PERL-5.26.1 heap_use_after_free READ of size 8

[p5pRT]

Migrated from rt.perl.org#132622 (status was 'open')

Searchable as RT132622$

[p5pRT]

From sraums2498@gmail.com

=================================================================
==50426==ERROR​: AddressSanitizer​: heap-use-after-free on address 0x60300000d0c8 at pc 0x000001cda604 bp 0x7ffc859ff070 sp 0x7ffc859ff060
READ of size 8 at 0x60300000d0c8 thread T0
  #0 0x1cda603 in Perl_sv_clear /home/asan_perl/Documents/perl-5.26.1/sv.c​:6678
  #1 0x1ca0107 in Perl_sv_free2 /home/asan_perl/Documents/perl-5.26.1/sv.c​:7073
  #2 0x2277eb3 in S_SvREFCNT_dec_NN /home/asan_perl/Documents/perl-5.26.1/inline.h​:200
  #3 0x2277eb3 in Perl_free_tmps /home/asan_perl/Documents/perl-5.26.1/scope.c​:212
  #4 0x922624 in perl_run /home/asan_perl/Documents/perl-5.26.1/perl.c​:2452
  #5 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #6 0x7f238bb2b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
  #7 0x46c888 in _start (/home/asan_perl/Documents/perl-5.26.1/perl+0x46c888)

0x60300000d0c8 is located 8 bytes inside of 24-byte region [0x60300000d0c0,0x60300000d0d8)
freed by thread T0 here​:
  #0 0x7f238c8cf2ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
  #1 0x1ccae92 in Perl_sv_clear /home/asan_perl/Documents/perl-5.26.1/sv.c​:6771
  #2 0x1ca0107 in Perl_sv_free2 /home/asan_perl/Documents/perl-5.26.1/sv.c​:7073
  #3 0x2277eb3 in S_SvREFCNT_dec_NN /home/asan_perl/Documents/perl-5.26.1/inline.h​:200
  #4 0x2277eb3 in Perl_free_tmps /home/asan_perl/Documents/perl-5.26.1/scope.c​:212
  #5 0x922624 in perl_run /home/asan_perl/Documents/perl-5.26.1/perl.c​:2452
  #6 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #7 0x7f238bb2b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

previously allocated by thread T0 here​:
  #0 0x7f238c8cf961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
  #1 0x1681118 in Perl_safesysrealloc /home/asan_perl/Documents/perl-5.26.1/util.c​:274
  #2 0x1de47d6 in Perl_sv_grow /home/asan_perl/Documents/perl-5.26.1/sv.c​:1598
  #3 0x1f26bb4 in Perl_sv_catpvn_flags /home/asan_perl/Documents/perl-5.26.1/sv.c​:5521
  #4 0x1f2d6c2 in Perl_sv_catsv_flags /home/asan_perl/Documents/perl-5.26.1/sv.c​:5582
  #5 0x1df11dc in Perl_sv_2pv_flags /home/asan_perl/Documents/perl-5.26.1/sv.c​:3177
  #6 0x1e8eb64 in Perl_sv_copypv_flags /home/asan_perl/Documents/perl-5.26.1/sv.c​:3249
  #7 0x176f904 in Perl_magic_get /home/asan_perl/Documents/perl-5.26.1/mg.c​:1110
  #8 0x17491ba in Perl_mg_get /home/asan_perl/Documents/perl-5.26.1/mg.c​:201
  #9 0x1da42c6 in Perl_sv_setsv_flags /home/asan_perl/Documents/perl-5.26.1/sv.c​:4459
  #10 0x1b28e2f in Perl_pp_sassign /home/asan_perl/Documents/perl-5.26.1/pp_hot.c​:226
  #11 0x1b1bc2e in Perl_runops_standard /home/asan_perl/Documents/perl-5.26.1/run.c​:41
  #12 0x9218a5 in S_run_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2519
  #13 0x9218a5 in perl_run /home/asan_perl/Documents/perl-5.26.1/perl.c​:2447
  #14 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #15 0x7f238bb2b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY​: AddressSanitizer​: heap-use-after-free /home/asan_perl/Documents/perl-5.26.1/sv.c​:6678 Perl_sv_clear
Shadow bytes around the buggy address​:
  0x0c067fff99c0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff99d0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff99e0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff99f0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9a00​: fa fa fa fa fa fa fd fd fd fa fa fa 00 00 00 fa
=>0x0c067fff9a10​: fa fa fd fd fd fa fa fa fd[fd]fd fa fa fa 00 00
  0x0c067fff9a20​: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x0c067fff9a30​: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
  0x0c067fff9a40​: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
  0x0c067fff9a50​: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x0c067fff9a60​: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes)​:
  Addressable​: 00
  Partially addressable​: 01 02 03 04 05 06 07
  Heap left redzone​: fa
  Heap right redzone​: fb
  Freed heap region​: fd
  Stack left redzone​: f1
  Stack mid redzone​: f2
  Stack right redzone​: f3
  Stack partial redzone​: f4
  Stack after return​: f5
  Stack use after scope​: f8
  Global redzone​: f9
  Global init order​: f6
  Poisoned by user​: f7
  Container overflow​: fc
  Array cookie​: ac
  Intra object redzone​: bb
  ASan internal​: fe
==50426==ABORTING

--
Regards,
SRAUMS

[p5pRT]

From sraums2498@gmail.com

116

[p5pRT]

From sraums2498@gmail.com

=================================================================
==3296==ERROR​: AddressSanitizer​: heap-buffer-overflow on address 0x60300000d088 at pc 0x000001cdb438 bp 0x7ffd771664d0 sp 0x7ffd771664c0
READ of size 8 at 0x60300000d088 thread T0
  #0 0x1cdb437 in Perl_sv_clear /home/asan_perl/Documents/perl-5.26.1/sv.c​:6820
  #1 0x1ca0107 in Perl_sv_free2 /home/asan_perl/Documents/perl-5.26.1/sv.c​:7073
  #2 0x2277eb3 in S_SvREFCNT_dec_NN /home/asan_perl/Documents/perl-5.26.1/inline.h​:200
  #3 0x2277eb3 in Perl_free_tmps /home/asan_perl/Documents/perl-5.26.1/scope.c​:212
  #4 0x922624 in perl_run /home/asan_perl/Documents/perl-5.26.1/perl.c​:2452
  #5 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #6 0x7f1c7dd4682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
  #7 0x46c888 in _start (/home/asan_perl/Documents/perl-5.26.1/perl+0x46c888)

0x60300000d088 is located 8 bytes to the left of 32-byte region [0x60300000d090,0x60300000d0b0)
allocated by thread T0 here​:
  #0 0x7f1c7eaea602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
  #1 0x167dd81 in Perl_safesysmalloc /home/asan_perl/Documents/perl-5.26.1/util.c​:153
  #2 0x1adf2d0 in Perl_av_extend_guts /home/asan_perl/Documents/perl-5.26.1/av.c​:186
  #3 0x1aed221 in Perl_av_extend /home/asan_perl/Documents/perl-5.26.1/av.c​:80
  #4 0x1aed221 in Perl_av_store /home/asan_perl/Documents/perl-5.26.1/av.c​:355
  #5 0x186239e in S_mro_get_linear_isa_dfs /home/asan_perl/Documents/perl-5.26.1/mro_core.c​:260
  #6 0x1870900 in Perl_mro_get_linear_isa /home/asan_perl/Documents/perl-5.26.1/mro_core.c​:413
  #7 0x1892bab in Perl_mro_isa_changed_in /home/asan_perl/Documents/perl-5.26.1/mro_core.c​:652
  #8 0x18ad65f in Perl_mro_package_moved /home/asan_perl/Documents/perl-5.26.1/mro_core.c​:877
  #9 0x462350 in S_glob_assign_glob /home/asan_perl/Documents/perl-5.26.1/sv.c​:3977
  #10 0x1daef0f in Perl_sv_setsv_flags /home/asan_perl/Documents/perl-5.26.1/sv.c​:4464
  #11 0x1b28e2f in Perl_pp_sassign /home/asan_perl/Documents/perl-5.26.1/pp_hot.c​:226
  #12 0x1b1bc2e in Perl_runops_standard /home/asan_perl/Documents/perl-5.26.1/run.c​:41
  #13 0x9218a5 in S_run_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2519
  #14 0x9218a5 in perl_run /home/asan_perl/Documents/perl-5.26.1/perl.c​:2447
  #15 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #16 0x7f1c7dd4682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY​: AddressSanitizer​: heap-buffer-overflow /home/asan_perl/Documents/perl-5.26.1/sv.c​:6820 Perl_sv_clear
Shadow bytes around the buggy address​:
  0x0c067fff99c0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff99d0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff99e0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff99f0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9a00​: fd fd fd fa fa fa 00 00 00 fa fa fa fd fd fd fa
=>0x0c067fff9a10​: fa[fa]00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
  0x0c067fff9a20​: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x0c067fff9a30​: 00 00 00 00 fa fa fd fd fd fd fa fa 00 00 00 00
  0x0c067fff9a40​: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa fd fd
  0x0c067fff9a50​: fd fd fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
  0x0c067fff9a60​: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes)​:
  Addressable​: 00
  Partially addressable​: 01 02 03 04 05 06 07
  Heap left redzone​: fa
  Heap right redzone​: fb
  Freed heap region​: fd
  Stack left redzone​: f1
  Stack mid redzone​: f2
  Stack right redzone​: f3
  Stack partial redzone​: f4
  Stack after return​: f5
  Stack use after scope​: f8
  Global redzone​: f9
  Global init order​: f6
  Poisoned by user​: f7
  Container overflow​: fc
  Array cookie​: ac
  Intra object redzone​: bb
  ASan internal​: fe
==3296==ABORTING

--
Regards,
SRAUMS

[p5pRT]

From sraums2498@gmail.com

209

[p5pRT]

From @hvds

This reduces to​:
  ./miniperl -e '$* ^= *​: = ** = *​: = $\ = *^ = ""'
with the same stack trace. As another stack refcount/glob mashing case, I don't plan to investigate further.

Hugo

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @hvds

This has the same stack trace as rt132622, I'll merge them.

Hugo

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'