New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
heap-use-after-free in Perl_sv_setsv_cow (sv.c:4872) #16860
Comments
From @dur-randirCreated by @dur-randirWhile fuzzing perl v5.29.8-21-gde59f38ed9 built with afl and run 00000000 73 2f 2f 30 2f 2c 40 2f 3d 30 2c 73 00 30 00 00 |s//0/,@/=0,s.0..| to perform an access outside of an allocated memory slot. ASAN diagnostics are: ==29541==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200000d6f9 is located 9 bytes inside of 10-byte region previously allocated by thread T0 here: This is a regression between 5.24 and 5.26, bisect points to commit 8b0c337 Better optimise array and hash assignment [perl #127999] Slowdown in split + list assign Re-implement the code that handles e.g. (..., @a) = (...); Perl Info
|
From @dur-randir |
From @tonycozOn Sun, 03 Mar 2019 03:36:04 -0800, randir wrote:
I suspect this is a stack not refcounted issue. The code is: s//0/,@/=0,s.0..-split@0=values@0for-0,@/=@0=// which groups like: (s//0/, (@/ = 0), (s/0// - split((@0 = values(@0)), $_, 0))) foreach ((0, (@/ = (@0 = //)))); First the arguments to foreach are processed, setting @/ and @0 to copies of PL_sv_true, and the value 0 and the value of @/ is pushed on the stack. For each iteration $_ is aliased to those values. On the first iteration both @0 and @/ are assigned to, so the values on the stack are released. The next iteration then tries to process the now invalid value from @/, and makes a copy of it in the saved_copy member of the regexp (this might not be quite correct, but the next bit is observed behaviour.) Unfortunately this seems to have been allocated at the same location as the original SV from @/, so the same sv is passed as both parameters to sv_setsv_cow(), which doesn't handle that case, releasing the PVX of the destination SV before trying to duplicate it from the source SV, which fails horribly because they're the same SV. Tony |
The RT System itself - Status changed from 'new' to 'open' |
From @iabynOn Tue, Apr 16, 2019 at 09:58:05PM -0700, Tony Cook via RT wrote:
I propose we move this ticket to the public queue -- |
From @tonycozOn Wed, 07 Aug 2019 02:41:07 -0700, davem wrote:
Now public. Tony |
Migrated from rt.perl.org#133878 (status was 'open')
Searchable as RT133878$
The text was updated successfully, but these errors were encountered: