Segmentation fault in S_do_trans_count #15043

p5pRT · 2015-11-11T03:04:16Z

Migrated from rt.perl.org#126613 (status was 'resolved')

Searchable as RT126613$

p5pRT · 2015-11-11T03:04:16Z

From @dcollinsn

Greetings Porters,

I have compiled bleadperl with the afl-gcc compiler using:

./Configure -Dusedevel -Dprefix='/usr/local/perl-afl' -Dcc='ccache afl-gcc' -Duselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -des
AFL_HARDEN=1 make && make test

And then fuzzed the resulting binary using:

AFL_NO_VAR_CHECK=1 afl-fuzz -i in -o out bin/perl @@

After reducing testcases using `afl-tmin` and performing additional minimization by hand, I have located the following testcase that triggers a segmentation fault. The testcase is the file:

/(?{s0})|(?{s0:})/|s|||eg|y|||

**GDB**

(gdb) run
Starting program: /usr/local/perl-afl/bin/perl -e /$\?\{s0\}$\|$\?\{s0:\}$/\|s\|\|\|eg\|y\|\|\|
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x0000000000bf1604 in S_do_trans_count (sv=0x11a6030) at doop.c:114
114 if (tbl[*s++] >= 0)
(gdb) bt
#0 0x0000000000bf1604 in S_do_trans_count (sv=0x11a6030) at doop.c:114
#1 Perl_do_trans (sv=sv@entry=0x11a6030) at doop.c:645
#2 0x0000000000a30510 in Perl_pp_trans () at pp.c:765
#3 0x00000000007bdf7f in Perl_runops_debug () at dump.c:2224
#4 0x0000000000527fc1 in S_run_body (oldscope=1) at perl.c:2459
#5 perl_run (my_perl=<optimized out>) at perl.c:2382
#6 0x0000000000428b18 in main (argc=3, argv=0x7fffffffe338, env=0x7fffffffe358) at perlmain.c:116
(gdb) info locals
len = 18527264
s = <optimized out>
send = 0x2356a20 <error: Cannot access memory at address 0x2356a20>
matches = <optimized out>
tbl = 0x11c8630

**VALGRIND**

==61036== Memcheck, a memory error detector
==61036== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==61036== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==61036== Command: ../bin/perl -e /(?{s0})|(?{s0:})/|s|||eg|y|||
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF115F: S_do_trans_count (doop.c:114)
==61036== by 0xBF115F: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ad0 is 0 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1394: S_do_trans_count (doop.c:114)
==61036== by 0xBF1394: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ad1 is 1 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF13E4: S_do_trans_count (doop.c:114)
==61036== by 0xBF13E4: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ad2 is 2 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1434: S_do_trans_count (doop.c:114)
==61036== by 0xBF1434: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ad3 is 3 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1484: S_do_trans_count (doop.c:114)
==61036== by 0xBF1484: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ad4 is 4 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF14D4: S_do_trans_count (doop.c:114)
==61036== by 0xBF14D4: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ad5 is 5 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1524: S_do_trans_count (doop.c:114)
==61036== by 0xBF1524: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ad6 is 6 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1578: S_do_trans_count (doop.c:114)
==61036== by 0xBF1578: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ad7 is 7 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1604: S_do_trans_count (doop.c:114)
==61036== by 0xBF1604: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ad8 is 8 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1609: S_do_trans_count (doop.c:114)
==61036== by 0xBF1609: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ad9 is 9 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1611: S_do_trans_count (doop.c:114)
==61036== by 0xBF1611: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ada is 0 bytes after a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1615: S_do_trans_count (doop.c:114)
==61036== by 0xBF1615: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82adb is 1 bytes after a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1625: S_do_trans_count (doop.c:114)
==61036== by 0xBF1625: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82adc is 2 bytes after a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1630: S_do_trans_count (doop.c:114)
==61036== by 0xBF1630: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82add is 3 bytes after a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF163A: S_do_trans_count (doop.c:114)
==61036== by 0xBF163A: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82ade is 4 bytes after a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1646: S_do_trans_count (doop.c:114)
==61036== by 0xBF1646: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Address 0x5f82adf is 5 bytes after a block of size 10 free'd
==61036== at 0x4C28D29: free (vg_replace_malloc.c:530)
==61036== by 0x91B1BC: Perl_sv_clear (sv.c:6610)
==61036== by 0x91CBF7: Perl_sv_free2 (sv.c:6885)
==61036== by 0xAD70D4: S_SvREFCNT_dec_NN (inline.h:177)
==61036== by 0xAD70D4: Perl_free_tmps (scope.c:182)
==61036== by 0x8B03A4: Perl_pp_nextstate (pp_hot.c:52)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0xC85589: S_regmatch (regexec.c:6309)
==61036== by 0xC85589: S_regtry (regexec.c:3518)
==61036== by 0xCE7451: Perl_regexec_flags (regexec.c:3388)
==61036== by 0xB128FE: Perl_pp_substcont (pp_ctl.c:224)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F: malloc (vg_replace_malloc.c:299)
==61036== by 0x7CD6D8: Perl_safesysmalloc (util.c:153)
==61036== by 0x96A4A7: Perl_sv_grow (sv.c:1628)
==61036== by 0x995A73: Perl_sv_setpvn (sv.c:4853)
==61036== by 0x997992: Perl_newSVpvn_flags (sv.c:9089)
==61036== by 0x8E1514: Perl_pp_subst (pp_hot.c:3007)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036==
==61036==
==61036== Process terminating with default action of signal 11 (SIGSEGV)
==61036== Access not within mapped region at address 0x6350000
==61036== at 0xBF1604: S_do_trans_count (doop.c:114)
==61036== by 0xBF1604: Perl_do_trans (doop.c:645)
==61036== by 0xA3050F: Perl_pp_trans (pp.c:765)
==61036== by 0x7BDF7E: Perl_runops_debug (dump.c:2224)
==61036== by 0x527FC0: S_run_body (perl.c:2459)
==61036== by 0x527FC0: perl_run (perl.c:2382)
==61036== by 0x428B17: main (perlmain.c:116)
==61036== If you believe this happened as a result of a stack
==61036== overflow in your program's main thread (unlikely but
==61036== possible), you can try to increase the size of the
==61036== main thread stack using the --main-stacksize= flag.
==61036== The main thread stack size used in this run was 8388608.
==61036==
==61036== HEAP SUMMARY:
==61036== in use at exit: 131,731 bytes in 656 blocks
==61036== total heap usage: 818 allocs, 162 frees, 151,761 bytes allocated
==61036==
==61036== LEAK SUMMARY:
==61036== definitely lost: 320 bytes in 1 blocks
==61036== indirectly lost: 2,599 bytes in 38 blocks
==61036== possibly lost: 0 bytes in 0 blocks
==61036== still reachable: 128,812 bytes in 617 blocks
==61036== suppressed: 0 bytes in 0 blocks
==61036== Rerun with --leak-check=full to see details of leaked memory
==61036==
==61036== For counts of detected and suppressed errors, rerun with: -v
==61036== ERROR SUMMARY: 3986737 errors from 16 contexts (suppressed: 0 from 0)
Segmentation fault

**PERL -V**

dcollins@nightshade64:/usr/local/perl-afl$ ./bin/perl -V
Summary of my perl5 (revision 5 version 23 subversion 5) configuration:
Commit id: 7195e5d
Platform:
osname=linux, osvers=3.16.0-4-amd64, archname=x86_64-linux-ld
uname='linux nightshade64 3.16.0-4-amd64 #1 smp debian 3.16.7-ckt11-1+deb8u4 (2015-09-19) x86_64 gnulinux '
config_args='-Dusedevel -Dprefix=/usr/local/perl-afl -Dcc=ccache afl-gcc -Duselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -DDEBUGGING -DPERL_POISON -des'
hint=recommended, useposix=true, d_sigaction=define
useithreads=undef, usemultiplicity=undef
use64bitint=define, use64bitall=define, uselongdouble=define
usemymalloc=n, bincompat5005=undef
Compiler:
cc='ccache afl-gcc', ccflags ='-fwrapv -DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
optimize='-g',
cppflags='-fwrapv -DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include'
ccversion='', gccversion='5.2.0', gccosandvers=''
intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678, doublekind=3
d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16, longdblkind=3
ivtype='long', ivsize=8, nvtype='long double', nvsize=16, Off_t='off_t', lseeksize=8
alignbytes=16, prototype=define
Linker and Libraries:
ld='ccache afl-gcc', ldflags =' -fstack-protector-strong -L/usr/local/lib'
libpth=/usr/local/lib /usr/local/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/include-fixed /usr/include/x86_64-linux-gnu /usr/lib /lib/x86_64-linux-gnu /lib/../lib /usr/lib/x86_64-linux-gnu /usr/lib/../lib /lib
libs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc
perllibs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc
libc=libc-2.19.so, so=so, useshrplib=false, libperl=libperl.a
gnulibc_version='2.19'
Dynamic Linking:
dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
cccdlflags='-fPIC', lddlflags='-shared -g -L/usr/local/lib -fstack-protector-strong'

Characteristics of this binary (from libperl):
Compile-time options: DEBUGGING HAS_TIMES PERLIO_LAYERS PERL_COPY_ON_WRITE
PERL_DONT_CREATE_GVSV
PERL_HASH_FUNC_ONE_AT_A_TIME_HARD PERL_MALLOC_WRAP
PERL_PRESERVE_IVUV PERL_USE_DEVEL USE_64_BIT_ALL
USE_64_BIT_INT USE_LARGE_FILES USE_LOCALE
USE_LOCALE_COLLATE USE_LOCALE_CTYPE
USE_LOCALE_NUMERIC USE_LOCALE_TIME USE_LONG_DOUBLE
USE_PERLIO USE_PERL_ATOF
Built under linux
Compiled at Oct 22 2015 15:44:40
@INC:
/usr/local/perl-afl/lib/site_perl/5.23.5/x86_64-linux-ld
/usr/local/perl-afl/lib/site_perl/5.23.5
/usr/local/perl-afl/lib/5.23.5/x86_64-linux-ld
/usr/local/perl-afl/lib/5.23.5
/usr/local/perl-afl/lib/site_perl/5.23.4
/usr/local/perl-afl/lib/site_perl
.

p5pRT · 2015-11-16T04:52:20Z

From @ap

* Dan Collins <perlbug-followup@perl.org> [2015-11-11 04:05]:

/(?{s0})|(?{s0:})/|s|||eg|y|||

This does not reproduce on 5.16.1.

The general form turns out to be

/(?{ 'string' })|(?{ LABEL: })/ | s///eg | y///

Removing the /e on the substitution causes it to throw an exception that
terminates the program before it crashes:

Can't coerce UNKNOWN to string in substitution (s///) at t.pl line 1.

Putting an eval{} around the substitution to prevent the exception from
terminating the program reveals that it goes on to crash just as before.
So this error message is likely pointing out (half of) the culprit.

p5pRT · 2015-11-16T04:52:21Z

The RT System itself - Status changed from 'new' to 'open'

p5pRT · 2015-11-16T05:30:42Z

From @khwilliamson

On 11/15/2015 09:51 PM, Aristotle Pagaltzis wrote:

* Dan Collins <perlbug-followup@perl.org> [2015-11-11 04:05]:

/(?{s0})|(?{s0:})/|s|||eg|y|||

This does not reproduce on 5.16.1.

The general form turns out to be
 /$?\{ 'string' \}$|$?\{ LABEL&#8203;: \}$/ | s///eg | y///
Removing the /e on the substitution causes it to throw an exception that
terminates the program before it crashes:
 Can't coerce UNKNOWN to string in substitution $s///$ at t\.pl line 1\.
Putting an eval{} around the substitution to prevent the exception from
terminating the program reveals that it goes on to crash just as before.
So this error message is likely pointing out (half of) the culprit.

I bisected this with this result:
There are only 'skip'ped commits left to test.
The first bad commit could be any of:
81ed78b
b0812ba
We cannot bisect more!
bisect run cannot continue any more
Died at ../blead/Porting/bisect.pl line 267.
That took 863 seconds.

The first commit is
commit 81ed78b
Author: David Mitchell <davem@iabyn.com>
Date: Fri May 4 16:34:01 2012 +0100

make calling of /(?{}) code blocks correct
....

The second is
commit b0812ba
Author: David Mitchell <davem@iabyn.com>
Date: Tue Jun 5 22:29:23 2012 +0100

make perl build again on non-DEBUGGING builds

The PL_block_type debugging-only array is now used indeirectly in
ext/re/re-exec.c, which enables debugging even on non-debugging builds

p5pRT · 2017-03-30T08:51:10Z

@iabyn - Status changed from 'open' to 'resolved'

p5pRT · 2017-03-30T08:51:22Z

From @iabyn

On Sun, Nov 15, 2015 at 10:29:55PM -0700, Karl Williamson wrote:

On 11/15/2015 09:51 PM, Aristotle Pagaltzis wrote:
* Dan Collins <perlbug-followup@perl.org> [2015-11-11 04:05]:

/(?{s0})|(?{s0:})/|s|||eg|y|||

This does not reproduce on 5.16.1.

The general form turns out to be
 /$?\{ 'string' \}$|$?\{ LABEL&#8203;: \}$/ | s///eg | y///
Removing the /e on the substitution causes it to throw an exception that
terminates the program before it crashes:
 Can't coerce UNKNOWN to string in substitution $s///$ at t\.pl line 1\.
Putting an eval{} around the substitution to prevent the exception from
terminating the program reveals that it goes on to crash just as before.
So this error message is likely pointing out (half of) the culprit.
I bisected this with this result:
There are only 'skip'ped commits left to test.
The first bad commit could be any of:
81ed78b
b0812ba
We cannot bisect more!
bisect run cannot continue any more
Died at ../blead/Porting/bisect.pl line 267.
That took 863 seconds.

The first commit is
commit 81ed78b
Author: David Mitchell <davem@iabyn.com>
Date: Fri May 4 16:34:01 2012 +0100
 make calling of /$?\{\}$ code blocks correct
 \.\.\.\.
The second is
commit b0812ba
Author: David Mitchell <davem@iabyn.com>
Date: Tue Jun 5 22:29:23 2012 +0100
 make perl build again on non\-DEBUGGING builds

 The PL\_block\_type debugging\-only array is now used indeirectly in
 ext/re/re\-exec\.c\, which enables debugging even on non\-debugging builds

The problem appears to have gone away in 5.23.8, so I'll close this
ticket. The fix bisects to

commit 1dfbe6b
Author: David Mitchell <davem@iabyn.com>
Date: Sat Jul 11 14:42:56 2015 +0100

add old_tmpsfloor field to CXt_SUB context frame

Rather than saving and restoring PL_tmps_floor on subroutine entry/exit
by using SAVETMPS and the save stack, store the old value directly
in the context struct and make PUSHSUB/POPSUB handle the saving and
restoring.

--
Art is anything that has a label (especially if the label is "untitled 1")

p5pRT closed this as completed Mar 30, 2017

p5pRT added the Severity Low label Oct 19, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Segmentation fault in S_do_trans_count #15043

Segmentation fault in S_do_trans_count #15043

p5pRT commented Nov 11, 2015

p5pRT commented Nov 11, 2015

p5pRT commented Nov 16, 2015

p5pRT commented Nov 16, 2015

p5pRT commented Nov 16, 2015

p5pRT commented Mar 30, 2017

p5pRT commented Mar 30, 2017

Segmentation fault in S_do_trans_count #15043

Segmentation fault in S_do_trans_count #15043

Comments

p5pRT commented Nov 11, 2015

p5pRT commented Nov 11, 2015

From @dcollinsn

p5pRT commented Nov 16, 2015

From @ap

p5pRT commented Nov 16, 2015

p5pRT commented Nov 16, 2015

From @khwilliamson

p5pRT commented Mar 30, 2017

p5pRT commented Mar 30, 2017

From @iabyn