Check Perl 5.12.4 Compatibility Fixes on a Modern Linux Host

perl5124delta covers five fixes worth five minutes each, from an undefined-hash edge case to a Linux packaging note.

You will finish with a small, repeatable compatibility check for all five, run read-only as an ordinary user. Allow about 15 minutes. This machine provides perl-doc and perl-base version 5.38.2-3.2ubuntu0.6, so the examples show how to assess an old release note with a newer interpreter. They do not turn Perl 5.38 into Perl 5.12.4.

1. Confirm the manual and interpreter you are checking

Start by recording the local files and versions. These commands only read package metadata and print version information:

$ command -v perl
/usr/bin/perl
$ man -w perl5124delta
/usr/share/man/man1/perl5124delta.1.gz
$ dpkg-query -W -f='${Package} ${Version}\n' perl-doc perl-base
perl-doc 5.38.2-3.2ubuntu0.6
perl-base 5.38.2-3.2ubuntu0.6
$ perl -e 'print "$^V\n"'
v5.38.2

The manpage describes the difference between Perl 5.12.3 and 5.12.4. Its installed header may carry the documentation generator's version rather than the historical Perl release, so treat the release named in the title as the document's subject, not as what the package manager installed.

2. Test the undefined hash edge case

Perl 5.12.4 fixed an optimisation around keys and an undefined hash reference when strict references are off. The boundary is deliberate: the expression should be accepted without strict references, and rejected under strict mode.

$ perl -we 'no strict "refs"; my $x; my $ok = eval { keys %$x; 1 }; print "ok=$ok err=$@"'
ok=1 err=
$ perl -we 'use strict "refs"; my $x; my $ok = eval { keys %$x; 1 }; print "ok=$ok err=$@"'
ok= err=Can't use an undefined value as a HASH reference at -e line 1.

The exact diagnostic wording varies between Perl releases, but the distinction matters. An application accidentally depending on an undefined reference should be fixed, not propped up by permissive behaviour. This is a compatibility probe, not a recommendation to disable strictness. It creates no files and changes no process-wide setting.

3. Check taint propagation through case conversion

The release note records a security-relevant correction: lc, uc, lcfirst and ucfirst must preserve taint. Taint mode is enabled with -T; the sample reads the environment, which Perl treats as tainted, and checks the converted value with Scalar::Util::tainted:

$ perl -T -we 'my $x = $ENV{PATH}; my $y = lc $x; require Scalar::Util; print Scalar::Util::tainted($y) ? "tainted\n" : "untainted\n"'
tainted

This does not make an environment variable safe for a shell, file path or network request. It only proves the taint marker survives one transformation. Keep validation and untainting decisions at the point where the value enters your application.

4. Keep here-document fixes in the parser category

The manpage describes a possible use-after-free while parsing a here document. That is an interpreter memory-safety fix, not a shell feature you switch on with a flag. A harmless parser smoke test confirms your installed interpreter handles the syntax:

$ perl -we 'my $text = <<"END";
line one
line two
END
print $text'
line one
line two

A successful result shows this simple input parsed and ran. It proves nothing about every parser bug, and it cannot reproduce the vulnerable historical allocator state on demand. For an application that must run an older Perl, use its supported update path and test the actual interpreter version in a disposable environment.

5. Compare the bundled module version

perl5124delta says Module::CoreList moved from 2.43 to 2.50 in Perl 5.12.4. Query the installed module directly instead of guessing from the interpreter version:

$ perl -MModule::CoreList -e 'print "$Module::CoreList::VERSION\n"'
5.20231129

Much newer than 2.50, which is expected on Perl 5.38.2. That is evidence about this host only. If a build script needs a particular module API, test that API or declare a dependency; do not compare version strings across unrelated Perl releases as if they were interchangeable.

6. Treat the platform note as a packaging check

The document records support for Ubuntu 11.04's multi-architecture library layout: a historical platform note, not a command-line option. On a modern Debian or Ubuntu system, inspect the architecture and configured foreign architectures without changing them:

$ dpkg --print-architecture
amd64
$ dpkg --print-foreign-architectures
<no output on this host>

Do not run dpkg --add-architecture as part of this guide; it changes package-management state and can pull in downloads or dependency changes. Diagnosing a real multi-architecture installation? Record the current output first, then follow your distribution's packaging procedure with a change plan and rollback point.

7. Use the release note when triaging an old application

Read perl5123delta and perl5120delta too if the application is moving from an earlier 5.12 release. The 5.12.4 document deliberately limits itself to the 5.12.3 to 5.12.4 delta. Its note on HTTPS environment variables concerns the old cpan/CGI/t/http.t test, not a promise that every CGI application handles proxy settings correctly.

For a bug report, capture the smallest failing input and the output of perl -V, as the manpage requests. Route anything with Perl-core security implications through the manual's security reporting path rather than posting sensitive details publicly, and keep secrets, tokens and customer data out of the reproducer.