PERL-5.26.1 heap_buffer_overflow READ of size 8

[p5pRT]

Migrated from rt.perl.org#132613 (status was 'open')

Searchable as RT132613$

[p5pRT]

From sraums2498@gmail.com

=================================================================
==50512==ERROR​: AddressSanitizer​: heap-buffer-overflow on address 0x60400000d9b0 at pc 0x000001a4f710 bp 0x7ffcc9667b40 sp 0x7ffcc9667b30
READ of size 8 at 0x60400000d9b0 thread T0
  #0 0x1a4f70f in Perl_hv_common /home/asan_perl/Documents/perl-5.26.1/hv.c​:637
  #1 0x1a57ccf in Perl_hv_common_key_len /home/asan_perl/Documents/perl-5.26.1/hv.c​:333
  #2 0xa96c14 in Perl_gv_override /home/asan_perl/Documents/perl-5.26.1/gv.c​:3681
  #3 0x6b9a3e in Perl_ck_require /home/asan_perl/Documents/perl-5.26.1/op.c​:10966
  #4 0x5e9e49 in Perl_newUNOP /home/asan_perl/Documents/perl-5.26.1/op.c​:5093
  #5 0xe99ae5 in Perl_yyparse /home/asan_perl/Documents/perl-5.26.1/perly.y​:1170
  #6 0x22f7ca5 in S_doeval_compile /home/asan_perl/Documents/perl-5.26.1/pp_ctl.c​:3432
  #7 0x24be9e3 in Perl_pp_entereval /home/asan_perl/Documents/perl-5.26.1/pp_ctl.c​:4391
  #8 0x89c265 in Perl_eval_sv /home/asan_perl/Documents/perl-5.26.1/perl.c​:2962
  #9 0x8a2587 in Perl_require_pv /home/asan_perl/Documents/perl-5.26.1/perl.c​:3069
  #10 0x9f2e69 in Perl_gv_fetchmethod_pvn_flags /home/asan_perl/Documents/perl-5.26.1/gv.c​:1102
  #11 0x9f94da in Perl_gv_fetchmethod_sv_flags /home/asan_perl/Documents/perl-5.26.1/gv.c​:996
  #12 0x1c5f57f in Perl_pp_method_named /home/asan_perl/Documents/perl-5.26.1/pp_hot.c​:4527
  #13 0x1b1bc2e in Perl_runops_standard /home/asan_perl/Documents/perl-5.26.1/run.c​:41
  #14 0x9218a5 in S_run_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2519
  #15 0x9218a5 in perl_run /home/asan_perl/Documents/perl-5.26.1/perl.c​:2447
  #16 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #17 0x7fd45fd5b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
  #18 0x46c888 in _start (/home/asan_perl/Documents/perl-5.26.1/perl+0x46c888)

