Assert fail w/o other symptoms - pp_sys.c:690 Perl_pp_pipe_op when first arg to pipe is definitely not a filehandle #15015
Comments
From @dcollinsnGreetings Porters, I have compiled bleadperl with the afl-gcc compiler using: ./Configure -Dusedevel -Dprefix='/usr/local/perl-afl' -Dcc='ccache afl-gcc' -Duselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -des And then fuzzed the resulting binary using: AFL_NO_VAR_CHECK=1 afl-fuzz -i in -o out bin/perl @@ After reducing testcases using `afl-tmin` and performing additional minimization by hand, I have located the following testcase that triggers an assert fail in DEBUGGING perls without any other symptoms in the normal perl interpreter. The testcase is the file: pipe$$5,0 dcollins@nightshade64:/usr/local/perl-afl$ ./bin/perl -e 'pipe$$5,0' The output with a normal perl is the expected error: dcollins@nightshade64:/usr/local/perl-afl$ ~/perl/perl -e 'pipe$$5,0' **GDB** (gdb) run Program received signal SIGABRT, Aborted. Inferior 1 [process 4065] will be killed. Quit anyway? (y or n) y **VALGRIND** dcollins@nightshade64:/usr/local/perl-afl$ valgrind ./bin/perl -e 'pipe$$5,0' **PERL -V** dcollins@nightshade64:/usr/local/perl-afl$ ./bin/perl -V Characteristics of this binary (from libperl): |
From @tonycozOn Wed Oct 28 19:59:00 2015, dcollinsn@gmail.com wrote:
I suspect the assertions are incorrect here. S_rv2gv returns &PL_sv_undef when it can't turn the value into something resembling a GV, and the GvIOn() macro can handle that (by croaking). So the assertions would be something like: Inline Patchdiff --git a/pp_sys.c b/pp_sys.c
index 373590f..8589413 100644
--- a/pp_sys.c
+++ b/pp_sys.c
@@ -695,8 +695,10 @@ PP(pp_pipe_op)
GV * const wgv = MUTABLE_GV(POPs);
GV * const rgv = MUTABLE_GV(POPs);
- assert (isGV_with_GP(rgv));
- assert (isGV_with_GP(wgv));
+ /* rv2gv pushes PL_sv_undef when it can't make a GV, and GvIOn() properly croaks
+ when it's supplied with such */
+ assert ((SV*)rgv == &PL_sv_undef || isGV_with_GP(rgv));
+ assert ((SV*)wgv == &PL_sv_undef || isGV_with_GP(wgv));
rstio = GvIOn(rgv);
if (IoIFP(rstio))
do_close(rgv, FALSE);
Possibly the assertions should just be removed. Tony |
|
The RT System itself - Status changed from 'new' to 'open' |
From @tonycozOn Wed Oct 28 20:49:47 2015, tonyc wrote:
Like in the attached patch. Tony |
From @tonycoz0001-perl-126480-pipe-doesn-t-need-the-assertions.patchFrom 992ebee3f63e16317109eca1eb0d76925c594593 Mon Sep 17 00:00:00 2001
From: Tony Cook <tony@develop-help.com>
Date: Mon, 2 Nov 2015 17:22:25 +1100
Subject: [perl 126480] pipe() doesn't need the assertions
GvIOn() already performs the checks and produces a nice error message.
---
MANIFEST | 1 +
pp_sys.c | 2 --
t/lib/croak/pp_sys | 16 ++++++++++++++++
3 files changed, 17 insertions(+), 2 deletions(-)
create mode 100644 t/lib/croak/pp_sys
diff --git a/MANIFEST b/MANIFEST
index f07488f..ed47673 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -5043,6 +5043,7 @@ t/lib/croak/op Test croak calls from op.c
t/lib/croak/pp Test croak calls from pp.c
t/lib/croak/pp_ctl Test croak calls from pp_ctl.c
t/lib/croak/pp_hot Test croak calls from pp_hot.c
+t/lib/croak/pp_sys Test croak calls from pp_sys.c
t/lib/croak.t Test calls to Perl_croak() in the C source.
t/lib/croak/toke Test croak calls from toke.c
t/lib/cygwin.t Builtin cygwin function tests
diff --git a/pp_sys.c b/pp_sys.c
index 373590f..15b4d8b 100644
--- a/pp_sys.c
+++ b/pp_sys.c
@@ -695,8 +695,6 @@ PP(pp_pipe_op)
GV * const wgv = MUTABLE_GV(POPs);
GV * const rgv = MUTABLE_GV(POPs);
- assert (isGV_with_GP(rgv));
- assert (isGV_with_GP(wgv));
rstio = GvIOn(rgv);
if (IoIFP(rstio))
do_close(rgv, FALSE);
diff --git a/t/lib/croak/pp_sys b/t/lib/croak/pp_sys
new file mode 100644
index 0000000..001baa3
--- /dev/null
+++ b/t/lib/croak/pp_sys
@@ -0,0 +1,16 @@
+__END__
+# pp_sys.c
+# NAME pipe() croaks on bad left side [perl #126480]
+# SKIP ? use Config; !$Config{d_pipe} && "No pipe() available"
+my $fh;
+pipe($$5, $fh)
+EXPECT
+Bad symbol for filehandle at - line 3.
+########
+# NAME pipe() croaks on bad left side [perl #126480]
+# SKIP ? use Config; !$Config{d_pipe} && "No pipe() available"
+my $fh;
+pipe($fh, $$5)
+EXPECT
+Bad symbol for filehandle at - line 2.
+########
--
2.1.4
|
|
@tonycoz - Status changed from 'open' to 'pending release' |
From @khwilliamsonThank you for submitting this report. You have helped make Perl better. Perl 5.24.0 may be downloaded via https://metacpan.org/release/RJBS/perl-5.24.0 |
|
@khwilliamson - Status changed from 'pending release' to 'resolved' |
Migrated from rt.perl.org#126480 (status was 'resolved')
Searchable as RT126480$
The text was updated successfully, but these errors were encountered: