New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Another segfault in a child of Perl_runops_standard, this one in Perl_pp_stat #14910
Comments
From @dcollinsnGreetings Porters, I have compiled bleadperl with the afl-gcc compiler using: ./Configure -Dusedevel -Dprefix='/usr/local/perl-afl' -Dcc=afl-gcc -Duselongdouble -Duse64bitint -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -des And then fuzzed the resulting binary using: AFL_NO_VAR_CHECK=1 afl-fuzz -i in -o out bin/perl @@ After reducing testcases using `afl-tmin` and filtering out testcases that are merely iterations of "#!perl -u", I have located the following testcase that triggers a segmentation fault in the perl interpreter. The testcase is the 14 character file: stat+stat+stat As with 126042, this seems to be an instance of multiple instances of the same thing being on the stack, related to the stack not being refcounted. However, unlike earlier instances of this bug that I have found, Valgrind finds an earlier error, namely an invalid 32-bit read 4 bytes before a region alloced in Perl_init_stacks. Accordingly, I do not know whether this (and 126042) should be depending on the 77706 tracking bug. **GDB** GNU gdb (GDB) 7.10 Program received signal SIGSEGV, Segmentation fault. **VALGRIND** ==22561== Memcheck, a memory error detector **PERL -V** Summary of my perl5 (revision 5 version 23 subversion 3) configuration: Characteristics of this binary (from libperl): |
From @cpansproutOn Tue Sep 15 19:23:00 2015, dcollinsn@gmail.com wrote:
It has nothing to do with the stack not being refcounted, but stack corruption resulting from perl losing track of where the current stack pointer is meant to be. It is reading past the beginning of the stack. I have just fixed it in 7f399b4. -- Father Chrysostomos |
The RT System itself - Status changed from 'new' to 'open' |
@cpansprout - Status changed from 'open' to 'resolved' |
Migrated from rt.perl.org#126064 (status was 'resolved')
Searchable as RT126064$
The text was updated successfully, but these errors were encountered: