NULL pointer deference in Perl_sv_setpv_bufsize #16727

p5pRT · 2018-10-19T05:19:47Z

Migrated from rt.perl.org#133599 (status was 'open')

Searchable as RT133599$

p5pRT · 2018-10-19T05:19:47Z

From zzw20124321@gmail.com

NULL pointer deference in Perl_sv_setpv_bufsize

./perl -v

This is perl 5, version 29, subversion 3 (v5.29.3) built for x86_64-linux

Perl may be copied only under the terms of either the Artistic License or
the
GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl". If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.

compile with -fsanitize=address

./perl null_pointer.pl
$* is no longer supported. Its use will be fatal in Perl 5.30 at
null_pointer.pl line 1.
ASAN:SIGSEGV

==26073==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x000000639f80 bp 0x000000000000 sp 0x7ffcf29b4330 T0)
#0 0x639f7f in Perl_sv_setpv_bufsize
/home/fan/github/perl5-5.29.3/sv.c:4865
#1 0x6fa103 in Perl_do_vop /home/fan/github/perl5-5.29.3/doop.c:1039
#2 0x661ce6 in Perl_pp_bit_or /home/fan/github/perl5-5.29.3/pp.c:2392
#3 0x5e983a in Perl_runops_standard
/home/fan/github/perl5-5.29.3/run.c:41
#4 0x48efa7 in S_run_body /home/fan/github/perl5-5.29.3/perl.c:2683
#5 0x48efa7 in perl_run /home/fan/github/perl5-5.29.3/perl.c:2611
#6 0x424814 in main /home/fan/github/perl5-5.29.3/perlmain.c:122
#7 0x7f2f2194382f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#8 0x424d88 in _start (/home/fan/github/perl5-5.29.3/perl+0x424d88)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fan/github/perl5-5.29.3/sv.c:4865
Perl_sv_setpv_bufsize
==26073==ABORTING

cat null_pointer.pl
$* ^= *: = ** = *^= *: = ** = *^= *: = ** = *:

or we cat test this

../perl -e '$* ^= *: = ** = *^= *: = ** = *^= *: = ** = *:'

$* is no longer supported. Its use will be fatal in Perl 5.30 at -e line 1.
ASAN:SIGSEGV

==27827==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x000000639f80 bp 0x000000000000 sp 0x7ffc146ae8f0 T0)
#0 0x639f7f in Perl_sv_setpv_bufsize
/home/fan/github/perl5-5.29.3/sv.c:4865
#1 0x6fa103 in Perl_do_vop /home/fan/github/perl5-5.29.3/doop.c:1039
#2 0x661ce6 in Perl_pp_bit_or /home/fan/github/perl5-5.29.3/pp.c:2392
#3 0x5e983a in Perl_runops_standard
/home/fan/github/perl5-5.29.3/run.c:41
#4 0x48efa7 in S_run_body /home/fan/github/perl5-5.29.3/perl.c:2683
#5 0x48efa7 in perl_run /home/fan/github/perl5-5.29.3/perl.c:2611
#6 0x424814 in main /home/fan/github/perl5-5.29.3/perlmain.c:122
#7 0x7ffb6e6a382f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#8 0x424d88 in _start (/home/fan/github/perl5-5.29.3/perl+0x424d88)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fan/github/perl5-5.29.3/sv.c:4865
Perl_sv_setpv_bufsize
==27827==ABORTING

p5pRT · 2018-10-20T01:07:10Z

From @jkeenan

On Fri, 19 Oct 2018 05:19:47 GMT, zzw20124321@gmail.com wrote:

NULL pointer deference in Perl_sv_setpv_bufsize

./perl -v

This is perl 5, version 29, subversion 3 (v5.29.3) built for x86_64-linux

Copyright 1987-2018, Larry Wall

Perl may be copied only under the terms of either the Artistic License or
the
GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl". If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.

compile with -fsanitize=address

./perl null_pointer.pl
$* is no longer supported. Its use will be fatal in Perl 5.30 at
null_pointer.pl line 1.
ASAN:SIGSEGV

==26073==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x000000639f80 bp 0x000000000000 sp 0x7ffcf29b4330 T0)
#0 0x639f7f in Perl_sv_setpv_bufsize
/home/fan/github/perl5-5.29.3/sv.c:4865
#1 0x6fa103 in Perl_do_vop /home/fan/github/perl5-5.29.3/doop.c:1039
#2 0x661ce6 in Perl_pp_bit_or /home/fan/github/perl5-5.29.3/pp.c:2392
#3 0x5e983a in Perl_runops_standard
/home/fan/github/perl5-5.29.3/run.c:41
#4 0x48efa7 in S_run_body /home/fan/github/perl5-5.29.3/perl.c:2683
#5 0x48efa7 in perl_run /home/fan/github/perl5-5.29.3/perl.c:2611
#6 0x424814 in main /home/fan/github/perl5-5.29.3/perlmain.c:122
#7 0x7f2f2194382f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#8 0x424d88 in _start (/home/fan/github/perl5-5.29.3/perl+0x424d88)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fan/github/perl5-5.29.3/sv.c:4865
Perl_sv_setpv_bufsize
==26073==ABORTING

cat null_pointer.pl
$* ^= *: = ** = *^= *: = ** = *^= *: = ** = *:

or we cat test this

../perl -e '$* ^= *: = ** = *^= *: = ** = *^= *: = ** = *:'

$* is no longer supported. Its use will be fatal in Perl 5.30 at -e line 1.
ASAN:SIGSEGV

==27827==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
(pc 0x000000639f80 bp 0x000000000000 sp 0x7ffc146ae8f0 T0)
#0 0x639f7f in Perl_sv_setpv_bufsize
/home/fan/github/perl5-5.29.3/sv.c:4865
#1 0x6fa103 in Perl_do_vop /home/fan/github/perl5-5.29.3/doop.c:1039
#2 0x661ce6 in Perl_pp_bit_or /home/fan/github/perl5-5.29.3/pp.c:2392
#3 0x5e983a in Perl_runops_standard
/home/fan/github/perl5-5.29.3/run.c:41
#4 0x48efa7 in S_run_body /home/fan/github/perl5-5.29.3/perl.c:2683
#5 0x48efa7 in perl_run /home/fan/github/perl5-5.29.3/perl.c:2611
#6 0x424814 in main /home/fan/github/perl5-5.29.3/perlmain.c:122
#7 0x7ffb6e6a382f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#8 0x424d88 in _start (/home/fan/github/perl5-5.29.3/perl+0x424d88)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/fan/github/perl5-5.29.3/sv.c:4865
Perl_sv_setpv_bufsize
==27827==ABORTING

It so happens that just this week we introducted into blead -- our main development branch -- the commit which fatalizes use of $*.

#####
commit dcb414a
Author: James E Keenan <jkeenan@cpan.org>
AuthorDate: Fri Oct 12 11:55:40 2018
Commit: James E Keenan <jkeenan@cpan.org>
CommitDate: Wed Oct 17 07:44:45 2018

Fatalize use of $* and $#

Per: RT # 133583
#####

So now you won't get the segfault (preceded by a deprecation warning) when you run that program; you'll get an exception instead.

#####
$ bleadperl -v | head -2 | tail -1
This is perl 5, version 29, subversion 4 (v5.29.4 (v5.29.3-71-g083a0c3388)) built for x86_64-linux-thread-multi

$ bleadperl -e '$* ^= *: = ** = *^= *: = ** = *^= *: = ** = *:'
$* is no longer supported as of Perl 5.30 at -e line 1.
#####

Thank you very much.

--
James E Keenan (jkeenan@cpan.org)

p5pRT · 2018-10-20T01:07:10Z

The RT System itself - Status changed from 'new' to 'open'

p5pRT · 2018-10-20T01:27:40Z

From @xenu

On Fri, 19 Oct 2018 18:07:10 -0700
"James E Keenan via RT" <perlbug-followup@perl.org> wrote:

It so happens that just this week we introducted into blead -- our main development branch -- the commit which fatalizes use of $*.

#####
commit dcb414a
Author: James E Keenan <jkeenan@cpan.org>
AuthorDate: Fri Oct 12 11:55:40 2018
Commit: James E Keenan <jkeenan@cpan.org>
CommitDate: Wed Oct 17 07:44:45 2018
Fatalize use of $\* and $\#

Per&#8203;: RT \# 133583
#####

So now you won't get the segfault (preceded by a deprecation warning) when you run that program; you'll get an exception instead.

#####
$ bleadperl -v | head -2 | tail -1
This is perl 5, version 29, subversion 4 (v5.29.4 (v5.29.3-71-g083a0c3388)) built for x86_64-linux-thread-multi

$ bleadperl -e '$* ^= *: = ** = *^= *: = ** = *^= *: = ** = *:'
$* is no longer supported as of Perl 5.30 at -e line 1.
#####

If you replace $* with $^, it still segfaults:

perl5.29.4 -e '$^ ^= *: = ** = *^= *: = ** = *^= *: = ** = *:'
Segmentation fault

p5pRT · 2018-10-20T02:29:32Z

From @jkeenan

On 10/19/2018 09:27 PM, Tomasz Konojacki wrote:

On Fri, 19 Oct 2018 18:07:10 -0700
"James E Keenan via RT" <perlbug-followup@perl.org> wrote:
It so happens that just this week we introducted into blead -- our main development branch -- the commit which fatalizes use of $*.

#####
commit dcb414a
Author: James E Keenan <jkeenan@cpan.org>
AuthorDate: Fri Oct 12 11:55:40 2018
Commit: James E Keenan <jkeenan@cpan.org>
CommitDate: Wed Oct 17 07:44:45 2018
 Fatalize use of $\* and $\#
 
 Per&#8203;: RT \# 133583
#####

So now you won't get the segfault (preceded by a deprecation warning) when you run that program; you'll get an exception instead.

#####
$ bleadperl -v | head -2 | tail -1
This is perl 5, version 29, subversion 4 (v5.29.4 (v5.29.3-71-g083a0c3388)) built for x86_64-linux-thread-multi

$ bleadperl -e '$* ^= *: = ** = *^= *: = ** = *^= *: = ** = *:'
$* is no longer supported as of Perl 5.30 at -e line 1.
#####
If you replace $* with $^, it still segfaults:

perl5.29.4 -e '$^ ^= *: = ** = *^= *: = ** = *^= *: = ** = *:'
Segmentation fault

So, is this a general problem with the punctuation variables?

p5pRT · 2018-10-20T05:22:59Z

From @tonycoz

On Fri, Oct 19, 2018 at 10:29:23PM -0400, James E Keenan wrote:

On 10/19/2018 09:27 PM, Tomasz Konojacki wrote:
On Fri, 19 Oct 2018 18:07:10 -0700
"James E Keenan via RT" <perlbug-followup@perl.org> wrote:
It so happens that just this week we introducted into blead -- our main development branch -- the commit which fatalizes use of $*.

#####
commit dcb414a
Author: James E Keenan <jkeenan@cpan.org>
AuthorDate: Fri Oct 12 11:55:40 2018
Commit: James E Keenan <jkeenan@cpan.org>
CommitDate: Wed Oct 17 07:44:45 2018
 Fatalize use of $\* and $\#
 Per&#8203;: RT \# 133583
#####

So now you won't get the segfault (preceded by a deprecation warning) when you run that program; you'll get an exception instead.

#####
$ bleadperl -v | head -2 | tail -1
This is perl 5, version 29, subversion 4 (v5.29.4 (v5.29.3-71-g083a0c3388)) built for x86_64-linux-thread-multi

$ bleadperl -e '$* ^= *: = ** = *^= *: = ** = *^= *: = ** = *:'
$* is no longer supported as of Perl 5.30 at -e line 1.
#####
If you replace $* with $^, it still segfaults:

perl5.29.4 -e '$^ ^= *: = ** = *^= *: = ** = *^= *: = ** = *:'
Segmentation fault
So, is this a general problem with the punctuation variables?

No, it's the stack-not-refcounted bug.

Tony

p5pRT · 2019-07-30T12:56:57Z

From geeknik@protonmail.ch

This looks like a duplicate of 130224.

On Fri, 19 Oct 2018 22:22:59 -0700, tonyc wrote:

No, it's the stack-not-refcounted bug.

Tony

xcainiao · 2020-10-12T07:40:52Z

hello would this open a cve?

tonycoz · 2020-10-13T22:24:48Z

hello would this open a cve?

No, it's a bug, but not a security issue.

p5pRT added the Severity Low label Oct 19, 2019

xenu removed the Severity Low label Dec 29, 2021

khwilliamson added the segfault label Apr 17, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NULL pointer deference in Perl_sv_setpv_bufsize #16727

NULL pointer deference in Perl_sv_setpv_bufsize #16727

p5pRT commented Oct 19, 2018

p5pRT commented Oct 19, 2018

p5pRT commented Oct 20, 2018

./perl null_pointer.pl
$* is no longer supported. Its use will be fatal in Perl 5.30 at
null_pointer.pl line 1.
ASAN:SIGSEGV

$* is no longer supported. Its use will be fatal in Perl 5.30 at -e line 1.
ASAN:SIGSEGV

p5pRT commented Oct 20, 2018

p5pRT commented Oct 20, 2018

p5pRT commented Oct 20, 2018

p5pRT commented Oct 20, 2018

p5pRT commented Jul 30, 2019

xcainiao commented Oct 12, 2020

tonycoz commented Oct 13, 2020

NULL pointer deference in Perl_sv_setpv_bufsize #16727

NULL pointer deference in Perl_sv_setpv_bufsize #16727

Comments

p5pRT commented Oct 19, 2018

p5pRT commented Oct 19, 2018

From zzw20124321@gmail.com

./perl null_pointer.pl $* is no longer supported. Its use will be fatal in Perl 5.30 at null_pointer.pl line 1. ASAN​:SIGSEGV

$* is no longer supported. Its use will be fatal in Perl 5.30 at -e line 1. ASAN​:SIGSEGV

p5pRT commented Oct 20, 2018

From @jkeenan

./perl null_pointer.pl $* is no longer supported. Its use will be fatal in Perl 5.30 at null_pointer.pl line 1. ASAN​:SIGSEGV

$* is no longer supported. Its use will be fatal in Perl 5.30 at -e line 1. ASAN​:SIGSEGV

p5pRT commented Oct 20, 2018

p5pRT commented Oct 20, 2018

From @xenu

p5pRT commented Oct 20, 2018

From @jkeenan

p5pRT commented Oct 20, 2018

From @tonycoz

p5pRT commented Jul 30, 2019

From geeknik@protonmail.ch

xcainiao commented Oct 12, 2020

tonycoz commented Oct 13, 2020

./perl null_pointer.pl
$* is no longer supported. Its use will be fatal in Perl 5.30 at
null_pointer.pl line 1.
ASAN:SIGSEGV

$* is no longer supported. Its use will be fatal in Perl 5.30 at -e line 1.
ASAN:SIGSEGV

./perl null_pointer.pl
$* is no longer supported. Its use will be fatal in Perl 5.30 at
null_pointer.pl line 1.
ASAN:SIGSEGV

$* is no longer supported. Its use will be fatal in Perl 5.30 at -e line 1.
ASAN:SIGSEGV