AddressSanitizer: SEGV on unknown address 0x618df5f5f678 in S_opmethod_stash #15914
Comments
From mtowalski@pentest.net.plHello, I've attached the poc and the asan log. Configure options: “./Configure -des -Dusedevel -DDEBUGGING -Dcc=clang -Doptimize=-O2 -Accflags="-fsanitize=address -fsanitize-coverage=edge" -Aldflags="-fsanitize=address -fsanitize-coverage=edge" -Alddlflags=-shared" Information about configuration: Distributor ID: Ubuntu ps. last crash from this round of fuzzing Best Regards, |
From mtowalski@pentest.net.pl/usr/bin/llvm-symbolizer
|
From @arcvia RT <perl5-security-report@perl.org> wrote:
Reduction: $ ./miniperl -e 'goto X; meth {X:}'
|
From @arc0001-RT-130936-segfault-on-goto-into-empty-invocant-block.patchFrom d3b18bad523a65512801ee0e9a8d1a78d5bb4755 Mon Sep 17 00:00:00 2001
From: Aaron Crane <arc@cpan.org>
Date: Mon, 6 Mar 2017 18:10:34 +0000
Subject: [PATCH] RT#130936: segfault on goto into empty invocant block
---
pp_hot.c | 10 +++++++---
t/op/method.t | 9 ++++++++-
2 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/pp_hot.c b/pp_hot.c
index 58bbe2f1e9..ae31281ca9 100644
--- a/pp_hot.c
+++ b/pp_hot.c
@@ -4398,15 +4398,19 @@ S_opmethod_stash(pTHX_ SV* meth)
{
SV* ob;
HV* stash;
+ SV* sv;
+
+ PERL_ARGS_ASSERT_OPMETHOD_STASH;
- SV* const sv = PL_stack_base + TOPMARK == PL_stack_sp
+ if (PL_markstack_ptr <= PL_markstack)
+ goto undefined; /* No mark on stack */
+
+ sv = PL_stack_base + TOPMARK == PL_stack_sp
? (Perl_croak(aTHX_ "Can't call method \"%" SVf "\" without a "
"package or object reference", SVfARG(meth)),
(SV *)NULL)
: *(PL_stack_base + TOPMARK + 1);
- PERL_ARGS_ASSERT_OPMETHOD_STASH;
-
if (UNLIKELY(!sv))
undefined:
Perl_croak(aTHX_ "Can't call method \"%" SVf "\" on an undefined value",
diff --git a/t/op/method.t b/t/op/method.t
index ef181c4ce0..e3d4428b20 100644
--- a/t/op/method.t
+++ b/t/op/method.t
@@ -13,7 +13,7 @@ BEGIN {
use strict;
no warnings 'once';
-plan(tests => 151);
+plan(tests => 152);
@A::ISA = 'B';
@B::ISA = 'C';
@@ -711,6 +711,13 @@ fresh_perl_is('eval { {}->$x }; print $@;',
{},
"no crash with undef method name on unblessed ref");
+# RT#130936: segfault on goto into invocant block with no mark on stack
+fresh_perl_is('goto X; meth {X: }',
+ qq/Use of "goto" to jump into a construct is deprecated at - line 1.\n/.
+ qq/Can't call method "meth" on an undefined value at - line 1./,
+ {},
+ "no segfault on goto into invocant block");
+
__END__
#FF9900
#F78C08
--
2.11.0
|
|
The RT System itself - Status changed from 'new' to 'open' |
From @iabynOn Mon, Mar 06, 2017 at 06:20:48PM +0000, Aaron Crane wrote:
Unless I'm misreading that, I don't think the patch really fixes the
Agreed.
Given my reservations above, lets not!
IIUC, what really needs to happen is for goto, whenever it notices that's
(In http://nntp.perl.org/group/perl.perl5.porters/242200)
+1 I propose we move this ticket to the public queue for any further -- |
From @arcDave Mitchell <davem@iabyn.com> wrote:
Ah. This is presumably where it becomes apparent that I don't fully
OK. In the light of your concerns about the approach my patch takes, I
Seconded. -- |
From @iabynOn Fri, Mar 17, 2017 at 05:07:35PM +0000, Aaron Crane wrote:
Now moved. -- |
From @cpansproutFixed in 6d90e98. The cases that would crash are now forbidden. -- Father Chrysostomos |
|
@cpansprout - Status changed from 'open' to 'pending release' |
From @khwilliamsonThank you for filing this report. You have helped make Perl better. With the release yesterday of Perl 5.28.0, this and 185 other issues have been Perl 5.28.0 may be downloaded via: If you find that the problem persists, feel free to reopen this ticket. |
|
@khwilliamson - Status changed from 'pending release' to 'resolved' |
Migrated from rt.perl.org#130936 (status was 'resolved')
Searchable as RT130936$
The text was updated successfully, but these errors were encountered: