panic: sv_chop on multiple ^* formats on one line #14255
Comments
From x.fix@o2.plCreated by x.fix@o2.plWhen the ^* format tries to write while multiple ^* formats are on the Sample code: ``` Result: ``` Perl Info |
From @cpansproutOn Tue Nov 18 11:50:39 2014, x.fix@o2.pl wrote:
5.8.7 to 5.14.4: Modification of a read-only value attempted at - line 3. 5.18.3: panic: sv_chop ptr=7f94bbc0bdd2, start=10518ce45, end=10518ce45 at - line 3. Both answers are wrong. So this has been buggy for a long time. -- Father Chrysostomos |
|
The RT System itself - Status changed from 'new' to 'open' |
From @TuxOn Tue, 18 Nov 2014 11:50:39 -0800, Konrad Borowski (via RT)
Confirmed for all perl builds as of 5.8.4 === base/perl5.6.0 5.006 x86_64-linux -- |
From @tonycozOn Tue Nov 18 13:22:50 2014, sprout wrote:
Bisected with: perl ../bisect.pl --start=perl-5.8.0 --end=perl-5.10..0 --target=miniperl -- ./miniperl ../format-crash.pl to: a1b9506 is the first bad commit format/write (version 2) |
From @tonycozOn Tue Nov 18 11:50:39 2014, x.fix@o2.pl wrote:
Candidate fix attached. I still need to write some tests. Tony |
From @tonycoz0001-perl-123245-avoid-a-panic-in-sv_chop-in-formats.patchFrom ffd87e202ed6b9c8d1f3b8888a980f6690a3bfa7 Mon Sep 17 00:00:00 2001
From: Tony Cook <tony@develop-help.com>
Date: Tue, 2 Dec 2014 11:44:31 +1100
Subject: [perl #123245] avoid a panic in sv_chop() in formats
This fixes two issues:
1) if you don't supply enough arguments to the format, pp_formline()
uses &PL_sv_no as the sv, since we've already warned about the
missing format argument, we don't need to produce a read only error
for an SV the caller didn't supply
2) when the supplied string is empty for FF_LINESNGL and FF_LINEGLOB
the case would skip most of its processing, including setting
chophere, this meant that when the following FF_CHOP operator was
processed it would pass a pointer into a different string, producing
a panic.
---
pp_ctl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/pp_ctl.c b/pp_ctl.c
index 0b7a6ec..dc80999 100644
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -674,7 +674,7 @@ PP(pp_formline)
goto append;
case FF_CHOP: /* (for ^*) chop the current item */
- {
+ if (sv != &PL_sv_no) {
const char *s = chophere;
if (chopspace) {
while (isSPACE(*s))
@@ -701,11 +701,11 @@ PP(pp_formline)
const char *const send = s + len;
item_is_utf8 = DO_UTF8(sv);
+ chophere = s + len;
if (!len)
break;
trans = 0;
gotsome = TRUE;
- chophere = s + len;
source = (U8 *) s;
to_copy = len;
while (s < send) {
--
1.7.10.4
|
From @tonycozOn Mon Dec 01 16:45:42 2014, tonyc wrote:
TODO tests pushed as fcaef4d and the fix (unmarking the TODOs) as fb9282c. Tony |
|
@tonycoz - Status changed from 'open' to 'pending release' |
From @khwilliamsonThanks for submitting this ticket The issue should be resolved with the release today of Perl v5.22, available at http://www.perl.org/get.html -- |
|
@khwilliamson - Status changed from 'pending release' to 'resolved' |
Migrated from rt.perl.org#123245 (status was 'resolved')
Searchable as RT123245$
The text was updated successfully, but these errors were encountered: