Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign upheap-buffer-overflow Perl_pp_split (pp.c:6145) #15749
Comments
This comment has been minimized.
This comment has been minimized.
From @geeknikTriggered with Perl v5.25.7-26-g7332835. ./perl -e 'map{int"";split//.0>60for"0000000000000000"}split//
|
This comment has been minimized.
This comment has been minimized.
From @tonycozOn Sun, 04 Dec 2016 13:56:12 -0800, brian.carpenter@gmail.com wrote:
From valgrind: ==26813== Invalid write of size 8 This is a stack overflow from the final: PUSHi(iters); in pp_split. An attacker has no control over the value stored, and it's always stored Fixed by the attached. Tony |
This comment has been minimized.
This comment has been minimized.
From @tonycoz0001-perl-130262-split-scalar-context-stack-overflow-fix.patchFrom 071b4693c6bfb5496be82ae23e136b7f58c7e86d Mon Sep 17 00:00:00 2001
From: Tony Cook <tony@develop-help.com>
Date: Mon, 5 Dec 2016 11:48:14 +1100
Subject: (perl #130262) split scalar context stack overflow fix
pp_split didn't ensure there was space for its return value
in scalar context.
---
pp.c | 2 +-
t/op/split.t | 6 +++++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/pp.c b/pp.c
index b198b47..737111a 100644
--- a/pp.c
+++ b/pp.c
@@ -6142,7 +6142,7 @@ PP(pp_split)
}
GETTARGET;
- PUSHi(iters);
+ XPUSHi(iters);
RETURN;
}
diff --git a/t/op/split.t b/t/op/split.t
index ceaea00..6d1ed25 100644
--- a/t/op/split.t
+++ b/t/op/split.t
@@ -7,7 +7,7 @@ BEGIN {
set_up_inc('../lib');
}
-plan tests => 161;
+plan tests => 162;
$FS = ':';
@@ -621,3 +621,7 @@ is "@a", '1 2 3', 'assignment to split-to-array (stacked)';
ok eval { $a[0] = 'a'; 1; }, "array split filling AvARRAY: assign 0";
is "@a", "a b", "array split filling AvARRAY: result";
}
+
+fresh_perl_is(<<'CODE', '', {}, "scalar split stack overflow");
+map{int"";split//.0>60for"0000000000000000"}split// for"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+CODE
--
2.1.4
|
This comment has been minimized.
This comment has been minimized.
|
The RT System itself - Status changed from 'new' to 'open' |
This comment has been minimized.
This comment has been minimized.
From @dur-randirCreated by @dur-randirWhile fuzzing perl v5.25.8-207-gcbe2fc5001 built with afl and run @0=s//000000000000000000000000000000000000000000000000000000000000000000000000000000000\000000000000000000000000000000000000000000000000000000000000f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f00000000000000000000000000000000000000000000000000000000000000000000000/; to perform an access outside of an allocated memory slot. ASAN diagnostics are: % ./perl /tmp/0002==18293==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62400000bed8 is located 0 bytes to the right of 7640-byte region SUMMARY: AddressSanitizer: heap-buffer-overflow GDB reports the following program state: Perl Info |
This comment has been minimized.
This comment has been minimized.
From @tonycozOn Sun, 04 Dec 2016 16:58:42 -0800, tonyc wrote:
No comments, so treating as a non-security issue, and moved to the perl5
Applied as 02c161e (with some noise). Tony |
This comment has been minimized.
This comment has been minimized.
|
@tonycoz - Status changed from 'open' to 'pending release' |
This comment has been minimized.
This comment has been minimized.
From @tonycozOn Sat, 14 Jan 2017 14:02:01 -0800, randir wrote:
This looks like a duplicate of #130262, and my fix from that seems to fix this issue. As with that I don't think this is a security issue. Tony |
This comment has been minimized.
This comment has been minimized.
|
The RT System itself - Status changed from 'new' to 'open' |
This comment has been minimized.
This comment has been minimized.
From @tonycozOn Sun, 15 Jan 2017 21:40:27 -0800, tonyc wrote:
No dissent, so merging into 130262. Tony |
This comment has been minimized.
This comment has been minimized.
From @khwilliamsonThank you for filing this report. You have helped make Perl better. With the release today of Perl 5.26.0, this and 210 other issues have been Perl 5.26.0 may be downloaded via: If you find that the problem persists, feel free to reopen this ticket. |
This comment has been minimized.
This comment has been minimized.
|
@khwilliamson - Status changed from 'pending release' to 'resolved' |
Migrated from rt.perl.org#130262 (status was 'resolved')
Searchable as RT130262$