Skip Menu |
Report information
Id: 130722
Status: pending release
Priority: 0/
Queue: perl5

Owner: Nobody
Requestors: randir <sergey.aleynikov [at]>

Operating System: (no value)
PatchStatus: (no value)
Severity: low
Type: core
Perl Version: 5.25.9
Fixed In: (no value)

Date: Mon, 6 Feb 2017 02:12:28 +0300
To: perlbug [...]
From: Sergey Aleynikov <sergey.aleynikov [...]>
Subject: pp_ctl.c:5165: MAGIC *S_doparseform(SV *): Assertion `!isGV_with_GP(_svpvx)' failed
Download (untitled) / with headers
text/plain 4.8k
This is a bug report for perl from, generated with the help of perlbug 1.40 running under perl 5.25.9. ----------------------------------------------------------------- [Please describe your issue here] While fuzzing perl v5.25.9-35-g32207c637b built with afl and run under libdislocator, I found the following program for(1..2){formline*0} to cause an assertion failure. GDB info about the crash location: (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:58 #1 0x00007f6bb585f40a in __GI_abort () at abort.c:89 #2 0x00007f6bb5856e47 in __assert_fail_base (fmt=<optimized out>, assertion=assertion@entry=0x7f6bb6f6fbfe "!isGV_with_GP(_svpvx)", file=file@entry=0x7f6bb6f6f9a5 "pp_ctl.c", line=line@entry=5165, function=function@entry=0x7f6bb6f74a08 <__PRETTY_FUNCTION__.17320> "S_doparseform") at assert.c:92 #3 0x00007f6bb5856ef2 in __GI___assert_fail (assertion=0x7f6bb6f6fbfe "!isGV_with_GP(_svpvx)", file=0x7f6bb6f6f9a5 "pp_ctl.c", line=5165, function=0x7f6bb6f74a08 <__PRETTY_FUNCTION__.17320> "S_doparseform") at assert.c:101 #4 0x00007f6bb6e14f01 in S_doparseform (sv=0x7f6bb7c279d8) at pp_ctl.c:5165 #5 0x00007f6bb6df1ed9 in Perl_pp_formline () at pp_ctl.c:494 #6 0x00007f6bb6ce2885 in Perl_runops_debug () at dump.c:2450 #7 0x00007f6bb6bdb9a0 in S_run_body (oldscope=1) at perl.c:2528 #8 0x00007f6bb6bdaf1e in perl_run (my_perl=0x7f6bb7c11010) at perl.c:2451 #9 0x00007f6bb6b95efe in main (argc=2, argv=0x7fff553fb958, env=0x7fff553fb970) at perlmain.c:123 This used to produce "Can't coerce GLOB to string in form line" error instead of assertion failure up to 37ffbfcca347ea751c9514463873b90f8a496be0, but this commit only seems to expose the crash while fixing another problem. [Please do not change anything below this line] ----------------------------------------------------------------- --- Flags: category=core severity=low --- Site configuration information for perl 5.25.9: Configured by root at Sat Jan 14 02:25:05 MSK 2017. Summary of my perl5 (revision 5 version 25 subversion 9) configuration: Commit id: cbe2fc5001aa59cdc73e04cc35e097a2ecfbeec0 Platform: osname=linux osvers=3.16.0-4-amd64 archname=x86_64-linux uname='linux dorothy 3.16.0-4-amd64 #1 smp debian 3.16.36-1+deb8u2 (2016-10-19) x86_64 gnulinux ' config_args='-des -Dusedevel -DDEBUGGING -Dcc=afl-clang-fast -Doptimize=-O0 -g -ggdb3' hint=recommended useposix=true d_sigaction=define useithreads=undef usemultiplicity=undef use64bitint=define use64bitall=define uselongdouble=undef usemymalloc=n bincompat5005=undef Compiler: cc='afl-clang-fast' ccflags ='-DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -D_FORTIFY_SOURCE=2' optimize='-O0 -g -ggdb3' cppflags='-DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include' ccversion='' gccversion='4.2.1 Compatible Clang 3.9.1 (tags/RELEASE_391/rc2)' gccosandvers='' intsize=4 longsize=8 ptrsize=8 doublesize=8 byteorder=12345678 doublekind=3 d_longlong=define longlongsize=8 d_longdbl=define longdblsize=16 longdblkind=3 ivtype='long' ivsize=8 nvtype='double' nvsize=8 Off_t='off_t' lseeksize=8 alignbytes=8 prototype=define Linker and Libraries: ld='afl-clang-fast' ldflags =' -fstack-protector-strong -L/usr/local/lib' libpth=/usr/local/lib /usr/lib/llvm-3.9/bin/../lib/clang/3.9.1/lib /usr/include/x86_64-linux-gnu /usr/lib /lib/x86_64-linux-gnu /lib/../lib /usr/lib/x86_64-linux-gnu /usr/lib/../lib /lib libs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc perllibs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc so=so useshrplib=false libperl=libperl.a gnulibc_version='2.24' Dynamic Linking: dlsrc=dl_dlopen.xs dlext=so d_dlsymun=undef ccdlflags='-Wl,-E' cccdlflags='-fPIC' lddlflags='-shared -O0 -g -ggdb3 -L/usr/local/lib -fstack-protector-strong' --- @INC for perl 5.25.9: lib /usr/local/lib/perl5/site_perl/5.25.9/x86_64-linux /usr/local/lib/perl5/site_perl/5.25.9 /usr/local/lib/perl5/5.25.9/x86_64-linux /usr/local/lib/perl5/5.25.9 --- Environment for perl 5.25.9: HOME=/home/afl LANG=en_US.UTF-8 LANGUAGE=en_US:en LD_LIBRARY_PATH (unset) LOGDIR (unset) PATH=/home/afl/perlbrew/bin:/home/afl/perlbrew/perls/perl-5.22.1/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games PERLBREW_BASHRC_VERSION=0.78 PERLBREW_HOME=/home/afl/.perlbrew PERLBREW_MANPATH=/home/afl/perlbrew/perls/perl-5.22.1/man PERLBREW_PATH=/home/afl/perlbrew/bin:/home/afl/perlbrew/perls/perl-5.22.1/bin PERLBREW_PERL=perl-5.22.1 PERLBREW_ROOT=/home/afl/perlbrew PERLBREW_VERSION=0.78 PERL_BADLANG (unset) SHELL=/usr/bin/zsh
RT-Send-CC: perl5-porters [...]
Download (untitled) / with headers
text/plain 713b
On Sun, 05 Feb 2017 15:12:50 -0800, randir wrote: Show quoted text
> While fuzzing perl v5.25.9-35-g32207c637b built with afl and run > under libdislocator, I found the following program > > for(1..2){formline*0} > > to cause an assertion failure. GDB info about the crash location:
Fixed by: commit dd314e1ca8c35e1e3f33c104a0ebca62c28f2d3e Author: Tony Cook <> Date: Tue Feb 7 16:14:53 2017 +1100 (perl #130722) don't call SvPVX() on a glob S_doparseform() called SvPVX() on the format argument, which produced an assertion failure when the format was supplied as a glob. Since S_doparseform() calls SvPV() initially and stores the result, just use that result. Tony

This service is sponsored and maintained by Best Practical Solutions and runs on infrastructure.

For issues related to this RT instance (aka "perlbug"), please contact perlbug-admin at