New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
null ptr deref -> bcmp (mc_replace_strmem.c:889) | S_scan_doc: Assertion 's' failed (toke.c:9314) #14789
Comments
From @geeknikWhile fuzzing Perl built from git source (v5.23.0-69-gf907dd3), I came across the following "script" that causes an assertion failure at toke.c:9314: geeknik@h5n2:~$ ~/perl/perl test03-min It also causes Perl v5.21.6-602-ge9d2bd8 to segfault at mc_replace_strmem.c:889: $# is no longer supported at test03-min line 1. $# is no longer supported at test03-min line 1. Program received signal SIGSEGV, Segmentation fault. |
From @geeknik |
From @dcollinsnGreetings Porters, I have compiled bleadperl with the afl-gcc compiler using: ./Configure -Dusedevel -Dprefix='/usr/local/perl-afl' -Dcc='ccache afl-gcc' -Duselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -des And then fuzzed the resulting binary using: AFL_NO_VAR_CHECK=1 afl-fuzz -i in -o out bin/perl @@ After reducing testcases using `afl-tmin` and performing additional minimization by hand, I have located the following testcase that triggers a segfault in the Perl interpreter. The testcase is the attached file: $ od -c out/allcrash/f2i000048 When executed, this prints the following: **GDB** (gdb) run Program received signal SIGSEGV, Segmentation fault. **VALGRIND** ==14515== Memcheck, a memory error detector **PERL -V** Summary of my perl5 (revision 5 version 23 subversion 6) configuration: Characteristics of this binary (from libperl): |
From @dcollinsn |
From @geeknikMaybe a dupe of 125540? |
The RT System itself - Status changed from 'new' to 'open' |
From @tonycozOn Fri Jul 03 09:57:24 2015, brian.carpenter@gmail.com wrote:
The attached should fix this. Tony |
From @tonycoz0001-perl-125540-handle-already-being-at-EOF-while-not-fi.patchFrom 87ee70413aa5b8f8c6ebeea5d0e3f9fe6a8300f1 Mon Sep 17 00:00:00 2001
From: Tony Cook <tony@develop-help.com>
Date: Wed, 20 Jan 2016 15:35:13 +1100
Subject: [perl #125540] handle already being at EOF while not finding a
heredoc terminator
In some cases, S_scan_heredoc() can already be at end of file and
PL_rsfp is NULL. If we're on the final line and that line has no
newline we'd assert or crash.
Now, if we don't find that newline, we obviously can't find the
terminator, so go straight to reporting the missing terminator.
I considered setting s to PL_bufend, but that would just be more
work to print the same message.
---
t/op/heredoc.t | 10 +++++++++-
toke.c | 5 +++--
2 files changed, 12 insertions(+), 3 deletions(-)
diff --git a/t/op/heredoc.t b/t/op/heredoc.t
index dadf105..8fe0c0f 100644
--- a/t/op/heredoc.t
+++ b/t/op/heredoc.t
@@ -7,7 +7,7 @@ BEGIN {
}
use strict;
-plan(tests => 40);
+plan(tests => 41);
# heredoc without newline (#65838)
@@ -98,4 +98,12 @@ HEREDOC
{},
"don't use an invalid oldoldbufptr"
);
+
+ # [perl #125540] this asserted or crashed
+ fresh_perl_like(
+ q(map d$#<<<<),
+ qr/Can't find string terminator "" anywhere before EOF at - line 1\./,
+ {},
+ "Don't assert parsing a here-doc if we hit EOF early"
+ );
}
diff --git a/toke.c b/toke.c
index 23c3521..d1c3b23 100644
--- a/toke.c
+++ b/toke.c
@@ -9577,9 +9577,10 @@ S_scan_heredoc(pTHX_ char *s)
goto streaming;
}
}
- else { /* eval */
+ else { /* eval or we've already hit EOF */
s = (char*)memchr((void*)s, '\n', PL_bufend - s);
- assert(s);
+ if (!s)
+ goto interminable;
}
linestr = shared->ls_linestr;
bufend = SvEND(linestr);
--
2.1.4
|
The RT System itself - Status changed from 'new' to 'open' |
From @tonycozOn Tue Jan 19 20:36:15 2016, tonyc wrote:
Applied to blead as 23c4e91. Tony |
@tonycoz - Status changed from 'open' to 'pending release' |
From @tonycozOn Sat Dec 05 01:36:33 2015, brian.carpenter@gmail.com wrote:
Yes, it's a duplicate, the fix for 125540 fixes this. Tony |
From @khwilliamsonThank you for submitting this report. You have helped make Perl better. Perl 5.24.0 may be downloaded via https://metacpan.org/release/RJBS/perl-5.24.0 |
@khwilliamson - Status changed from 'pending release' to 'resolved' |
Migrated from rt.perl.org#125540 (status was 'resolved')
Searchable as RT125540$
The text was updated successfully, but these errors were encountered: