PERL-5.26.1 heap_use_after_free READ of size 8

[p5pRT]

Migrated from rt.perl.org#132615 (status was 'open')

Searchable as RT132615$

[p5pRT]

From sraums2498@gmail.com

=================================================================
==49691==ERROR​: AddressSanitizer​: heap-use-after-free on address 0x60200000d7d0 at pc 0x000001ce62c0 bp 0x7ffe92146f70 sp 0x7ffe92146f60
READ of size 8 at 0x60200000d7d0 thread T0
  #0 0x1ce62bf in Perl_sv_newmortal /home/asan_perl/Documents/perl-5.26.1/sv.c​:9248
  #1 0x1b91a20 in Perl_pp_qr /home/asan_perl/Documents/perl-5.26.1/pp_hot.c​:1902
  #2 0x1b1bc2e in Perl_runops_standard /home/asan_perl/Documents/perl-5.26.1/run.c​:41
  #3 0x9218a5 in S_run_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2519
  #4 0x9218a5 in perl_run /home/asan_perl/Documents/perl-5.26.1/perl.c​:2447
  #5 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #6 0x7f4f182f382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
  #7 0x46c888 in _start (/home/asan_perl/Documents/perl-5.26.1/perl+0x46c888)

0x60200000d7d0 is located 0 bytes inside of 13-byte region [0x60200000d7d0,0x60200000d7dd)
freed by thread T0 here​:
  #0 0x7f4f190972ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
  #1 0x1ccae92 in Perl_sv_clear /home/asan_perl/Documents/perl-5.26.1/sv.c​:6771
  #2 0x1ca0107 in Perl_sv_free2 /home/asan_perl/Documents/perl-5.26.1/sv.c​:7073
  #3 0x4c2b87 in S_SvREFCNT_dec /home/asan_perl/Documents/perl-5.26.1/inline.h​:189
  #4 0x4c2b87 in Perl_op_clear /home/asan_perl/Documents/perl-5.26.1/op.c​:972
  #5 0x4c5553 in Perl_op_free /home/asan_perl/Documents/perl-5.26.1/op.c​:855
  #6 0x85c4b8 in Perl_pmruntime /home/asan_perl/Documents/perl-5.26.1/op.c​:5889
  #7 0x86260c in Perl_bind_match /home/asan_perl/Documents/perl-5.26.1/op.c​:4017
  #8 0xea84a9 in Perl_yyparse /home/asan_perl/Documents/perl-5.26.1/perly.y​:984
  #9 0x90a9bc in S_parse_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2377
  #10 0x90a9bc in perl_parse /home/asan_perl/Documents/perl-5.26.1/perl.c​:1692
  #11 0x46b239 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:121
  #12 0x7f4f182f382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

previously allocated by thread T0 here​:
  #0 0x7f4f19097602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
  #1 0x167dd81 in Perl_safesysmalloc /home/asan_perl/Documents/perl-5.26.1/util.c​:153
  #2 0x1de5477 in Perl_sv_grow /home/asan_perl/Documents/perl-5.26.1/sv.c​:1601
  #3 0x1e8c86f in Perl_sv_setpvn /home/asan_perl/Documents/perl-5.26.1/sv.c​:5003
  #4 0x1e903d0 in Perl_newSVpvn_flags /home/asan_perl/Documents/perl-5.26.1/sv.c​:9285
  #5 0xb916db in S_sublex_start /home/asan_perl/Documents/perl-5.26.1/toke.c​:2380
  #6 0xe17347 in Perl_yylex /home/asan_perl/Documents/perl-5.26.1/toke.c​:8294
  #7 0xe7c7ec in Perl_yyparse /home/asan_perl/Documents/perl-5.26.1/perly.c​:340
  #8 0x90a9bc in S_parse_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2377
  #9 0x90a9bc in perl_parse /home/asan_perl/Documents/perl-5.26.1/perl.c​:1692
  #10 0x46b239 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:121
  #11 0x7f4f182f382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY​: AddressSanitizer​: heap-use-after-free /home/asan_perl/Documents/perl-5.26.1/sv.c​:9248 Perl_sv_newmortal
Shadow bytes around the buggy address​:
  0x0c047fff9aa0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9ab0​: fa fa fa fa fa fa 00 02 fa fa 00 02 fa fa 00 02
  0x0c047fff9ac0​: fa fa 00 02 fa fa fd fd fa fa fd fd fa fa 00 02
  0x0c047fff9ad0​: fa fa 00 02 fa fa 02 fa fa fa fd fd fa fa fd fd
  0x0c047fff9ae0​: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
=>0x0c047fff9af0​: fa fa fd fd fa fa fd fa fa fa[fd]fd fa fa fd fd
  0x0c047fff9b00​: fa fa fd fd fa fa fd fd fa fa 00 02 fa fa 00 02
  0x0c047fff9b10​: fa fa fd fd fa fa fd fa fa fa 00 02 fa fa fd fd
  0x0c047fff9b20​: fa fa 02 fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff9b30​: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff9b40​: fa fa fd fd fa fa fd fd fa fa 06 fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes)​:
  Addressable​: 00
  Partially addressable​: 01 02 03 04 05 06 07
  Heap left redzone​: fa
  Heap right redzone​: fb
  Freed heap region​: fd
  Stack left redzone​: f1
  Stack mid redzone​: f2
  Stack right redzone​: f3
  Stack partial redzone​: f4
  Stack after return​: f5
  Stack use after scope​: f8
  Global redzone​: f9
  Global init order​: f6
  Poisoned by user​: f7
  Container overflow​: fc
  Array cookie​: ac
  Intra object redzone​: bb
  ASan internal​: fe
==49691==ABORTING

--
Regards,
SRAUMS

[p5pRT]

From sraums2498@gmail.com

22

[p5pRT]

From sraums2498@gmail.com

=================================================================
==49691==ERROR​: AddressSanitizer​: heap-use-after-free on address 0x60200000d7d0 at pc 0x000001ce62c0 bp 0x7ffe92146f70 sp 0x7ffe92146f60
READ of size 8 at 0x60200000d7d0 thread T0
  #0 0x1ce62bf in Perl_sv_newmortal /home/asan_perl/Documents/perl-5.26.1/sv.c​:9248
  #1 0x1b91a20 in Perl_pp_qr /home/asan_perl/Documents/perl-5.26.1/pp_hot.c​:1902
  #2 0x1b1bc2e in Perl_runops_standard /home/asan_perl/Documents/perl-5.26.1/run.c​:41
  #3 0x9218a5 in S_run_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2519
  #4 0x9218a5 in perl_run /home/asan_perl/Documents/perl-5.26.1/perl.c​:2447
  #5 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #6 0x7f4f182f382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
  #7 0x46c888 in _start (/home/asan_perl/Documents/perl-5.26.1/perl+0x46c888)

0x60200000d7d0 is located 0 bytes inside of 13-byte region [0x60200000d7d0,0x60200000d7dd)
freed by thread T0 here​:
  #0 0x7f4f190972ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
  #1 0x1ccae92 in Perl_sv_clear /home/asan_perl/Documents/perl-5.26.1/sv.c​:6771
  #2 0x1ca0107 in Perl_sv_free2 /home/asan_perl/Documents/perl-5.26.1/sv.c​:7073
  #3 0x4c2b87 in S_SvREFCNT_dec /home/asan_perl/Documents/perl-5.26.1/inline.h​:189
  #4 0x4c2b87 in Perl_op_clear /home/asan_perl/Documents/perl-5.26.1/op.c​:972
  #5 0x4c5553 in Perl_op_free /home/asan_perl/Documents/perl-5.26.1/op.c​:855
  #6 0x85c4b8 in Perl_pmruntime /home/asan_perl/Documents/perl-5.26.1/op.c​:5889
  #7 0x86260c in Perl_bind_match /home/asan_perl/Documents/perl-5.26.1/op.c​:4017
  #8 0xea84a9 in Perl_yyparse /home/asan_perl/Documents/perl-5.26.1/perly.y​:984
  #9 0x90a9bc in S_parse_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2377
  #10 0x90a9bc in perl_parse /home/asan_perl/Documents/perl-5.26.1/perl.c​:1692
  #11 0x46b239 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:121
  #12 0x7f4f182f382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

previously allocated by thread T0 here​:
  #0 0x7f4f19097602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
  #1 0x167dd81 in Perl_safesysmalloc /home/asan_perl/Documents/perl-5.26.1/util.c​:153
  #2 0x1de5477 in Perl_sv_grow /home/asan_perl/Documents/perl-5.26.1/sv.c​:1601
  #3 0x1e8c86f in Perl_sv_setpvn /home/asan_perl/Documents/perl-5.26.1/sv.c​:5003
  #4 0x1e903d0 in Perl_newSVpvn_flags /home/asan_perl/Documents/perl-5.26.1/sv.c​:9285
  #5 0xb916db in S_sublex_start /home/asan_perl/Documents/perl-5.26.1/toke.c​:2380
  #6 0xe17347 in Perl_yylex /home/asan_perl/Documents/perl-5.26.1/toke.c​:8294
  #7 0xe7c7ec in Perl_yyparse /home/asan_perl/Documents/perl-5.26.1/perly.c​:340
  #8 0x90a9bc in S_parse_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2377
  #9 0x90a9bc in perl_parse /home/asan_perl/Documents/perl-5.26.1/perl.c​:1692
  #10 0x46b239 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:121
  #11 0x7f4f182f382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY​: AddressSanitizer​: heap-use-after-free /home/asan_perl/Documents/perl-5.26.1/sv.c​:9248 Perl_sv_newmortal
Shadow bytes around the buggy address​:
  0x0c047fff9aa0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9ab0​: fa fa fa fa fa fa 00 02 fa fa 00 02 fa fa 00 02
  0x0c047fff9ac0​: fa fa 00 02 fa fa fd fd fa fa fd fd fa fa 00 02
  0x0c047fff9ad0​: fa fa 00 02 fa fa 02 fa fa fa fd fd fa fa fd fd
  0x0c047fff9ae0​: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
=>0x0c047fff9af0​: fa fa fd fd fa fa fd fa fa fa[fd]fd fa fa fd fd
  0x0c047fff9b00​: fa fa fd fd fa fa fd fd fa fa 00 02 fa fa 00 02
  0x0c047fff9b10​: fa fa fd fd fa fa fd fa fa fa 00 02 fa fa fd fd
  0x0c047fff9b20​: fa fa 02 fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff9b30​: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff9b40​: fa fa fd fd fa fa fd fd fa fa 06 fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes)​:
  Addressable​: 00
  Partially addressable​: 01 02 03 04 05 06 07
  Heap left redzone​: fa
  Heap right redzone​: fb
  Freed heap region​: fd
  Stack left redzone​: f1
  Stack mid redzone​: f2
  Stack right redzone​: f3
  Stack partial redzone​: f4
  Stack after return​: f5
  Stack use after scope​: f8
  Global redzone​: f9
  Global init order​: f6
  Poisoned by user​: f7
  Container overflow​: fc
  Array cookie​: ac
  Intra object redzone​: bb
  ASan internal​: fe
==49691==ABORTING

--
Regards,
SRAUMS

[p5pRT]

From sraums2498@gmail.com

22

[p5pRT]

From @hvds

This simplifies to the below. The '$^V .= *^V = ""' is clearly the proximate cause, but I'm also a bit disturbed that !~"" appears to be ok to treat as an lvalue when both !"" and ~"" are disallowed. I may be misunderstanding what it's parsing that as.

% ./miniperl -e '"x" . $x . pack "Wu", qr{}, !"" = "x" . $x . pack "Wu", "", !"" = $^V .= *^V = ""'
ASAN​:SIGSEGV

==8437==ERROR​: AddressSanitizer​: SEGV on unknown address 0x000000000000 (pc 0x000000ddc502 sp 0x7ffee8f28aa0 bp 0x7ffee8f28e30 T0)
  #0 0xddc501 in Perl_sv_setpv_bufsize /src/package/lang/perl/gitperl/sv.c​:4856
  #1 0xcdacf2 in Perl_pp_concat /src/package/lang/perl/gitperl/pp_hot.c​:292
  #2 0xcd10f7 in Perl_runops_standard /src/package/lang/perl/gitperl/run.c​:41
  #3 0x644229 in S_run_body /src/package/lang/perl/gitperl/perl.c​:2730
  #4 0x6421b6 in perl_run /src/package/lang/perl/gitperl/perl.c​:2646
  #5 0x14aa7c8 in main /src/package/lang/perl/gitperl/miniperlmain.c​:128
  #6 0x7f40f3acff44 (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
  #7 0x49947c in _start (/src/package/lang/perl/gitperl/miniperl+0x49947c)

AddressSanitizer can not provide additional info.
SUMMARY​: AddressSanitizer​: SEGV /src/package/lang/perl/gitperl/sv.c​:4856 Perl_sv_setpv_bufsize
==8437==ABORTING
%

Hugo

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @hvds

Dup of rt132615, merging.

Hugo

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @tonycoz

On Sun, 07 Jan 2018 02​:27​:34 -0800, hv wrote​:

This simplifies to the below. The '$^V .= *^V = ""' is clearly the
proximate cause, but I'm also a bit disturbed that !~"" appears to be
ok to treat as an lvalue when both !"" and ~"" are disallowed. I may
be misunderstanding what it's parsing that as.

The !~ is being paused as the !~ operator​:

tony@​mars​:.../git/perl$ ./perl -Ilib -MO=Deparse,-p -e '"x" . $x . pack "Wu", qr{}, !"" = "x" . $x . pack "Wu", "", !"" = $^V .= *^V = ""'
(('x' . $x . (!(pack('Wu', (qr//)) = //))) = (('x' . $x . (!(pack('Wu', '') =~ //))) = ($^V .= (*^V = ''))));

% ./miniperl -e '"x" . $x . pack "Wu", qr{}, !"" = "x" . $x . pack
"Wu", "", !"" = $^V .= *^V = ""'
ASAN​:SIGSEGV

==8437==ERROR​: AddressSanitizer​: SEGV on unknown address
0x000000000000 (pc 0x000000ddc502 sp 0x7ffee8f28aa0 bp 0x7ffee8f28e30
T0)
#0 0xddc501 in Perl_sv_setpv_bufsize
/src/package/lang/perl/gitperl/sv.c​:4856
#1 0xcdacf2 in Perl_pp_concat
/src/package/lang/perl/gitperl/pp_hot.c​:292
#2 0xcd10f7 in Perl_runops_standard
/src/package/lang/perl/gitperl/run.c​:41
#3 0x644229 in S_run_body
/src/package/lang/perl/gitperl/perl.c​:2730
#4 0x6421b6 in perl_run /src/package/lang/perl/gitperl/perl.c​:2646
#5 0x14aa7c8 in main
/src/package/lang/perl/gitperl/miniperlmain.c​:128
#6 0x7f40f3acff44 (/lib/x86_64-linux-gnu/libc.so.6+0x21f44)
#7 0x49947c in _start
(/src/package/lang/perl/gitperl/miniperl+0x49947c)

AddressSanitizer can not provide additional info.
SUMMARY​: AddressSanitizer​: SEGV
/src/package/lang/perl/gitperl/sv.c​:4856 Perl_sv_setpv_bufsize
==8437==ABORTING
%

Hugo

This looks like a stack-not-refcounted bug.

I'll move it to the public queue and link it to the meta-ticket in a few days unless someone objects.

Tony

[p5pRT]

From @hvds

On Sun, 14 Jan 2018 20​:41​:49 -0800, tonyc wrote​:

On Sun, 07 Jan 2018 02​:27​:34 -0800, hv wrote​:

This simplifies to the below. The '$^V .= *^V = ""' is clearly the
proximate cause, but I'm also a bit disturbed that !~"" appears to be
ok to treat as an lvalue when both !"" and ~"" are disallowed. I may
be misunderstanding what it's parsing that as.

The !~ is being paused as the !~ operator​:

tony@​mars​:.../git/perl$ ./perl -Ilib -MO=Deparse,-p -e '"x" . $x .
pack "Wu", qr{}, !"" = "x" . $x . pack "Wu", "", !"" = $^V .= *^V
= ""'
(('x' . $x . (!(pack('Wu', (qr//)) = //))) = (('x' . $x .
(!(pack('Wu', '') =~ //))) = ($^V .= (*^V = ''))));

Ah ok, I thought I'd demonstrated to myself that it couldn't be that, but I must have messed something up.

Hugo