0x60400000d9b6 is located 0 bytes to the right of 38-byte region [0x60400000d990,0x60400000d9b6)
allocated by thread T0 here​:
  #0 0x7fd460aff602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
  #1 0x167dd81 in Perl_safesysmalloc /home/asan_perl/Documents/perl-5.26.1/util.c​:153
  #2 0x196726f in S_share_hek_flags /home/asan_perl/Documents/perl-5.26.1/hv.c​:3030
  #3 0x19d2567 in Perl_share_hek /home/asan_perl/Documents/perl-5.26.1/hv.c​:2978
  #4 0x19d2567 in Perl_hv_name_set /home/asan_perl/Documents/perl-5.26.1/hv.c​:2357
  #5 0x97a198 in S_parse_gv_stash_name /home/asan_perl/Documents/perl-5.26.1/gv.c​:1656
  #6 0x97a198 in Perl_gv_fetchpvn_flags /home/asan_perl/Documents/perl-5.26.1/gv.c​:2346
  #7 0x8ff1cf in S_init_main_stash /home/asan_perl/Documents/perl-5.26.1/perl.c​:3758
  #8 0x8ff1cf in S_parse_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:1929
  #9 0x8ff1cf in perl_parse /home/asan_perl/Documents/perl-5.26.1/perl.c​:1692
  #10 0x46b239 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:121
  #11 0x7fd45fd5b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY​: AddressSanitizer​: heap-buffer-overflow /home/asan_perl/Documents/perl-5.26.1/hv.c​:637 Perl_hv_common
Shadow bytes around the buggy address​:
  0x0c087fff9ae0​: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff9af0​: fa fa 00 00 00 00 00 02 fa fa 00 00 00 00 07 fa
  0x0c087fff9b00​: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
  0x0c087fff9b10​: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
  0x0c087fff9b20​: fa fa 00 00 00 00 00 06 fa fa fd fd fd fd fd fd
=>0x0c087fff9b30​: fa fa 00 00 00 00[06]fa fa fa fd fd fd fd fd fa
  0x0c087fff9b40​: fa fa 00 00 00 00 04 fa fa fa fd fd fd fd fd fa
  0x0c087fff9b50​: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 03 fa
  0x0c087fff9b60​: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 03 fa
  0x0c087fff9b70​: fa fa 00 00 00 00 03 fa fa fa 00 00 00 00 00 00
  0x0c087fff9b80​: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 03 fa
Shadow byte legend (one shadow byte represents 8 application bytes)​:
  Addressable​: 00
  Partially addressable​: 01 02 03 04 05 06 07
  Heap left redzone​: fa
  Heap right redzone​: fb
  Freed heap region​: fd
  Stack left redzone​: f1
  Stack mid redzone​: f2
  Stack right redzone​: f3
  Stack partial redzone​: f4
  Stack after return​: f5
  Stack use after scope​: f8
  Global redzone​: f9
  Global init order​: f6
  Poisoned by user​: f7
  Container overflow​: fc
  Array cookie​: ac
  Intra object redzone​: bb
  ASan internal​: fe
==50512==ABORTING

--
Regards,
SRAUMS

[p5pRT]

From sraums2498@gmail.com

119

[p5pRT]

From sraums2498@gmail.com

=================================================================
==50512==ERROR​: AddressSanitizer​: heap-buffer-overflow on address 0x60400000d9b0 at pc 0x000001a4f710 bp 0x7ffcc9667b40 sp 0x7ffcc9667b30
READ of size 8 at 0x60400000d9b0 thread T0
  #0 0x1a4f70f in Perl_hv_common /home/asan_perl/Documents/perl-5.26.1/hv.c​:637
  #1 0x1a57ccf in Perl_hv_common_key_len /home/asan_perl/Documents/perl-5.26.1/hv.c​:333
  #2 0xa96c14 in Perl_gv_override /home/asan_perl/Documents/perl-5.26.1/gv.c​:3681
  #3 0x6b9a3e in Perl_ck_require /home/asan_perl/Documents/perl-5.26.1/op.c​:10966
  #4 0x5e9e49 in Perl_newUNOP /home/asan_perl/Documents/perl-5.26.1/op.c​:5093
  #5 0xe99ae5 in Perl_yyparse /home/asan_perl/Documents/perl-5.26.1/perly.y​:1170
  #6 0x22f7ca5 in S_doeval_compile /home/asan_perl/Documents/perl-5.26.1/pp_ctl.c​:3432
  #7 0x24be9e3 in Perl_pp_entereval /home/asan_perl/Documents/perl-5.26.1/pp_ctl.c​:4391
  #8 0x89c265 in Perl_eval_sv /home/asan_perl/Documents/perl-5.26.1/perl.c​:2962
  #9 0x8a2587 in Perl_require_pv /home/asan_perl/Documents/perl-5.26.1/perl.c​:3069
  #10 0x9f2e69 in Perl_gv_fetchmethod_pvn_flags /home/asan_perl/Documents/perl-5.26.1/gv.c​:1102
  #11 0x9f94da in Perl_gv_fetchmethod_sv_flags /home/asan_perl/Documents/perl-5.26.1/gv.c​:996
  #12 0x1c5f57f in Perl_pp_method_named /home/asan_perl/Documents/perl-5.26.1/pp_hot.c​:4527
  #13 0x1b1bc2e in Perl_runops_standard /home/asan_perl/Documents/perl-5.26.1/run.c​:41
  #14 0x9218a5 in S_run_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2519
  #15 0x9218a5 in perl_run /home/asan_perl/Documents/perl-5.26.1/perl.c​:2447
  #16 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #17 0x7fd45fd5b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
  #18 0x46c888 in _start (/home/asan_perl/Documents/perl-5.26.1/perl+0x46c888)

0x60400000d9b6 is located 0 bytes to the right of 38-byte region [0x60400000d990,0x60400000d9b6)
allocated by thread T0 here​:
  #0 0x7fd460aff602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
  #1 0x167dd81 in Perl_safesysmalloc /home/asan_perl/Documents/perl-5.26.1/util.c​:153
  #2 0x196726f in S_share_hek_flags /home/asan_perl/Documents/perl-5.26.1/hv.c​:3030
  #3 0x19d2567 in Perl_share_hek /home/asan_perl/Documents/perl-5.26.1/hv.c​:2978
  #4 0x19d2567 in Perl_hv_name_set /home/asan_perl/Documents/perl-5.26.1/hv.c​:2357
  #5 0x97a198 in S_parse_gv_stash_name /home/asan_perl/Documents/perl-5.26.1/gv.c​:1656
  #6 0x97a198 in Perl_gv_fetchpvn_flags /home/asan_perl/Documents/perl-5.26.1/gv.c​:2346
  #7 0x8ff1cf in S_init_main_stash /home/asan_perl/Documents/perl-5.26.1/perl.c​:3758
  #8 0x8ff1cf in S_parse_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:1929
  #9 0x8ff1cf in perl_parse /home/asan_perl/Documents/perl-5.26.1/perl.c​:1692
  #10 0x46b239 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:121
  #11 0x7fd45fd5b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY​: AddressSanitizer​: heap-buffer-overflow /home/asan_perl/Documents/perl-5.26.1/hv.c​:637 Perl_hv_common
Shadow bytes around the buggy address​:
  0x0c087fff9ae0​: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff9af0​: fa fa 00 00 00 00 00 02 fa fa 00 00 00 00 07 fa
  0x0c087fff9b00​: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
  0x0c087fff9b10​: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
  0x0c087fff9b20​: fa fa 00 00 00 00 00 06 fa fa fd fd fd fd fd fd
=>0x0c087fff9b30​: fa fa 00 00 00 00[06]fa fa fa fd fd fd fd fd fa
  0x0c087fff9b40​: fa fa 00 00 00 00 04 fa fa fa fd fd fd fd fd fa
  0x0c087fff9b50​: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 03 fa
  0x0c087fff9b60​: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 03 fa
  0x0c087fff9b70​: fa fa 00 00 00 00 03 fa fa fa 00 00 00 00 00 00
  0x0c087fff9b80​: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 03 fa
Shadow byte legend (one shadow byte represents 8 application bytes)​:
  Addressable​: 00
  Partially addressable​: 01 02 03 04 05 06 07
  Heap left redzone​: fa
  Heap right redzone​: fb
  Freed heap region​: fd
  Stack left redzone​: f1
  Stack mid redzone​: f2
  Stack right redzone​: f3
  Stack partial redzone​: f4
  Stack after return​: f5
  Stack use after scope​: f8
  Global redzone​: f9
  Global init order​: f6
  Poisoned by user​: f7
  Container overflow​: fc
  Array cookie​: ac
  Intra object redzone​: bb
  ASan internal​: fe
==50512==ABORTING

--
Regards,
SRAUMS

[p5pRT]

From sraums2498@gmail.com

119

[p5pRT]

From @hvds

This reduces to​:
./miniperl -e '*^V = "*main​::"; 1 for Y $\ = $\ = $~ = *\ = $\ = *^ = %^V = *^V'

.. which looks like another glob-assignment/stack-refcounting issue. I don't plan to investigate further.

SRAUMS JN​: it would be helpful if you could run afl-tmin over your test cases before submitting them (checking that the reduced case shows the same crash, of course) - there's quite a lot of garbage in some of these test cases that is a bit laborious to strip out manually.

Hugo

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @hvds

This is a dup of 132613, merging.

Hugo

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @tonycoz

On Sat, 06 Jan 2018 10​:02​:59 -0800, hv wrote​:

This reduces to​:
./miniperl -e '*^V = "*main​::"; 1 for Y $\ = $\ = $~ = *\ = $\ = *^ =
%^V = *^V'

.. which looks like another glob-assignment/stack-refcounting issue. I
don't plan to investigate further.

I think so too, moved to the public queue and linked to the meta ticket.

Tony