From frank.wiegand@gmail.com

Created by frank.wiegand@gmail.com

If @​INC contains a coderef that returns a list- or hashref, perl crashes​:

% perl -e 'push @​INC, sub { \[] }; require doesnotexist'
*** glibc detected *** perl​: double free or corruption (out)​: 0x0000000001e18c40 ***
======= Backtrace​: =========
/lib/libc.so.6[0x7ffe594f06c8]
/lib/libc.so.6(cfree+0x76)[0x7ffe594f21d6]
/usr/lib/libperl.so.5.10(Perl_sv_clear+0x715)[0x7ffe59f2fc45]
/usr/lib/libperl.so.5.10(Perl_sv_free2+0x52)[0x7ffe59f2fdf2]
/usr/lib/libperl.so.5.10[0x7ffe59f5423d]
/usr/lib/libperl.so.5.10[0x7ffe59eb70d1]
/usr/lib/libperl.so.5.10(Perl_yylex+0x354a)[0x7ffe59ebd93a]
/usr/lib/libperl.so.5.10(Perl_yyparse+0x458)[0x7ffe59ecacf8]
/usr/lib/libperl.so.5.10[0x7ffe59f51280]
/usr/lib/libperl.so.5.10(Perl_pp_require+0xefb)[0x7ffe59f536cb]
/usr/lib/libperl.so.5.10(Perl_runops_standard+0x12)[0x7ffe59f1b142]
/usr/lib/libperl.so.5.10(perl_run+0x30f)[0x7ffe59f1640f]
perl(main+0xdc)[0x400d2c]
/lib/libc.so.6(__libc_start_main+0xe6)[0x7ffe5949d5c6]
perl[0x400b89]
======= Memory map​: ========
00400000-00401000 r-xp 00000000 08​:04 9683764 /usr/bin/perl
00601000-00602000 rw-p 00001000 08​:04 9683764 /usr/bin/perl
01e14000-01e56000 rw-p 00000000 00​:00 0 [heap]
7ffe54000000-7ffe54021000 rw-p 00000000 00​:00 0
7ffe54021000-7ffe58000000 ---p 00000000 00​:00 0
7ffe5902d000-7ffe59047000 r-xp 00000000 08​:04 16482386 /lib/libgcc_s.so.1
7ffe59047000-7ffe59246000 ---p 0001a000 08​:04 16482386 /lib/libgcc_s.so.1
7ffe59246000-7ffe59247000 rw-p 00019000 08​:04 16482386 /lib/libgcc_s.so.1
7ffe59247000-7ffe5924f000 r-xp 00000000 08​:04 13500596 /lib/libcrypt-2.9.so
7ffe5924f000-7ffe5944f000 ---p 00008000 08​:04 13500596 /lib/libcrypt-2.9.so
7ffe5944f000-7ffe59450000 r--p 00008000 08​:04 13500596 /lib/libcrypt-2.9.so
7ffe59450000-7ffe59451000 rw-p 00009000 08​:04 13500596 /lib/libcrypt-2.9.so
7ffe59451000-7ffe5947f000 rw-p 00000000 00​:00 0
7ffe5947f000-7ffe595c6000 r-xp 00000000 08​:04 13500594 /lib/libc-2.9.so
7ffe595c6000-7ffe597c6000 ---p 00147000 08​:04 13500594 /lib/libc-2.9.so
7ffe597c6000-7ffe597ca000 r--p 00147000 08​:04 13500594 /lib/libc-2.9.so
7ffe597ca000-7ffe597cb000 rw-p 0014b000 08​:04 13500594 /lib/libc-2.9.so
7ffe597cb000-7ffe597d0000 rw-p 00000000 00​:00 0
7ffe597d0000-7ffe597e6000 r-xp 00000000 08​:04 13500449 /lib/libpthread-2.9.so
7ffe597e6000-7ffe599e5000 ---p 00016000 08​:04 13500449 /lib/libpthread-2.9.so
7ffe599e5000-7ffe599e6000 r--p 00015000 08​:04 13500449 /lib/libpthread-2.9.so
7ffe599e6000-7ffe599e7000 rw-p 00016000 08​:04 13500449 /lib/libpthread-2.9.so
7ffe599e7000-7ffe599eb000 rw-p 00000000 00​:00 0
7ffe599eb000-7ffe59a6d000 r-xp 00000000 08​:04 13500526 /lib/libm-2.9.so
7ffe59a6d000-7ffe59c6c000 ---p 00082000 08​:04 13500526 /lib/libm-2.9.so
7ffe59c6c000-7ffe59c6d000 r--p 00081000 08​:04 13500526 /lib/libm-2.9.so
7ffe59c6d000-7ffe59c6e000 rw-p 00082000 08​:04 13500526 /lib/libm-2.9.so
7ffe59c6e000-7ffe59c70000 r-xp 00000000 08​:04 13500754 /lib/libdl-2.9.so
7ffe59c70000-7ffe59e70000 ---p 00002000 08​:04 13500754 /lib/libdl-2.9.so
7ffe59e70000-7ffe59e71000 r--p 00002000 08​:04 13500754 /lib/libdl-2.9.so
7ffe59e71000-7ffe59e72000 rw-p 00003000 08​:04 13500754 /lib/libdl-2.9.so
7ffe59e72000-7ffe59fd4000 r-xp 00000000 08​:04 9654813 /usr/lib/libperl.so.5.10.0
7ffe59fd4000-7ffe5a1d4000 ---p 00162000 08​:04 9654813 /usr/lib/libperl.so.5.10.0
7ffe5a1d4000-7ffe5a1dd000 rw-p 00162000 08​:04 9654813 /usr/lib/libperl.so.5.10.0
7ffe5a1dd000-7ffe5a1fa000 r-xp 00000000 08​:04 13500593 /lib/ld-2.9.so
7ffe5a290000-7ffe5a3d2000 r--p 00000000 08​:04 9670145 /usr/lib/locale/locale-archive
7ffe5a3d2000-7ffe5a3d6000 rw-p 00000000 00​:00 0
7ffe5a3f6000-7ffe5a3f9000 rw-p 00000000 00​:00 0
7ffe5a3f9000-7ffe5a3fa000 r--p 0001c000 08​:04 13500593 /lib/ld-2.9.so
7ffe5a3fa000-7ffe5a3fb000 rw-p 0001d000 08​:04 13500593 /lib/ld-2.9.so
7fffd7b1b000-7fffd7b30000 rw-p 00000000 00​:00 0 [stack]
7fffd7bff000-7fffd7c00000 r-xp 00000000 00​:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00​:00 0 [vsyscall]
zsh​: abort perl -e 'push @​INC, sub { \[] }; require doesnotexist'

bleadperl (f03173f) crashes too​:

% bleadperl -e 'push @​INC, sub { \[] }; require doesnotexist'
bleadperl​: pp_ctl.c​:4875​: S_run_user_filter​: Zusicherung »!((cache)->sv_flags & 0x00000800) || !(*({ SV *const _svrv = ((SV *)({ void *_p = (cache); _p; })); ((((svtype)((_svrv)->sv_flags & 0xff)) >= SVt_PV || ((svtype)((_svrv)->sv_flags & 0xff)) == SVt_IV) ? (void) (0) : __assert_fail ("((svtype)((_svrv)->sv_flags & 0xff)) >= SVt_PV || ((svtype)((_svrv)->sv_flags & 0xff)) == SVt_IV", "pp_ctl.c", 4875, __PRETTY_FUNCTION__)); ((((svtype)((_svrv)->sv_flags & 0xff)) != SVt_PVAV) ? (void) (0) : __assert_fail ("((svtype)((_svrv)->sv_flags & 0xff)) != SVt_PVAV", "pp_ctl.c", 4875, __PRETTY_FUNCTION__)); ((((svtype)((_svrv)->sv_flags & 0xff)) != SVt_PVHV) ? (void) (0) : __assert_fail ("((svtype)((_svrv)->sv_flags & 0xff)) != SVt_PVHV", "pp_ctl.c", 4875, __PRETTY_FUNCTION__)); ((((svtype)((_svrv)->sv_flags & 0xff)) != SVt_PVCV) ? (void) (0) : __assert_fail ("((svtype)((_svrv)->sv_flags & 0xff)) != SVt_PVCV", "pp_ctl.c", 4875, __PRETTY_FUNCTION__)); ((((svtype)((_svrv)->sv_flags & 0xff)) != SVt_PVFM) ? (void) (0) : __assert_fail ("((svtype)((_svrv)->sv_flags & 0xff)) != SVt_PVFM", "pp_ctl.c", 4875, __PRETTY_FUNCTION__)); ((!((((_svrv)->sv_flags & (0x00004000|0x00008000)) == 0x00008000) && (((svtype)((_svrv)->sv_flags & 0xff)) == SVt_PVGV || ((svtype)((_svrv)->sv_flags & 0xff)) == SVt_PVLV))) ? (void) (0) : __assert_fail ("!((((_svrv)->sv_flags & (0x00004000|0x00008000)) == 0x00008000) && (((svtype)((_svrv)->sv_flags & 0xff)) == SVt_PVGV || ((svtype)((_svrv)->sv_flags & 0xff)) == SVt_PVLV))", "pp_ctl.c", 4875, __PRETTY_FUNCTION__)); &((_svrv)->sv_u.svu_rv); }))« nicht erfüllt.
zsh​: abort bleadperl -e 'push @​INC, sub { \[] }; require doesnotexist'

perl5.11.0 does *not* crash but gives a wrong error message​:

% perl5.11.0 -e 'push @​INC, sub { \[] }; require doesnotexist'
Undefined subroutine &main​::ARRAY called at /loader/0xf05230/doesnotexist.pm line 1.
Compilation failed in require at -e line 1.

Thanks, Frank

Flags:
    category=core
    severity=low

Site configuration information for perl 5.10.0:

Configured by Debian Project at Sun Aug 16 22:38:40 UTC 2009.

Summary of my perl5 (revision 5 version 10 subversion 0) configuration:
  Platform:
    osname=linux, osvers=2.6.18-xen-3.1-1-amd64, archname=x86_64-linux-gnu-thread-multi
    uname='linux nautilus 2.6.18-xen-3.1-1-amd64 #1 smp fri oct 19 23:35:59 cest 2007 x86_64 gnulinux '
    config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN -Dcccdlflags=-fPIC -Darchname=x86_64-linux-gnu -Dprefix=/usr -Dprivlib=/usr/share/perl/5.10 -Darchlib=/usr/lib/perl/5.10 -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5 -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local -Dsitelib=/usr/local/share/perl/5.10.0 -Dsitearch=/usr/local/lib/perl/5.10.0 -Dman1dir=/usr/share/man/man1 -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1 -Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Ud_ualarm -Uusesfio -Uusenm -DDEBUGGING=-g -Doptimize=-O2 -Duseshrplib -Dlibperl=libperl.so.5.10.0 -Dd_dosuid -des'
    hint=recommended, useposix=true, d_sigaction=define
    useithreads=define, usemultiplicity=define
    useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
    use64bitint=define, use64bitall=define, uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
    optimize='-O2 -g',
    cppflags='-D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fno-strict-aliasing -pipe -I/usr/local/include'
    ccversion='', gccversion='4.3.4', gccosandvers=''
    intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
    ivtype='long', ivsize=8, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
    alignbytes=8, prototype=define
  Linker and Libraries:
    ld='cc', ldflags =' -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib /lib64 /usr/lib64
    libs=-lgdbm -lgdbm_compat -ldb -ldl -lm -lpthread -lc -lcrypt
    perllibs=-ldl -lm -lpthread -lc -lcrypt
    libc=/lib/libc-2.9.so, so=so, useshrplib=true, libperl=libperl.so.5.10.0
    gnulibc_version='2.9'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
    cccdlflags='-fPIC', lddlflags='-shared -O2 -g -L/usr/local/lib'

Locally applied patches:
    


@INC for perl 5.10.0:
    /etc/perl
    /usr/local/lib/perl/5.10.0
    /usr/local/share/perl/5.10.0
    /usr/lib/perl5
    /usr/share/perl5
    /usr/lib/perl/5.10
    /usr/share/perl/5.10
    /usr/local/lib/site_perl
    .


Environment for perl 5.10.0:
    HOME=/home/fw
    LANG=de_DE.UTF-8
    LANGUAGE=
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
    PATH=/sbin:/usr/sbin:/home/fw/bin:/home/fw/bin:/usr/local/bin:/usr/bin:/bin:/usr/games
    PERL_AUTOINSTALL=--defaultdeps
    PERL_BADLANG (unset)
    PERL_EXTUTILS_AUTOINSTALL=--defaultdeps
    PERL_MM_USE_DEFAULT=1
    SHELL=/bin/zsh

From zefram@fysh.org

Frank Wiegand wrote​:

If @​INC contains a coderef that returns a list- or hashref, perl crashes​:

% perl -e 'push @​INC, sub { \[] }; require doesnotexist'

That's not returning an arrayref, it's returning a *ref*ref. Returning an
arrayref works sensibly​:

$ perl -e 'push @​INC, sub { [] }; require doesnotexist'
Can't locate doesnotexist.pm in @​INC (@​INC contains​: /etc/perl /usr/local/lib/perl/5.10.0 /usr/local/share/perl/5.10.0 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.10 /usr/share/perl/5.10 /usr/local/lib/site_perl . CODE(0x973a780)) at -e line 1.

Of course, the crash with a refref is still a bug.

-zefram

The RT System itself - Status changed from 'new' to 'open'

From zefram@fysh.org

No longer crashes since v5.19.1-66-g9b7d778. Ticket can be closed.

-zefram

@iabyn - Status changed from 'open' to 'resolved'