PERL-5.26.1 heap_buffer_overflow READ of size 1

[p5pRT]

Migrated from rt.perl.org#132623 (status was 'open')

Searchable as RT132623$

[p5pRT]

From sraums2498@gmail.com

=================================================================
==2913==ERROR​: AddressSanitizer​: heap-buffer-overflow on address 0x60c000009f3f at pc 0x000001c93850 bp 0x7ffd00696000 sp 0x7ffd00695ff0
READ of size 1 at 0x60c000009f3f thread T0
  #0 0x1c9384f in Perl_sv_backoff /home/asan_perl/Documents/perl-5.26.1/sv.c​:1519
  #1 0x1de399f in Perl_sv_grow /home/asan_perl/Documents/perl-5.26.1/sv.c​:1554
  #2 0x1f26bb4 in Perl_sv_catpvn_flags /home/asan_perl/Documents/perl-5.26.1/sv.c​:5521
  #3 0x1b34119 in Perl_pp_concat /home/asan_perl/Documents/perl-5.26.1/pp_hot.c​:316
  #4 0x1b1bc2e in Perl_runops_standard /home/asan_perl/Documents/perl-5.26.1/run.c​:41
  #5 0x9218a5 in S_run_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2519
  #6 0x9218a5 in perl_run /home/asan_perl/Documents/perl-5.26.1/perl.c​:2447
  #7 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #8 0x7f599810182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
  #9 0x46c888 in _start (/home/asan_perl/Documents/perl-5.26.1/perl+0x46c888)

0x60c000009f3f is located 1 bytes to the left of 120-byte region [0x60c000009f40,0x60c000009fb8)
allocated by thread T0 here​:
  #0 0x7f5998ea579a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
  #1 0x168f668 in Perl_safesyscalloc /home/asan_perl/Documents/perl-5.26.1/util.c​:442
  #2 0x19b3089 in S_hv_auxinit /home/asan_perl/Documents/perl-5.26.1/hv.c​:2145
  #3 0x19b3089 in Perl_hv_iterinit /home/asan_perl/Documents/perl-5.26.1/hv.c​:2205
  #4 0x18a9f65 in Perl_mro_package_moved /home/asan_perl/Documents/perl-5.26.1/mro_core.c​:858
  #5 0x462350 in S_glob_assign_glob /home/asan_perl/Documents/perl-5.26.1/sv.c​:3977
  #6 0x1daef0f in Perl_sv_setsv_flags /home/asan_perl/Documents/perl-5.26.1/sv.c​:4464
  #7 0x1b28e2f in Perl_pp_sassign /home/asan_perl/Documents/perl-5.26.1/pp_hot.c​:226
  #8 0x1b1bc2e in Perl_runops_standard /home/asan_perl/Documents/perl-5.26.1/run.c​:41
  #9 0x9218a5 in S_run_body /home/asan_perl/Documents/perl-5.26.1/perl.c​:2519
  #10 0x9218a5 in perl_run /home/asan_perl/Documents/perl-5.26.1/perl.c​:2447
  #11 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #12 0x7f599810182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY​: AddressSanitizer​: heap-buffer-overflow /home/asan_perl/Documents/perl-5.26.1/sv.c​:1519 Perl_sv_backoff
Shadow bytes around the buggy address​:
  0x0c187fff9390​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fff93a0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fff93b0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fff93c0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c187fff93d0​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c187fff93e0​: fa fa fa fa fa fa fa[fa]00 00 00 00 00 00 00 00
  0x0c187fff93f0​: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
  0x0c187fff9400​: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c187fff9410​: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c187fff9420​: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c187fff9430​: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes)​:
  Addressable​: 00
  Partially addressable​: 01 02 03 04 05 06 07
  Heap left redzone​: fa
  Heap right redzone​: fb
  Freed heap region​: fd
  Stack left redzone​: f1
  Stack mid redzone​: f2
  Stack right redzone​: f3
  Stack partial redzone​: f4
  Stack after return​: f5
  Stack use after scope​: f8
  Global redzone​: f9
  Global init order​: f6
  Poisoned by user​: f7
  Container overflow​: fc
  Array cookie​: ac
  Intra object redzone​: bb
  ASan internal​: fe
==2913==ABORTING

--
Regards,
SRAUMS

[p5pRT]

From sraums2498@gmail.com

205

[p5pRT]

From @hvds

This one reduces to​:
  ./miniperl -e '$T .= *​: = *T = "*main​::"'
with the same backtrace. I don't plan to investigate further.

Hugo

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @iabyn

On Mon, Jan 08, 2018 at 01​:21​:13PM -0800, Hugo van der Sanden via RT wrote​:

This one reduces to​:
./miniperl -e '$T .= *​: = *T = "*main​::"'
with the same backtrace. I don't plan to investigate further.

Its another stack-not-refcounted issue.

I'll move it to the perl5 queue.

--
"Foul and greedy Dwarf - you have eaten the last candle."
  -- "Hordes of the Things", BBC Radio.

[p5pRT]

From @tonycoz

On Mon, 09 Apr 2018 08​:48​:35 -0700, davem wrote​:

On Mon, Jan 08, 2018 at 01​:21​:13PM -0800, Hugo van der Sanden via RT wrote​:

This one reduces to​:
./miniperl -e '$T .= *​: = *T = "*main​::"'
with the same backtrace. I don't plan to investigate further.

Its another stack-not-refcounted issue.

I'll move it to the perl5 queue.

Now done.

Tony