From chenresig@karma.afterthought.org

I've been developping some binary testing software and ran into the most
annoying bug. Previously when sending input via stdin, I just had an ugly
system("cat <file_with_input> | program"); (cat because the input was too
large to fit in the environment via echo).

When we got more interested in performance, I switched to an open('program',
"|program") model (2 execs less, and no maintenance of files!). This sped
things up but I ran into a problem where I get coredumps.

If a program exceeds a certain run-time, I kill it. I've got an alarm set,
and in the $SIG{ALRM} handler I close the filehandle, because if I just
return(), it continues to hang on the print.. however, when I close this
filehandle, perl segfaults.

This may not be the best way to do it, if you can suggest a better way, I'm all
ears. If this is fixed through a patch, please notify me so I can get back
to speed!

(gdb) bt
#0 0x54ebc in Perl_my_pclose ()
#1 0x96ad4 in Perl_io_close ()
#2 0x96a58 in Perl_do_close ()
#3 0x891d8 in Perl_pp_close ()
#4 0x9d5d8 in Perl_runops_standard ()
#5 0x26a54 in perl_call_sv ()
#6 0x5a360 in Perl_sighandler ()
#7 <signal handler called>
#8 0xff217fc4 in _waitid () from /usr/lib/libc.so.1
#9 0xff1d7010 in _waitpid () from /usr/lib/libc.so.1
#10 0x550e0 in Perl_wait4pid ()
#11 0x54f38 in Perl_my_pclose ()
#12 0x96ad4 in Perl_io_close ()
#13 0x96a58 in Perl_do_close ()
#14 0x891d8 in Perl_pp_close ()
#15 0x9d5d8 in Perl_runops_standard ()
#16 0x26170 in perl_run ()
#17 0x23ce0 in main ()

This problem can be reproduced with the following code​:

#!/usr/bin/perl
# sample code to coredump perl5.0052/5.0053
# tested under Solaris 7, FreeBSD 4.0, and OpenBSD 2.6
# crashes at close(program);

# (gdb) bt
# #0 0x54ebc in Perl_my_pclose ()
# #1 0x96ad4 in Perl_io_close ()
# #2 0x96a58 in Perl_do_close ()
# #3 0x891d8 in Perl_pp_close ()

$SIG{ALRM} = \&sigalrm;
$| = 1;
$program = "/bin/pax";

while(1) {
  alarm 2;
  open('program', "|$program") ||
  die("Cant open pipe to $program");
  print(program "testdata");
  close('program');
  alarm 0;
  print("no coredump, we succeeded!\n");

}
sub sigalrm {
  print("SIGALRM caught during test. About to close old filehandle.\n\n");
  close(program); # we close here, otherwise pipe hangs
  return;
}

Site configuration information for perl 5.00503:

Configured by markm at $Date$.

Summary of my perl5 (5.0 patchlevel 5 subversion 3) configuration:
  Platform:
    osname=freebsd, osvers=4.0-current, archname=i386-freebsd
    uname='freebsd freefall.freebsd.org 4.0-current freebsd 4.0-current #0: $Date$'
    hint=recommended, useposix=true, d_sigaction=define
    usethreads=undef useperlio=undef d_sfio=undef
  Compiler:
    cc='cc', optimize='undef', gccversion=egcs-2.91.66 19990314 (egcs-1.1.2 release)
    cppflags=''
    ccflags =''
    stdchar='char', d_stdstdio=undef, usevfork=true
    intsize=4, longsize=4, ptrsize=4, doublesize=8
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    alignbytes=4, usemymalloc=n, prototype=define
  Linker and Libraries:
    ld='cc', ldflags ='-Wl,-E'
    libpth=/usr/lib
    libs=-lm -lc -lcrypt
    libc=/usr/lib/libc.so, so=so, useshrplib=true, libperl=libperl.so.3
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags=' '
    cccdlflags='-DPIC -fpic', lddlflags='-shared'

Locally applied patches:
    


@INC for perl 5.00503:
    /usr/libdata/perl/5.00503/mach
    /usr/libdata/perl/5.00503
    /usr/local/lib/perl5/site_perl/5.005/i386-freebsd
    /usr/local/lib/perl5/site_perl/5.005
    .


Environment for perl 5.00503:
    HOME=/home/chenresig
    LANG (unset)
    LANGUAGE (unset)
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
    PATH=/usr/local/jdk1.1.8/bin:/usr/local/bin:/usr/local/sbin:/bin:/sbin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/usr/local/scripts
    PERL_BADLANG (unset)
    SHELL=/usr/local/bin/zsh