write() with format containing ... crashes perl

[p5pRT]

Migrated from rt.perl.org#123622 (status was 'resolved')

Searchable as RT123622$

[p5pRT]

From @xenu

Created by @xenu

This is a bug report for perl from me@​xenu.tk,
generated with the help of perlbug 1.40 running under perl 5.20.1.

-----------------------------------------------------------------

Hello,

I was playing with format and I've noticed that using '...' in
format crashes perl when format is passed to write() function.
Problem occurs under perl 5.20.1 compiled for 64-bit Windows
(both Strawberry and ActiveState), I haven't tested it under
Linux.

Following snippet of code crashes perl​:

===========

use strict;
use warnings;

my $foo;

format =
@​>>>>>>...
$foo
.

$foo = 'sddsdasadsdasadsadsasd';

write;

===========

Cheers,
Tomasz

Perl Info

Flags:
    category=core
    severity=critical

Site configuration information for perl 5.20.1:

Configured by gecko at Wed Oct 15 14:55:58 2014.

Summary of my perl5 (revision 5 version 20 subversion 1) configuration:
   
  Platform:
    osname=MSWin32, osvers=6.1, archname=MSWin32-x64-multi-thread
    uname=''
    config_args='undef'
    hint=recommended, useposix=true, d_sigaction=undef
    useithreads=define, usemultiplicity=define
    use64bitint=define, use64bitall=undef, uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='undef', ccflags =' -s -O2 -DWIN32 -DWIN64 -DCONSERVATIVE -DPERL_TEXTMODE_SCRIPTS -DUSE_SITECUSTOMIZE -DPERL_IMPLICIT_CONTEXT -DPERL_IMPLICIT_SYS -DUSE_PERLIO -fwrapv -fno-strict-aliasing -mms-bitfields',
    optimize='-s -O2',
    cppflags='-DWIN32'
    ccversion='', gccversion='4.6.3', gccosandvers=''
    intsize=4, longsize=4, ptrsize=8, doublesize=8, byteorder=12345678
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    ivtype='long long', ivsize=8, nvtype='double', nvsize=8, Off_t='long long', lseeksize=8
    alignbytes=8, prototype=define
  Linker and Libraries:
    ld='undef', ldflags ='-s -static-libgcc -static-libstdc++ -L"C:\Perl64\lib\CORE" -L"C:\MinGW\x86_64-w64-mingw32\lib"'
    libpth=C:\MinGW\x86_64-w64-mingw32\lib
    libs=-lmoldname -lkernel32 -luser32 -lgdi32 -lwinspool -lcomdlg32 -ladvapi32 -lshell32 -lole32 -loleaut32 -lnetapi32 -luuid -lws2_32 -lmpr -lwinmm -lversion -lodbc32 -lodbccp32 -lcomctl32
    perllibs=-lmoldname -lkernel32 -luser32 -lgdi32 -lwinspool -lcomdlg32 -ladvapi32 -lshell32 -lole32 -loleaut32 -lnetapi32 -luuid -lws2_32 -lmpr -lwinmm -lversion -lodbc32 -lodbccp32 -lcomctl32
    libc=, so=dll, useshrplib=true, libperl=libperl520.a
    gnulibc_version=''
  Dynamic Linking:
    dlsrc=dl_win32.xs, dlext=dll, d_dlsymun=undef, ccdlflags=' '
    cccdlflags=' ', lddlflags='-mdll -s -static-libgcc -static-libstdc++ -L"C:\Perl64\lib\CORE" -L"C:\MinGW\x86_64-w64-mingw32\lib"'

Locally applied patches:
    ActivePerl Build 2000 [298557]


@INC for perl 5.20.1:
    C:/Perl64/site/lib
    C:/Perl64/lib
    .


Environment for perl 5.20.1:
    HOME (unset)
    LANG (unset)
    LANGUAGE (unset)
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
    PATH=C:\Perl64\site\bin;C:\Perl64\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\AMD\ATI.ACE\Core-Static;C:\Program Files (x86)\OpenVPN\bin
    PERL_BADLANG (unset)
    SHELL (unset)

[p5pRT]

From @jkeenan

On Sun Jan 18 14​:21​:29 2015, me@​xenu.tk wrote​:

This is a bug report for perl from me@​xenu.tk,
generated with the help of perlbug 1.40 running under perl 5.20.1.

-----------------------------------------------------------------

Hello,

I was playing with format and I've noticed that using '...' in
format crashes perl when format is passed to write() function.
Problem occurs under perl 5.20.1 compiled for 64-bit Windows
(both Strawberry and ActiveState), I haven't tested it under
Linux.

Following snippet of code crashes perl​:

===========

use strict;
use warnings;

my $foo;

format =
@​>>>>>>...
$foo
.

$foo = 'sddsdasadsdasadsadsasd';

write;

===========

Cheers,
Tomasz

Confirmed as existing on Linux as well.

--
James E Keenan (jkeenan@​cpan.org)

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @tonycoz

On Sun Jan 18 14​:21​:29 2015, me@​xenu.tk wrote​:

I was playing with format and I've noticed that using '...' in
format crashes perl when format is passed to write() function.
Problem occurs under perl 5.20.1 compiled for 64-bit Windows
(both Strawberry and ActiveState), I haven't tested it under
Linux.

My patch for 123538 fixed this.

Tony

[p5pRT]

@tonycoz - Status changed from 'open' to 'pending release'

[p5pRT]

From @iabyn

On Sun, Jan 18, 2015 at 02​:21​:29PM -0800, Tomasz Konojacki wrote​:

I was playing with format and I've noticed that using '...' in
format crashes perl when format is passed to write() function.
Problem occurs under perl 5.20.1 compiled for 64-bit Windows
(both Strawberry and ActiveState), I haven't tested it under
Linux.

Following snippet of code crashes perl​:

===========

use strict;
use warnings;

my $foo;

format =
@​>>>>>>...
$foo
.

$foo = 'sddsdasadsdasadsadsasd';

write;

===========

Thanks for the report. This has recently been fixed in the development
branch of perl (5.21.8) and will likely be backported to 5.20.x soon.

--
A major Starfleet emergency breaks out near the Enterprise, but
fortunately some other ships in the area are able to deal with it to
everyone's satisfaction.
  -- Things That Never Happen in "Star Trek" #13

[p5pRT]

From @iabyn

On Wed, Jan 21, 2015 at 11​:06​:23AM +0000, Dave Mitchell wrote​:

On Sun, Jan 18, 2015 at 02​:21​:29PM -0800, Tomasz Konojacki wrote​:

I was playing with format and I've noticed that using '...' in
format crashes perl when format is passed to write() function.
Problem occurs under perl 5.20.1 compiled for 64-bit Windows
(both Strawberry and ActiveState), I haven't tested it under
Linux.

Following snippet of code crashes perl​:

===========

use strict;
use warnings;

my $foo;

format =
@​>>>>>>...
$foo
.

$foo = 'sddsdasadsdasadsadsasd';

write;

===========

Thanks for the report. This has recently been fixed in the development
branch of perl (5.21.8) and will likely be backported to 5.20.x soon.

That's this commit​:

  commit 62db6ea
  Author​: Tony Cook <tony@​develop-help.com>
  AuthorDate​: Mon Jan 19 16​:03​:18 2015 +1100
  Commit​: Tony Cook <tony@​develop-help.com>
  CommitDate​: Mon Jan 19 16​:03​:18 2015 +1100

  [perl #123538] always set chophere and itembytes at the same time
 
  Previously this would crash in FF_MORE because chophere was still
  NULL.

In fact I've just noticed that it was back-ported this morning, so it will
be in 5.20.2, due to be released very soon.

--
Please note that ash-trays are provided for the use of smokers,
whereas the floor is provided for the use of all patrons.
  -- Bill Royston

[p5pRT]

From @khwilliamson

Thanks for submitting this ticket

The issue should be resolved with the release today of Perl v5.22, available at http​://www.perl.org/get.html
If you find that the problem persists, feel free to reopen this ticket

--
Karl Williamson for the Perl 5 porters team

[p5pRT]

@khwilliamson - Status changed from 'pending release' to 'resolved'