From @dcollinsn

Greetings Porters,

I have compiled bleadperl with the afl-gcc compiler using​:

./Configure -Dusedevel -Dprefix='/usr/local/perl-afl' -Dcc='ccache afl-gcc' -Duselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -des
AFL_HARDEN=1 make && make test

And then fuzzed the resulting binary using​:

AFL_NO_VAR_CHECK=1 afl-fuzz -i in -o out bin/perl @​@​

After reducing testcases using `afl-tmin` and performing additional minimization by hand, I have located the following testcase that triggers an assert fail with no other symptoms. The testcase is the file​:

qr/(?{})@​0{()}@​0/

dcollins@​nightshade64​:~$ perl/perl -e 'qr/(?{})@​0{()}@​0/'
dcollins@​nightshade64​:~$ perldebug/perl -e 'qr/(?{})@​0{()}@​0/'
perl​: regcomp.c​:5958​: S_concat_pat​: Assertion `oplist->op_type == OP_PADAV || oplist->op_type == OP_RV2AV' failed.
Aborted

**GDB**

(gdb) run
Starting program​: /home/dcollins/perldebug/perl -e qr/\(\?\{\}\)@​0\{\(\)\}@​0/
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
perl​: regcomp.c​:5958​: S_concat_pat​: Assertion `oplist->op_type == OP_PADAV || oplist->op_type == OP_RV2AV' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff6cf4107 in raise () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) bt
#0 0x00007ffff6cf4107 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007ffff6cf54e8 in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2 0x00007ffff6ced226 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#3 0x00007ffff6ced2d2 in __assert_fail ()
  from /lib/x86_64-linux-gnu/libc.so.6
#4 0x000000000069aec9 in S_concat_pat (
  pRExC_state=pRExC_state@​entry=0x7fffffffe020, pat=0x11d81c8,
  pat@​entry=0x0, patternp=patternp@​entry=0x11c6a28,
  pat_count=pat_count@​entry=2, oplist=0x11e24c8, oplist@​entry=0x11c9658,
  recompile_p=recompile_p@​entry=0x7fffffffdeeb, delim=0x0) at regcomp.c​:5957
#5 0x000000000077b4f1 in Perl_re_op_compile (patternp=<optimized out>,
  pat_count=2, expr=0x11c9658, eng=0xf16600 <PL_core_reg_engine>,
  old_re=0x0, is_bare_re=0x7fffffffe3b7, orig_rx_flags=0,
  pm_flags=1879048192) at regcomp.c​:6572
#6 0x0000000000b22e04 in Perl_pp_regcomp () at pp_ctl.c​:119
#7 0x00000000007c909f in Perl_runops_debug () at dump.c​:2224
#8 0x0000000000532411 in S_run_body (oldscope=1) at perl.c​:2464
#9 perl_run (my_perl=<optimized out>) at perl.c​:2387
#10 0x0000000000428928 in main (argc=3, argv=0x7fffffffe658,
  env=0x7fffffffe678) at perlmain.c​:116
(gdb) f 4
#4 0x000000000069aec9 in S_concat_pat (
  pRExC_state=pRExC_state@​entry=0x7fffffffe020, pat=0x11d81c8,
  pat@​entry=0x0, patternp=patternp@​entry=0x11c6a28,
  pat_count=pat_count@​entry=2, oplist=0x11e24c8, oplist@​entry=0x11c9658,
  recompile_p=recompile_p@​entry=0x7fffffffdeeb, delim=0x0) at regcomp.c​:5957
5957 assert(oplist->op_type == OP_PADAV
(gdb) info locals
maxarg = 0
array = <optimized out>
rx = 0x0
sv = <optimized out>
orig_patlen = 0
code = false
msv = <optimized out>
svp = <optimized out>
n = 1
use_delim = <optimized out>
alloced = <optimized out>
__PRETTY_FUNCTION__ = "S_concat_pat"
(gdb) q

**PERL -V**

Summary of my perl5 (revision 5 version 23 subversion 5) configuration​:
  Commit id​: fb034ed
  Platform​:
  osname=linux, osvers=3.16.0-4-amd64, archname=x86_64-linux-ld
  uname='linux nightshade64 3.16.0-4-amd64 #1 smp debian 3.16.7-ckt11-1+deb8u4 (2015-09-19) x86_64 gnulinux '
  config_args='-Dusedevel -Dprefix=/usr/local/perl-afl -Dcc=ccache afl-gcc -Duselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -DDEBUGGING -DDEBUG_LEAKING_SCALARS -des'
  hint=recommended, useposix=true, d_sigaction=define
  useithreads=undef, usemultiplicity=undef
  use64bitint=define, use64bitall=define, uselongdouble=define
  usemymalloc=n, bincompat5005=undef
  Compiler​:
  cc='ccache afl-gcc', ccflags ='-fwrapv -DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
  optimize='-g',
  cppflags='-fwrapv -DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include'
  ccversion='', gccversion='5.2.0', gccosandvers=''
  intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678, doublekind=3
  d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16, longdblkind=3
  ivtype='long', ivsize=8, nvtype='long double', nvsize=16, Off_t='off_t', lseeksize=8
  alignbytes=16, prototype=define
  Linker and Libraries​:
  ld='ccache afl-gcc', ldflags =' -fstack-protector-strong -L/usr/local/lib'
  libpth=/usr/local/lib /usr/local/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/include-fixed /usr/include/x86_64-linux-gnu /usr/lib /lib/x86_64-linux-gnu /lib/../lib /usr/lib/x86_64-linux-gnu /usr/lib/../lib /lib
  libs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc
  perllibs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc
  libc=libc-2.19.so, so=so, useshrplib=false, libperl=libperl.a
  gnulibc_version='2.19'
  Dynamic Linking​:
  dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
  cccdlflags='-fPIC', lddlflags='-shared -g -L/usr/local/lib -fstack-protector-strong'

Characteristics of this binary (from libperl)​:
  Compile-time options​: DEBUGGING HAS_TIMES PERLIO_LAYERS PERL_COPY_ON_WRITE
  PERL_DONT_CREATE_GVSV
  PERL_HASH_FUNC_ONE_AT_A_TIME_HARD PERL_MALLOC_WRAP
  PERL_PRESERVE_IVUV PERL_USE_DEVEL USE_64_BIT_ALL
  USE_64_BIT_INT USE_LARGE_FILES USE_LOCALE
  USE_LOCALE_COLLATE USE_LOCALE_CTYPE
  USE_LOCALE_NUMERIC USE_LOCALE_TIME USE_LONG_DOUBLE
  USE_PERLIO USE_PERL_ATOF
  Built under linux
  Compiled at Nov 17 2015 16​:24​:08
  @​INC​:
  /usr/local/perl-afl/lib/site_perl/5.23.5/x86_64-linux-ld
  /usr/local/perl-afl/lib/site_perl/5.23.5
  /usr/local/perl-afl/lib/5.23.5/x86_64-linux-ld
  /usr/local/perl-afl/lib/5.23.5
  /usr/local/perl-afl/lib/site_perl/5.23.4
  /usr/local/perl-afl/lib/site_perl
  .

From @demerphq

On 18 November 2015 at 00​:38, Dan Collins <perlbug-followup@​perl.org> wrote​:

# New Ticket Created by Dan Collins
# Please include the string​: [perl #126667]
# in the subject line of all future correspondence about this issue.
# <URL​: https://rt-archive.perl.org/perl5/Ticket/Display.html?id=126667 >

Greetings Porters,

I have compiled bleadperl with the afl-gcc compiler using​:

./Configure -Dusedevel -Dprefix='/usr/local/perl-afl' -Dcc='ccache afl-gcc' -Duselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -des
AFL_HARDEN=1 make && make test

And then fuzzed the resulting binary using​:

AFL_NO_VAR_CHECK=1 afl-fuzz -i in -o out bin/perl @​@​

After reducing testcases using `afl-tmin` and performing additional minimization by hand, I have located the following testcase that triggers an assert fail with no other symptoms. The testcase is the file​:

qr/(?{})@​0{()}@​0/

dcollins@​nightshade64​:~$ perl/perl -e 'qr/(?{})@​0{()}@​0/'
dcollins@​nightshade64​:~$ perldebug/perl -e 'qr/(?{})@​0{()}@​0/'
perl​: regcomp.c​:5958​: S_concat_pat​: Assertion `oplist->op_type == OP_PADAV || oplist->op_type == OP_RV2AV' failed.
Aborted

Its trying to stringify @​0

Yves

The RT System itself - Status changed from 'new' to 'open'