segfault in Perl_pad_free at pad.c:1820 #14815
Comments
From @geeknikWhile fuzzing Perl v5.23.2 (v5.23.1-27-g5cce15f), I found the attached script which causes a segfault in Perl_pad_free at pad.c:1820. Can't modify reference to eval "string" in list assignment at test01 line 1, near "};" Program received signal SIGSEGV, Segmentation fault. Hexdump: |
From @shlomifHi Brian, On Fri Jul 24 10:28:38 2015, brian.carpenter@gmail.com wrote:
I cannot reproduce this segfault on my Mageia Linux x86-64 6/Cauldron system: shlomif@telaviv1:~/Download/unpack/perl/p5/git/perl$ gdb ./perl bump version on Attribute::Handlers I've built bleadperl using this script: sh Configure -de -Dprefix=$HOME/apps/perl/bleadperl -Doptimize='-O3 -march=native' -Dusedevel |
|
The RT System itself - Status changed from 'new' to 'open' |
From @geeknikMy command line to build bleadperl on Debian 7 x64 (which never changes btw): ./Configure -des -Dusedevel -DDEBUGGING -Dcc=afl-gcc -Doptimize=-O2\ -g && AFL_HARDEN=1 make -j12 test-prep On Sat Jul 25 02:51:25 2015, shlomif wrote:
|
From @bulk88On Sat Jul 25 02:51:25 2015, shlomif wrote:
I can reproduce this with full win32 perl, but not with the same build of win32 miniperl. miniperl is fine, full perl isn't. C:\Documents and Settings\Owner\Desktop>drmemory -- C:\perl521\srcnewb4opt\minip C:\Documents and Settings\Owner\Desktop>drmemory -- C:\perl521\srcnewb4opt\perl. C:\Documents and Settings\Owner\Desktop> -- |
From @hvdsI tried this with: This is with afl-cc 1.47b and gcc (Ubuntu 4.8.2-19ubuntu1) 4.8.2. I also Hugo "Brian Carpenter via RT" <perlbug-followup@perl.org> wrote: |
From @geeknikThe only other differences is that I'm using GCC 4.9.2 and AFL 1.83b. To be honest, the test case was rather weird in the fact that I couldn't get afl-tmin to minimize it or even recognize that it was crashing, but I captured it with Valgrind and GDB. Not sure what else I can provide, guess we can put this on hold and see if I can get it to pop again? On Sun Jul 26 04:31:03 2015, hv wrote:
|
From @geeknikHere is the core dump and the Valgrind output if that helps. geeknik@deb7fuzz:~/perl$ git show geeknik@deb7fuzz:~/tmp$ ~/perl/perl test01 geeknik@deb7fuzz:~/tmp$ valgrind --version geeknik@deb7fuzz:~/tmp$ valgrind -q ~/perl/perl test01 |
From [Unknown Contact. See original ticket]Here is the core dump and the Valgrind output if that helps. geeknik@deb7fuzz:~/perl$ git show geeknik@deb7fuzz:~/tmp$ ~/perl/perl test01 geeknik@deb7fuzz:~/tmp$ valgrind --version geeknik@deb7fuzz:~/tmp$ valgrind -q ~/perl/perl test01 |
From @geeknikUnable to reproduce this `bug` in Perl v5.25.4-20-gc2f7c0b*. Feel free to close. |
From [Unknown Contact. See original ticket]Unable to reproduce this `bug` in Perl v5.25.4-20-gc2f7c0b*. Feel free to close. |
From @cpansproutOn Sat Aug 27 18:24:46 2016, brian.carpenter@gmail.com wrote:
Well *I* can reproduce it on darwin. $ ./perl -Ilib -V:config_args Maybe the last argument is helping. $ ./miniperl /Users/sprout/Downloads/test01 -- Father Chrysostomos |
From @cpansproutOn Sat Aug 27 22:06:12 2016, sprout wrote:
And that’s with v5.25.4-21-g51068c1. I reduced it by hand to: \eval=""^i{};f{}A{};e{}a{};} It doesn’t crash for me with -e. -- Father Chrysostomos |
From @cpansproutOn Sat Aug 27 22:06:12 2016, sprout wrote:
It was the poisson that helped. (I smelt something fishy.) It turns out that the larger the value of $^H the more likely it is to crash: BEGIN{$^H=-1}\eval=time because the hints were being used as a pad offset, as explained in 2b6a5bf, which fixes the problem. -- Father Chrysostomos |
|
@cpansprout - Status changed from 'open' to 'pending release' |
From @khwilliamsonThank you for filing this report. You have helped make Perl better. With the release today of Perl 5.26.0, this and 210 other issues have been Perl 5.26.0 may be downloaded via: If you find that the problem persists, feel free to reopen this ticket. |
|
@khwilliamson - Status changed from 'pending release' to 'resolved' |
Migrated from rt.perl.org#125679 (status was 'resolved')
Searchable as RT125679$
The text was updated successfully, but these errors were encountered: