New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Segfault (access not within mapped region at 0x8) in Perl_pp_iter #14985
Comments
From @dcollinsnGreetings Porters, I have compiled bleadperl with the afl-gcc compiler using: ./Configure -Dusedevel -Dprefix='/usr/local/perl-afl' -Dcc='ccache afl-gcc' -Duselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -des And then fuzzed the resulting binary using: AFL_NO_VAR_CHECK=1 afl-fuzz -i in -o out bin/perl @@ After reducing testcases using `afl-tmin` and performing additional minimization by hand, I have located the following testcase that triggers a segmentation fault in the perl interpreter. The testcase is the file: *_=a for 0..1 Interestingly the following sequence which appears similar shows different behavior: dcollins@nightshade64:~/perldebug$ ./perl -e '*_="" for 0..1' And the use of *_ is relevant: dcollins@nightshade64:~/perldebug$ ./perl -e '*_=a for 0..1' So I wonder if this is a problem due to the for statement modifying *_ while it is on the stack. The crash occurs in Perl_pp_iter as shown below - I assume that either Sv_REFCNT or SvMAGICAL accesses the second element of the struct at oldsv, and the first element of that struct is a pointer, since the accessed address is 0x8 on 64-bit and 0x4 on 32-bit. I have no perl that does not crash here, so a bisect was not attempted. **GDB** (gdb) run Program received signal SIGSEGV, Segmentation fault. **VALGRIND** ==24813== Memcheck, a memory error detector **PERL -V** Summary of my perl5 (revision 5 version 23 subversion 4) configuration: Characteristics of this binary (from libperl): |
From @geeknikMost likely a dupe of https://rt-archive.perl.org/perl5/Ticket/Display.html?id=123994. |
The RT System itself - Status changed from 'new' to 'open' |
Migrated from rt.perl.org#126361 (status was 'open')
Searchable as RT126361$
The text was updated successfully, but these errors were encountered: