Null pointer dereference in Perl_pp_multiconcat #16468
Comments
From jeremy@feusi.coCreated by jeremy@feusi.coReply-To: jeremy@feusi.co This is a bug report for perl from jeremy@feusi.co, ----------------------------------------------------------------- Detailed backtrace: ASAN:DEADLYSIGNAL==9327==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000c (pc 0x00000084e5f2 bp 0x7ffeed336030 sp 0x7ffeed335a40 T0) AddressSanitizer can not provide additional info. This bug was found with honggfuzz and asan. Perl Info |
From jeremy@feusi.co#!./perl |
|
Looks like this has been fixed: Ran out of time to dig deeper or bisect. Can do so at the weekend, unless someone wants to beat me to it. |
|
Looks like it was fixed by 4e521aa |
|
the first release for 4e521aa is v5.29.8 |
|
On Thu, Oct 24, 2019 at 04:53:11PM -0700, Richard Leach wrote:
Looks like this has been fixed:
```
This is perl 5, version 30, subversion 0 (v5.30.0) built for MSWin32-x64-multi-thread
C:\fldr>perl fzz.pl
A
A
A
```
```
This is perl 5, version 28, subversion 1 (v5.28.1) built for x86_64-linux-gnu-thread-multi
***@***.***:~# perl fzz.pl
A
A
A
```
Ran out of time to dig deeper or bisect. Can do so at the weekend, unless someone wants to beat me to it.
It's not fixed, but its only an issue on non-threaded builds. The bug can
be exhibited without using multiconcat, e.g.
my $A= "";
"" =~ m/(?{ my $x; })/;
my $s;
sub f { $s =~ s//foo/ }
f();
It's because the empty pattern in the s/// causes the last successful
pattern to be used instead, which is the earlier m//. This is called with
PL_curcop still pointing to f's pad, so the lookup of $x in the current
pad retrieves a random pointer value off the end of f's pad.
It's basically a problem with the empty pattern misfeature . Needs fixing
at some point.
…--
31 Dec 1661: "I have newly taken a solemne oath about abstaining from plays".
1 Jan 1662: "And after ... we went by coach to the play".
-- The Diary of Samuel Pepys
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Migrated from rt.perl.org#132991 (status was 'new')
Searchable as RT132991$
The text was updated successfully, but these errors were encountered: