PERL-5.26.1 heap_buffer_overflow READ of size 8

[p5pRT]

Migrated from rt.perl.org#132625 (status was 'open')

Searchable as RT132625$

[p5pRT]

From sraums2498@gmail.com

=================================================================
==3446==ERROR​: AddressSanitizer​: heap-buffer-overflow on address
0x621000000031 at pc 0x0000019ac530 bp 0x7fffe0c56030 sp 0x7fffe0c56020
READ of size 8 at 0x621000000031 thread T0
  #0 0x19ac52f in Perl_hfree_next_entry
/home/asan_perl/Documents/perl-5.26.1/hv.c​:1899
  #1 0x1cc9140 in Perl_sv_clear
/home/asan_perl/Documents/perl-5.26.1/sv.c​:6663
  #2 0x1ca0107 in Perl_sv_free2
/home/asan_perl/Documents/perl-5.26.1/sv.c​:7073
  #3 0x2277eb3 in S_SvREFCNT_dec_NN
/home/asan_perl/Documents/perl-5.26.1/inline.h​:200
  #4 0x2277eb3 in Perl_free_tmps
/home/asan_perl/Documents/perl-5.26.1/scope.c​:212
  #5 0x922624 in perl_run
/home/asan_perl/Documents/perl-5.26.1/perl.c​:2452
  #6 0x46b6a7 in main /home/asan_perl/Documents/perl-5.26.1/perlmain.c​:123
  #7 0x7fa69760482f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
  #8 0x46c888 in _start
(/home/asan_perl/Documents/perl-5.26.1/perl+0x46c888)

AddressSanitizer can not describe address in more detail (wild memory
access suspected).
SUMMARY​: AddressSanitizer​: heap-buffer-overflow
/home/asan_perl/Documents/perl-5.26.1/hv.c​:1899 Perl_hfree_next_entry
Shadow bytes around the buggy address​:
  0x0c427fff7fb0​: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff7fc0​: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff7fd0​: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff7fe0​: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff7ff0​: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fff8000​: fa fa fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa
  0x0c427fff8010​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8020​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8030​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8040​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8050​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes)​:
  Addressable​: 00
  Partially addressable​: 01 02 03 04 05 06 07
  Heap left redzone​: fa
  Heap right redzone​: fb
  Freed heap region​: fd
  Stack left redzone​: f1
  Stack mid redzone​: f2
  Stack right redzone​: f3
  Stack partial redzone​: f4
  Stack after return​: f5
  Stack use after scope​: f8
  Global redzone​: f9
  Global init order​: f6
  Poisoned by user​: f7
  Container overflow​: fc
  Array cookie​: ac
  Intra object redzone​: bb
  ASan internal​: fe
==3446==ABORTING

--
Regards,
SRAUMS

[p5pRT]

From sraums2498@gmail.com

216

[p5pRT]

From @hvds

I can't reproduce this, I get​:
$* is no longer supported. Its use will be fatal in Perl 5.30 at /home/hv/rt132625 line 1.
Use of code point 0xFFFF9DEFFFFEE27F is not allowed; the permissible max is 0x7FFFFFFFFFFFFFFF at /home/hv/rt132625 line 1.

The code and reported stack trace appear to be a minor variation on rt132622.

Hugo

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @tonycoz

On Mon, 08 Jan 2018 13​:30​:49 -0800, hv wrote​:

I can't reproduce this, I get​:
$* is no longer supported. Its use will be fatal in Perl 5.30 at
/home/hv/rt132625 line 1.
Use of code point 0xFFFF9DEFFFFEE27F is not allowed; the permissible
max is 0x7FFFFFFFFFFFFFFF at /home/hv/rt132625 line 1.

The code and reported stack trace appear to be a minor variation on
rt132622.

If you remove the first statement (the pack of ~qr/./) a debugging build produces​:

tony@​mars​:.../git/perl$ ./miniperl ../132625.pl
$* is no longer supported. Its use will be fatal in Perl 5.30 at ../132625.pl line 1.
miniperl​: sv.c​:4856​: Perl_sv_setpv_bufsize​: Assertion `PL_valid_types_PVX[SvTYPE(_svpvx) & SVt_MASK]' failed.
Aborted

Backtrace​:

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@​entry=6) at ../sysdeps/unix/sysv/linux/raise.c​:51
51 ../sysdeps/unix/sysv/linux/raise.c​: No such file or directory.
(gdb) bt
#0 __GI_raise (sig=sig@​entry=6) at ../sysdeps/unix/sysv/linux/raise.c​:51
#1 0x00007ffff5d5b3fa in __GI_abort () at abort.c​:89
#2 0x00007ffff5d52e37 in __assert_fail_base (fmt=<optimized out>,
  assertion=assertion@​entry=0x555555bfa6e0 "PL_valid_types_PVX[SvTYPE(_svpvx) & SVt_MASK]", file=file@​entry=0x555555bf7ae0 "sv.c", line=line@​entry=4856,
  function=function@​entry=0x555555c11180 <__PRETTY_FUNCTION__.18843> "Perl_sv_setpv_bufsize") at assert.c​:92
#3 0x00007ffff5d52ee2 in __GI___assert_fail (
  assertion=assertion@​entry=0x555555bfa6e0 "PL_valid_types_PVX[SvTYPE(_svpvx) & SVt_MASK]", file=file@​entry=0x555555bf7ae0 "sv.c", line=line@​entry=4856,
  function=function@​entry=0x555555c11180 <__PRETTY_FUNCTION__.18843> "Perl_sv_setpv_bufsize") at assert.c​:101
#4 0x000055555592813a in Perl_sv_setpv_bufsize (sv=sv@​entry=0x621000012758,
  cur=cur@​entry=0, len=len@​entry=0) at sv.c​:4856
#5 0x00005555558aaea9 in Perl_pp_concat () at pp_hot.c​:292
#6 0x000055555582b13f in Perl_runops_debug () at dump.c​:2527
#7 0x00005555556ca9bf in S_run_body (oldscope=1) at perl.c​:2728
#8 perl_run (my_perl=<optimized out>) at perl.c​:2649
#9 0x00005555556433ea in main (argc=<optimized out>, argv=<optimized out>,
  env=<optimized out>) at miniperlmain.c​:128

which looks like a stack-not-refcounted issue, as you say.

Tony

[p5pRT]

From @iabyn

On Mon, Jan 22, 2018 at 09​:35​:32PM -0800, Tony Cook via RT wrote​:

On Mon, 08 Jan 2018 13​:30​:49 -0800, hv wrote​:

I can't reproduce this, I get​:
$* is no longer supported. Its use will be fatal in Perl 5.30 at
/home/hv/rt132625 line 1.
Use of code point 0xFFFF9DEFFFFEE27F is not allowed; the permissible
max is 0x7FFFFFFFFFFFFFFF at /home/hv/rt132625 line 1.

The code and reported stack trace appear to be a minor variation on
rt132622.

If you remove the first statement (the pack of ~qr/./) a debugging build produces​:

tony@​mars​:.../git/perl$ ./miniperl ../132625.pl
$* is no longer supported. Its use will be fatal in Perl 5.30 at ../132625.pl line 1.
miniperl​: sv.c​:4856​: Perl_sv_setpv_bufsize​: Assertion `PL_valid_types_PVX[SvTYPE(_svpvx) & SVt_MASK]' failed.
Aborted

Backtrace​:

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@​entry=6) at ../sysdeps/unix/sysv/linux/raise.c​:51
51 ../sysdeps/unix/sysv/linux/raise.c​: No such file or directory.
(gdb) bt
#0 __GI_raise (sig=sig@​entry=6) at ../sysdeps/unix/sysv/linux/raise.c​:51
#1 0x00007ffff5d5b3fa in __GI_abort () at abort.c​:89
#2 0x00007ffff5d52e37 in __assert_fail_base (fmt=<optimized out>,
assertion=assertion@​entry=0x555555bfa6e0 "PL_valid_types_PVX[SvTYPE(_svpvx) & SVt_MASK]", file=file@​entry=0x555555bf7ae0 "sv.c", line=line@​entry=4856,
function=function@​entry=0x555555c11180 <__PRETTY_FUNCTION__.18843> "Perl_sv_setpv_bufsize") at assert.c​:92
#3 0x00007ffff5d52ee2 in __GI___assert_fail (
assertion=assertion@​entry=0x555555bfa6e0 "PL_valid_types_PVX[SvTYPE(_svpvx) & SVt_MASK]", file=file@​entry=0x555555bf7ae0 "sv.c", line=line@​entry=4856,
function=function@​entry=0x555555c11180 <__PRETTY_FUNCTION__.18843> "Perl_sv_setpv_bufsize") at assert.c​:101
#4 0x000055555592813a in Perl_sv_setpv_bufsize (sv=sv@​entry=0x621000012758,
cur=cur@​entry=0, len=len@​entry=0) at sv.c​:4856
#5 0x00005555558aaea9 in Perl_pp_concat () at pp_hot.c​:292
#6 0x000055555582b13f in Perl_runops_debug () at dump.c​:2527
#7 0x00005555556ca9bf in S_run_body (oldscope=1) at perl.c​:2728
#8 perl_run (my_perl=<optimized out>) at perl.c​:2649
#9 0x00005555556433ea in main (argc=<optimized out>, argv=<optimized out>,
env=<optimized out>) at miniperlmain.c​:128

which looks like a stack-not-refcounted issue, as you say.

Agreed, I'll move it to the public queue.

--
Please note that ash-trays are provided for the use of smokers,
whereas the floor is provided for the use of all patrons.
  -- Bill Royston

[p5pRT]

From @tonycoz

On Mon, 09 Apr 2018 09​:04​:48 -0700, davem wrote​:

On Mon, Jan 22, 2018 at 09​:35​:32PM -0800, Tony Cook via RT wrote​:

On Mon, 08 Jan 2018 13​:30​:49 -0800, hv wrote​:

I can't reproduce this, I get​:
$* is no longer supported. Its use will be fatal in Perl 5.30 at
/home/hv/rt132625 line 1.
Use of code point 0xFFFF9DEFFFFEE27F is not allowed; the
permissible
max is 0x7FFFFFFFFFFFFFFF at /home/hv/rt132625 line 1.

The code and reported stack trace appear to be a minor variation on
rt132622.

If you remove the first statement (the pack of ~qr/./) a debugging
build produces​:

tony@​mars​:.../git/perl$ ./miniperl ../132625.pl
$* is no longer supported. Its use will be fatal in Perl 5.30 at
../132625.pl line 1.
miniperl​: sv.c​:4856​: Perl_sv_setpv_bufsize​: Assertion
`PL_valid_types_PVX[SvTYPE(_svpvx) & SVt_MASK]' failed.
Aborted

Backtrace​:

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@​entry=6) at ../sysdeps/unix/sysv/linux/raise.c​:51
51 ../sysdeps/unix/sysv/linux/raise.c​: No such file or
directory.
(gdb) bt
#0 __GI_raise (sig=sig@​entry=6) at
../sysdeps/unix/sysv/linux/raise.c​:51
#1 0x00007ffff5d5b3fa in __GI_abort () at abort.c​:89
#2 0x00007ffff5d52e37 in __assert_fail_base (fmt=<optimized out>,
assertion=assertion@​entry=0x555555bfa6e0
"PL_valid_types_PVX[SvTYPE(_svpvx) & SVt_MASK]",
file=file@​entry=0x555555bf7ae0 "sv.c", line=line@​entry=4856,
function=function@​entry=0x555555c11180
<__PRETTY_FUNCTION__.18843> "Perl_sv_setpv_bufsize") at assert.c​:92
#3 0x00007ffff5d52ee2 in __GI___assert_fail (
assertion=assertion@​entry=0x555555bfa6e0
"PL_valid_types_PVX[SvTYPE(_svpvx) & SVt_MASK]",
file=file@​entry=0x555555bf7ae0 "sv.c", line=line@​entry=4856,
function=function@​entry=0x555555c11180
<__PRETTY_FUNCTION__.18843> "Perl_sv_setpv_bufsize") at assert.c​:101
#4 0x000055555592813a in Perl_sv_setpv_bufsize
(sv=sv@​entry=0x621000012758,
cur=cur@​entry=0, len=len@​entry=0) at sv.c​:4856
#5 0x00005555558aaea9 in Perl_pp_concat () at pp_hot.c​:292
#6 0x000055555582b13f in Perl_runops_debug () at dump.c​:2527
#7 0x00005555556ca9bf in S_run_body (oldscope=1) at perl.c​:2728
#8 perl_run (my_perl=<optimized out>) at perl.c​:2649
#9 0x00005555556433ea in main (argc=<optimized out>,
argv=<optimized out>,
env=<optimized out>) at miniperlmain.c​:128

which looks like a stack-not-refcounted issue, as you say.

Agreed, I'll move it to the public queue.

Now done.

Tony