

+=item 2.136 (Oct 04 2012)

+

+Promote to stable release.

+

+Drop some "register" declarations.

+

+=item 2.135_07 (Aug 06 2012)

+

+Use the new utf8 to code point functions - fixing a potential

+reading buffer overrun.

+

+Data::Dumper: Sparseseen option to avoid building much of the seen

+hash: This has been measured to, in some cases, provide a 50% speed-up

+

+Dumper.xs: Avoid scan_vstring on 5.17.3 and up

+

+Avoid a warning from clang when compiling Data::Dumper

+

+Fix DD's dumping of qr|\/|

+

+Data::Dumper's Perl implementation was not working with overloaded

+blessed globs, which it thought were strings.

+

+Allow Data::Dumper to load on miniperl

+

+=item 2.135_02 (Dec 29 2011)

+

+Makes DD dump *{''} properly.

+

+[perl #101162] DD support for vstrings:

+Support for vstrings to Data::Dumper, in both Perl and XS

+implementations.

+

+=item 2.135_01 (Dec 19 2011)

+

+Make Data::Dumper UTF8- and null-clean with GVs.

+

+In Dumper.xs, use sv_newmortal() instead of sv_mortalcopy(&PL_sv_undef)

+for efficiency.

+

+Suppress compiler warning

+

+Keep verbatim pod in Data::Dumper within 80 cols

+

+=item 2.131 (May 27 2011)

+

+Essentially the same as version 2.130_02, but a production release.

+

+=item 2.130_03 (May 20 2011)

+

+Essentially the same as version 2.130_02, but a CPAN release

+for the eventual 2.131.

+

+=item 2.130_02

+

+This was only shipped with the perl core, never released to CPAN.

+

+Convert overload.t to Test::More

+

+Fix some spelling errors

+

+Fix some compiler warnings

+

+Fix an out of bounds write in Data-Dumper with malformed utf8 input

+

+=item 2.130 (Nov 20 2010)

+

+C<Dumpxs> can now handle malformed UTF-8.

+

+=item 2.129 (Oct 20 2010)

+

+C<Dumpxs> no longer crashes with globs returned by C<*$io_ref>

+[perl #72332].

+

+=item 2.128 (Sep 10 2010)

+

+Promote previous release to stable version with the correct version.

+

+=item 2.127 (Sep 10 2010)

+

+Promote previous release to stable version.

+

+=item 2.126_01 (Sep  6 2010)

+

+Port core perl changes e3ec2293dc, fe642606b19.

+Fixes core perl RT #74170 (handle the stack changing in the

+custom sort functions) and adds a test.

+

+=item 2.126 (Apr 15 2010)

+

+Fix Data::Dumper's Fix Terse(1) + Indent(2):

+perl-RT #73604: When $Data::Dumper::Terse is true, the indentation is thrown

+off. It appears to be acting as if the $VAR1 = is still there.

+

 =item 2.125 (Aug  8 2009)

 CPAN distribution fixes (meta information for META.yml).

diff -ur --new-file perl-5.12.5/dist/Data-Dumper/Dumper.pm perl-5.12.5_dumper/dist/Data-Dumper/Dumper.pm

--- perl-5.12.5/dist/Data-Dumper/Dumper.pm	2012-11-03 19:25:59.000000000 -0400

+++ perl-5.12.5_dumper/dist/Data-Dumper/Dumper.pm	2014-10-09 15:06:36.167092691 -0400

@@ -9,7 +9,9 @@

 package Data::Dumper;

-$VERSION = '2.125'; # Don't forget to set version and release date in POD!

+BEGIN {

+    $VERSION = '2.154'; # Don't forget to set version and release

+}               # date in POD below!

 #$| = 1;

@@ -28,13 +30,13 @@

     # XSLoader should be attempted to load, or the pure perl flag

     # toggled on load failure.

     eval {

-	require XSLoader;

-    };

-    $Useperl = 1 if $@;

+        require XSLoader;

+        XSLoader::load( 'Data::Dumper' );

+        1

+    }

+    or $Useperl = 1;

 }

-XSLoader::load( 'Data::Dumper' ) unless $Useperl;

-

 # module vars and their defaults

 $Indent     = 2         unless defined $Indent;

 $Purity     = 0         unless defined $Purity;

@@ -53,6 +55,8 @@

 $Useperl    = 0         unless defined $Useperl;

 $Sortkeys   = 0         unless defined $Sortkeys;

 $Deparse    = 0         unless defined $Deparse;

+$Sparseseen = 0         unless defined $Sparseseen;

+$Maxrecurse = 1000      unless defined $Maxrecurse;

 #

 # expects an arrayref of values to be dumped.

@@ -63,36 +67,38 @@

 sub new {

   my($c, $v, $n) = @_;

-  croak "Usage:  PACKAGE->new(ARRAYREF, [ARRAYREF])" 

+  croak "Usage:  PACKAGE->new(ARRAYREF, [ARRAYREF])"

     unless (defined($v) && (ref($v) eq 'ARRAY'));

   $n = [] unless (defined($n) && (ref($n) eq 'ARRAY'));

-  my($s) = { 

-             level      => 0,           # current recursive depth

-	     indent     => $Indent,     # various styles of indenting

-	     pad	=> $Pad,        # all lines prefixed by this string

-	     xpad       => "",          # padding-per-level

-	     apad       => "",          # added padding for hash keys n such

-	     sep        => "",          # list separator

-	     pair	=> $Pair,	# hash key/value separator: defaults to ' => '

-	     seen       => {},          # local (nested) refs (id => [name, val])

-	     todump     => $v,          # values to dump []

-	     names      => $n,          # optional names for values []

-	     varname    => $Varname,    # prefix to use for tagging nameless ones

-             purity     => $Purity,     # degree to which output is evalable

-             useqq 	=> $Useqq,      # use "" for strings (backslashitis ensues)

-             terse 	=> $Terse,      # avoid name output (where feasible)

-             freezer	=> $Freezer,    # name of Freezer method for objects

-             toaster	=> $Toaster,    # name of method to revive objects

-             deepcopy	=> $Deepcopy,   # dont cross-ref, except to stop recursion

-             quotekeys	=> $Quotekeys,  # quote hash keys

-             'bless'	=> $Bless,	# keyword to use for "bless"

-#	     expdepth   => $Expdepth,   # cutoff depth for explicit dumping

-	     maxdepth	=> $Maxdepth,   # depth beyond which we give up

-	     useperl    => $Useperl,    # use the pure Perl implementation

-	     sortkeys   => $Sortkeys,   # flag or filter for sorting hash keys

-	     deparse	=> $Deparse,	# use B::Deparse for coderefs

-	   };

+  my($s) = {

+        level      => 0,           # current recursive depth

+        indent     => $Indent,     # various styles of indenting

+        pad        => $Pad,        # all lines prefixed by this string

+        xpad       => "",          # padding-per-level

+        apad       => "",          # added padding for hash keys n such

+        sep        => "",          # list separator

+        pair       => $Pair,    # hash key/value separator: defaults to ' => '

+        seen       => {},          # local (nested) refs (id => [name, val])

+        todump     => $v,          # values to dump []

+        names      => $n,          # optional names for values []

+        varname    => $Varname,    # prefix to use for tagging nameless ones

+        purity     => $Purity,     # degree to which output is evalable

+        useqq      => $Useqq,      # use "" for strings (backslashitis ensues)

+        terse      => $Terse,      # avoid name output (where feasible)

+        freezer    => $Freezer,    # name of Freezer method for objects

+        toaster    => $Toaster,    # name of method to revive objects

+        deepcopy   => $Deepcopy,   # do not cross-ref, except to stop recursion

+        quotekeys  => $Quotekeys,  # quote hash keys

+        'bless'    => $Bless,    # keyword to use for "bless"

+#        expdepth   => $Expdepth,   # cutoff depth for explicit dumping

+        maxdepth   => $Maxdepth,   # depth beyond which we give up

+	maxrecurse => $Maxrecurse, # depth beyond which we abort

+        useperl    => $Useperl,    # use the pure Perl implementation

+        sortkeys   => $Sortkeys,   # flag or filter for sorting hash keys

+        deparse    => $Deparse,    # use B::Deparse for coderefs

+        noseen     => $Sparseseen, # do not populate the seen hash unless necessary

+       };

   if ($Indent > 0) {

     $s->{xpad} = "  ";

@@ -101,26 +107,39 @@

   return bless($s, $c);

 }

-if ($] >= 5.008) {

-  # Packed numeric addresses take less memory. Plus pack is faster than sprintf

-  *init_refaddr_format = sub {};

+# Packed numeric addresses take less memory. Plus pack is faster than sprintf

+

+# Most users of current versions of Data::Dumper will be 5.008 or later.

+# Anyone on 5.6.1 and 5.6.2 upgrading will be rare (particularly judging by

+# the bug reports from users on those platforms), so for the common case avoid

+# complexity, and avoid even compiling the unneeded code.

-  *format_refaddr  = sub {

+sub init_refaddr_format {

+}

+

+sub format_refaddr {

     require Scalar::Util;

     pack "J", Scalar::Util::refaddr(shift);

-  };

-} else {

-  *init_refaddr_format = sub {

-    require Config;

-    my $f = $Config::Config{uvxformat};

-    $f =~ tr/"//d;

-    our $refaddr_format = "0x%" . $f;

-  };

+};

-  *format_refaddr = sub {

-    require Scalar::Util;

-    sprintf our $refaddr_format, Scalar::Util::refaddr(shift);

-  }

+if ($] < 5.008) {

+    eval <<'EOC' or die;

+    no warnings 'redefine';

+    my $refaddr_format;

+    sub init_refaddr_format {

+        require Config;

+        my $f = $Config::Config{uvxformat};

+        $f =~ tr/"//d;

+        $refaddr_format = "0x%" . $f;

+    }

+

+    sub format_refaddr {

+        require Scalar::Util;

+        sprintf $refaddr_format, Scalar::Util::refaddr(shift);

+    }

+

+    1

+EOC

 }

 #

@@ -132,21 +151,26 @@

     init_refaddr_format();

     my($k, $v, $id);

     while (($k, $v) = each %$g) {

-      if (defined $v and ref $v) {

-	$id = format_refaddr($v);

-	if ($k =~ /^[*](.*)$/) {

-	  $k = (ref $v eq 'ARRAY') ? ( "\\\@" . $1 ) :

-	       (ref $v eq 'HASH')  ? ( "\\\%" . $1 ) :

-	       (ref $v eq 'CODE')  ? ( "\\\&" . $1 ) :

-				     (   "\$" . $1 ) ;

-	}

-	elsif ($k !~ /^\$/) {

-	  $k = "\$" . $k;

-	}

-	$s->{seen}{$id} = [$k, $v];

+      if (defined $v) {

+        if (ref $v) {

+          $id = format_refaddr($v);

+          if ($k =~ /^[*](.*)$/) {

+            $k = (ref $v eq 'ARRAY') ? ( "\\\@" . $1 ) :

+                 (ref $v eq 'HASH')  ? ( "\\\%" . $1 ) :

+                 (ref $v eq 'CODE')  ? ( "\\\&" . $1 ) :

+                 (   "\$" . $1 ) ;

+          }

+          elsif ($k !~ /^\$/) {

+            $k = "\$" . $k;

+          }

+          $s->{seen}{$id} = [$k, $v];

+        }

+        else {

+          carp "Only refs supported, ignoring non-ref item \$$k";

+        }

       }

       else {

-	carp "Only refs supported, ignoring non-ref item \$$k";

+        carp "Value of ref must be defined; ignoring undefined item \$$k";

       }

     }

     return $s;

@@ -161,9 +185,14 @@

 #

 sub Values {

   my($s, $v) = @_;

-  if (defined($v) && (ref($v) eq 'ARRAY'))  {

-    $s->{todump} = [@$v];        # make a copy

-    return $s;

+  if (defined($v)) {

+    if (ref($v) eq 'ARRAY')  {

+      $s->{todump} = [@$v];        # make a copy

+      return $s;

+    }

+    else {

+      croak "Argument to Values, if provided, must be array ref";

+    }

   }

   else {

     return @{$s->{todump}};

@@ -175,9 +204,14 @@

 #

 sub Names {

   my($s, $n) = @_;

-  if (defined($n) && (ref($n) eq 'ARRAY'))  {

-    $s->{names} = [@$n];         # make a copy

-    return $s;

+  if (defined($n)) {

+    if (ref($n) eq 'ARRAY') {

+      $s->{names} = [@$n];         # make a copy

+      return $s;

+    }

+    else {

+      croak "Argument to Names, if provided, must be array ref";

+    }

   }

   else {

     return @{$s->{names}};

@@ -188,9 +222,8 @@

 sub Dump {

     return &Dumpxs

-	unless $Data::Dumper::Useperl || (ref($_[0]) && $_[0]->{useperl}) ||

-	       $Data::Dumper::Useqq   || (ref($_[0]) && $_[0]->{useqq}) ||

-	       $Data::Dumper::Deparse || (ref($_[0]) && $_[0]->{deparse});

+    unless $Data::Dumper::Useperl || (ref($_[0]) && $_[0]->{useperl}) ||

+           $Data::Dumper::Deparse || (ref($_[0]) && $_[0]->{deparse});

     return &Dumpperl;

 }

@@ -208,40 +241,19 @@

   $s = $s->new(@_) unless ref $s;

   for $val (@{$s->{todump}}) {

-    my $out = "";

     @post = ();

     $name = $s->{names}[$i++];

-    if (defined $name) {

-      if ($name =~ /^[*](.*)$/) {

-	if (defined $val) {

-	  $name = (ref $val eq 'ARRAY') ? ( "\@" . $1 ) :

-		  (ref $val eq 'HASH')  ? ( "\%" . $1 ) :

-		  (ref $val eq 'CODE')  ? ( "\*" . $1 ) :

-					  ( "\$" . $1 ) ;

-	}

-	else {

-	  $name = "\$" . $1;

-	}

-      }

-      elsif ($name !~ /^\$/) {

-	$name = "\$" . $name;

-      }

-    }

-    else {

-      $name = "\$" . $s->{varname} . $i;

-    }

+    $name = $s->_refine_name($name, $val, $i);

     my $valstr;

     {

       local($s->{apad}) = $s->{apad};

-      $s->{apad} .= ' ' x (length($name) + 3) if $s->{indent} >= 2;

+      $s->{apad} .= ' ' x (length($name) + 3) if $s->{indent} >= 2 and !$s->{terse};

       $valstr = $s->_dump($val, $name);

     }

     $valstr = "$name = " . $valstr . ';' if @post or !$s->{terse};

-    $out .= $s->{pad} . $valstr . $s->{sep};

-    $out .= $s->{pad} . join(';' . $s->{sep} . $s->{pad}, @post) 

-      . ';' . $s->{sep} if @post;

+    my $out = $s->_compose_out($valstr, \@post);

     push @out, $out;

   }

@@ -255,6 +267,10 @@

     return  "'" . $val .  "'";

 }

+# Old Perls (5.14-) have trouble resetting vstring magic when it is no

+# longer valid.

+use constant _bad_vsmg => defined &_vstring && (_vstring(~v0)||'') eq "v0";

+

 #

 # twist, toil and turn;

 # and recurse, of course.

@@ -263,8 +279,7 @@

 #

 sub _dump {

   my($s, $val, $name) = @_;

-  my($sname);

-  my($out, $realpack, $realtype, $type, $ipad, $id, $blesspad);

+  my($out, $type, $id, $sname);

   $type = ref $val;

   $out = "";

@@ -281,65 +296,70 @@

     }

     require Scalar::Util;

-    $realpack = Scalar::Util::blessed($val);

-    $realtype = $realpack ? Scalar::Util::reftype($val) : ref $val;

+    my $realpack = Scalar::Util::blessed($val);

+    my $realtype = $realpack ? Scalar::Util::reftype($val) : ref $val;

     $id = format_refaddr($val);

-    # if it has a name, we need to either look it up, or keep a tab

-    # on it so we know when we hit it later

-    if (defined($name) and length($name)) {

-      # keep a tab on it so that we dont fall into recursive pit

-      if (exists $s->{seen}{$id}) {

-#	if ($s->{expdepth} < $s->{level}) {

-	  if ($s->{purity} and $s->{level} > 0) {

-	    $out = ($realtype eq 'HASH')  ? '{}' :

-	      ($realtype eq 'ARRAY') ? '[]' :

-		'do{my $o}' ;

-	    push @post, $name . " = " . $s->{seen}{$id}[0];

-	  }

-	  else {

-	    $out = $s->{seen}{$id}[0];

-	    if ($name =~ /^([\@\%])/) {

-	      my $start = $1;

-	      if ($out =~ /^\\$start/) {

-		$out = substr($out, 1);

-	      }

-	      else {

-		$out = $start . '{' . $out . '}';

-	      }

-	    }

-          }

-	  return $out;

-#        }

+    # Note: By this point $name is always defined and of non-zero length.

+    # Keep a tab on it so that we do not fall into recursive pit.

+    if (exists $s->{seen}{$id}) {