heap-buffer-overflow Perl_sv_setpvn (sv.c:4910) #15648
Comments
From @geeknikTriggered in Perl v5.25.6 (v5.25.5-72-g2814f4b) with AFL+ASAN. Valgrind + od -tx1 test03 ==21794==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000e1fc is located 0 bytes to the right of 12-byte region SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memmove Valgrind + Perl 5.20.2: |
From @hvdsI can't replicate this with valgrind on blead@2814f4b; with 5.20.2 I get a different report: I see one relevant commit in the intervening period, 488bc57, but that doesn't seem to affect this case. I'll have a go at building with ASAN. Hugo |
|
The RT System itself - Status changed from 'new' to 'open' |
From @geeknikThis test case does not crash with Valgrind under blead (v5.25.6 AFL_PRELOAD=/root/afl-2.34b/libdislocator/libdislocator.so
STACK 0: MAIN (19786:-e:1) null STACK 0: MAIN (19786:-e:1) const(PV(""\0)) STACK 0: MAIN (19786:-e:1) scalar STACK 0: MAIN (19786:-e:1) null STACK 0: MAIN (19786:-e:1) const(PV("0\n"\0)) STACK 0: MAIN (19786:-e:1) scalar STACK 0: MAIN (19786:-e:1) left_shift==19786==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000e21c is located 0 bytes to the right of 12-byte region SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memmove On Mon, Oct 10, 2016 at 7:16 PM, Hugo van der Sanden via RT <
|
From @hvdsUgh, I'm not getting very far with this. I believe the problem occurs if the call to lex_grow_linestr() from the 3rd scan_heredoc() causes the buffer to be reallocated - it appears this eventually gets us to toke.c:4745: Hugo |
From @geeknikI have a new test case that triggers this bug, plus some valgrind output Passing malformed UTF-8 to "_Perl_IDStart" is deprecated at test009 line 1. |
From @geeknik |
From @tonycozOn Fri, 14 Oct 2016 13:42:55 -0700, brian.carpenter@gmail.com wrote:
This bug requires feeding code to the interpreter, so it isn't a security issue. It's now public. Tony |
From @khwilliamsonOn Fri, 14 Oct 2016 13:42:55 -0700, brian.carpenter@gmail.com wrote:
There have been significant changes since this ticket was filed. I just tried this case in blead with valgrind and got no problems. This is the output Useless use of anonymous hash ({}) in void context at -e line 1. -- |
From @iabynOn Sun, Jan 29, 2017 at 08:15:22PM -0800, Karl Williamson via RT wrote:
with the original test03 script, I can bisect it not panicing under commit 98d5e3e misaligned buffer with heredoc and /(?{...})/ but I can't bisect the test0009 script. -- |
From @tonycozOn Wed, 01 Feb 2017 03:16:56 -0800, davem wrote:
test009 was fixed by: Author: Tony Cook <tony@develop-help.com> (perl #128997) avoid reading beyond the end of the line buffer Closing. Tony |
|
@tonycoz - Status changed from 'open' to 'pending release' |
From @khwilliamsonThank you for filing this report. You have helped make Perl better. With the release today of Perl 5.26.0, this and 210 other issues have been Perl 5.26.0 may be downloaded via: If you find that the problem persists, feel free to reopen this ticket. |
|
@khwilliamson - Status changed from 'pending release' to 'resolved' |
Migrated from rt.perl.org#129848 (status was 'resolved')
Searchable as RT129848$
The text was updated successfully, but these errors were encountered: