From @geeknik

Triggered with Perl v5.25.7-94-gc9b6887 while fuzzing with AFL.

od -tx1 test11
0000000 69 20 61 20 66 7b 7b 7b 61 7b 7b 7b 7b 7b 7b 7b
0000020 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b
0000040 7b 5f 00 54 20 69 20 61 20 61 7b 7b 7b 7b 7b 7b
0000060 7b 7b 7b 7b 61 7b 7b 7b 7b 7b 7b 7b 7b 7b 5b 7b
0000100 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b
*
0000140 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 7b 61 20 66
0000157

==23007==ERROR​: AddressSanitizer​: heap-buffer-overflow on address
0x62300000fa08 at pc 0x0000006bc406 bp 0x7ffd024e9950 sp 0x7ffd024e9948
WRITE of size 2 at 0x62300000fa08 thread T0
  #0 0x6bc405 in Perl_yyparse /root/perl/perly.c​:403​:13
  #1 0x59bf51 in S_parse_body /root/perl/perl.c​:2374​:9
  #2 0x5921d0 in perl_parse /root/perl/perl.c​:1689​:2
  #3 0x4de6b5 in main /root/perl/perlmain.c​:121​:18
  #4 0x7f24e029eb44 in __libc_start_main
/build/glibc-daoqzt/glibc-2.19/csu/libc-start.c​:287
  #5 0x4de34c in _start (/root/perl/perl+0x4de34c)

0x62300000fa08 is located 8 bytes to the right of 6400-byte region
[0x62300000e100,0x62300000fa00)
allocated by thread T0 here​:
  #0 0x4c0ccb in malloc (/root/perl/perl+0x4c0ccb)
  #1 0x7fbe27 in Perl_safesysmalloc /root/perl/util.c​:153​:21
  #2 0x59bf51 in S_parse_body /root/perl/perl.c​:2374​:9
  #3 0x5921d0 in perl_parse /root/perl/perl.c​:1689​:2
  #4 0x4de6b5 in main /root/perl/perlmain.c​:121​:18
  #5 0x7f24e029eb44 in __libc_start_main
/build/glibc-daoqzt/glibc-2.19/csu/libc-start.c​:287

SUMMARY​: AddressSanitizer​: heap-buffer-overflow /root/perl/perly.c​:403
Perl_yyparse
Shadow bytes around the buggy address​:
  0x0c467fff9ef0​: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff9f00​: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff9f10​: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff9f20​: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c467fff9f30​: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c467fff9f40​: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c467fff9f50​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c467fff9f60​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c467fff9f70​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c467fff9f80​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c467fff9f90​: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes)​:
  Addressable​: 00
  Partially addressable​: 01 02 03 04 05 06 07
  Heap left redzone​: fa
  Heap right redzone​: fb
  Freed heap region​: fd
  Stack left redzone​: f1
  Stack mid redzone​: f2
  Stack right redzone​: f3
  Stack partial redzone​: f4
  Stack after return​: f5
  Stack use after scope​: f8
  Global redzone​: f9
  Global init order​: f6
  Poisoned by user​: f7
  Container overflow​: fc
  ASan internal​: fe
==23007==ABORTING

From @geeknik

test11.gz

From @iabyn

On Sat, Dec 10, 2016 at 10​:07​:58AM -0800, Brian Carpenter wrote​:

Triggered with Perl v5.25.7-94-gc9b6887 while fuzzing with AFL.

This was recently introduced by my own stupidity with v5.25.7-60-gb2c9b6e;
now reverted with v5.25.7-98-gdf13534.

Since it hasn't been in a release, its not a security issue :-).

--
The warp engines start playing up a bit, but seem to sort themselves out
after a while without any intervention from boy genius Wesley Crusher.
  -- Things That Never Happen in "Star Trek" #17

The RT System itself - Status changed from 'new' to 'open'

From @tonycoz

On Sat, 10 Dec 2016 12​:21​:51 -0800, davem wrote​:

On Sat, Dec 10, 2016 at 10​:07​:58AM -0800, Brian Carpenter wrote​:

Triggered with Perl v5.25.7-94-gc9b6887 while fuzzing with AFL.

This was recently introduced by my own stupidity with v5.25.7-60-gb2c9b6e;
now reverted with v5.25.7-98-gdf13534.

So closing...

Since it hasn't been in a release, its not a security issue :-).

... after moving it to the public queue.

Tony

@tonycoz - Status changed from 'open' to 'pending release'

From @khwilliamson

Thank you for filing this report. You have helped make Perl better.

With the release today of Perl 5.26.0, this and 210 other issues have been
resolved.

Perl 5.26.0 may be downloaded via​:
https://metacpan.org/release/XSAWYERX/perl-5.26.0

If you find that the problem persists, feel free to reopen this ticket.

@khwilliamson - Status changed from 'pending release' to 'resolved'