Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Assertion failure in Perl_isSCRIPT_RUN (regexec.c:10475) #16935

Closed
p5pRT opened this issue Apr 6, 2019 · 6 comments
Closed

Assertion failure in Perl_isSCRIPT_RUN (regexec.c:10475) #16935

p5pRT opened this issue Apr 6, 2019 · 6 comments

Comments

@p5pRT
Copy link

p5pRT commented Apr 6, 2019

Migrated from rt.perl.org#133997 (status was 'resolved')

Searchable as RT133997$

@p5pRT
Copy link
Author

p5pRT commented Apr 6, 2019

From @dur-randir

Created by @dur-randir

While fuzzing perl v5.29.9-63-g2496d8f3f7 built with afl and run
under libdislocator, I found the following program

0=~'(((*sr​:()|)0)(*sr​:)0|)'

to cause an assertion failure

perl​: regexec.c​:10475​: _Bool Perl_isSCRIPT_RUN(const U8 *, const U8 *,
const _Bool)​: Assertion `send >= s' failed.

GDB stack trace is following

#0 __GI_raise (sig=sig@​entry=6) at ../sysdeps/unix/sysv/linux/raise.c​:50
#1 0x00007ffff7c25535 in __GI_abort () at abort.c​:79
#2 0x00007ffff7c2540f in __assert_fail_base (fmt=0x7ffff7d87ee0
"%s%s%s​:%u​: %s%sAssertion `%s' failed.\n%n", assertion=0x555555ae0fe8
"send >= s",
  file=0x555555ae0348 "regexec.c", line=10475, function=<optimized
out>) at assert.c​:92
#3 0x00007ffff7c330f2 in __GI___assert_fail (assertion=0x555555ae0fe8
"send >= s", file=0x555555ae0348 "regexec.c", line=10475,
  function=0x555555af3270 <__PRETTY_FUNCTION__.20773>
"Perl_isSCRIPT_RUN") at assert.c​:101
#4 0x00005555558ca5b9 in Perl_isSCRIPT_RUN (s=0x555555b64481 "",
send=0x555555b64480 "0", utf8_target=false) at regexec.c​:10475
#5 0x00005555558bdf84 in S_regmatch (reginfo=0x7fffffffdce0,
startpos=0x555555b64480 "0", prog=0x555555b793bc) at regexec.c​:7671
#6 0x00005555558ae0bf in S_regtry (reginfo=0x7fffffffdce0,
startposp=0x7fffffffdaa8) at regexec.c​:3956
#7 0x00005555558ada3f in Perl_regexec_flags (rx=0x555555b730c8,
stringarg=0x555555b64480 "0", strend=0x555555b64481 "",
strbeg=0x555555b64480 "0",
  minend=0, sv=0x555555b73080, data=0x0, flags=97) at regexec.c​:3819
#8 0x0000555555769960 in Perl_pp_match () at pp_hot.c​:3018
#9 0x000055555570b640 in Perl_runops_debug () at dump.c​:2537
#10 0x00005555555ed560 in S_run_body (oldscope=1) at perl.c​:2716
#11 0x00005555555ecade in perl_run (my_perl=0x555555b4c260) at perl.c​:2639
#12 0x00005555555a114e in main (argc=2, argv=0x7fffffffe1c8,
env=0x7fffffffe1e0) at perlmain.c​:127

This appeared between 5.26 and 5.28, bisect points to the following commit

commit d979061
Author​: Karl Williamson <khw@​cpan.org>
Date​: Sun Feb 18 20​:28​:34 2018 -0700

  Change syntax of script runs

  The new syntax is (*script_run​:...)
  and a shortcut (*sr​:...)

Perl Info

Flags:
    category=core
    severity=medium

Site configuration information for perl 5.29.9:

Configured by dur-randir at Wed Feb 27 14:51:01 MSK 2019.

Summary of my perl5 (revision 5 version 29 subversion 9) configuration:
  Commit id: c1e47bad34ce1d9c84ed57c9b8978bcbd5a02e98
  Platform:
    osname=darwin
    osvers=13.4.0
    archname=darwin-thread-multi-2level
    uname='darwin isengard.local 13.4.0 darwin kernel version 13.4.0:
mon jan 11 18:17:34 pst 2016; root:xnu-2422.115.15~1release_x86_64
x86_64 '
    config_args='-de -Dusedevel -DDEBUGGING -Dusethreads'
    hint=recommended
    useposix=true
    d_sigaction=define
    useithreads=define
    usemultiplicity=define
    use64bitint=define
    use64bitall=define
    uselongdouble=undef
    usemymalloc=n
    default_inc_excludes_dot=define
    bincompat5005=undef
  Compiler:
    cc='cc'
    ccflags ='-fno-common -DPERL_DARWIN -mmacosx-version-min=10.9
-DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector
-I/usr/local/include -DPERL_USE_SAFE_PUTENV'
    optimize='-O3 -g'
    cppflags='-fno-common -DPERL_DARWIN -mmacosx-version-min=10.9
-DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector
-I/usr/local/include'
    ccversion=''
    gccversion='4.2.1 Compatible Apple LLVM 6.0 (clang-600.0.56)'
    gccosandvers=''
    intsize=4
    longsize=8
    ptrsize=8
    doublesize=8
    byteorder=12345678
    doublekind=3
    d_longlong=define
    longlongsize=8
    d_longdbl=define
    longdblsize=16
    longdblkind=3
    ivtype='long'
    ivsize=8
    nvtype='double'
    nvsize=8
    Off_t='off_t'
    lseeksize=8
    alignbytes=8
    prototype=define
  Linker and Libraries:
    ld='cc'
    ldflags =' -mmacosx-version-min=10.9 -fstack-protector -L/usr/local/lib'
    libpth=/usr/local/lib
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/6.0/lib
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib
/usr/lib
    libs=-lpthread -lgdbm -ldbm -ldl -lm -lutil -lc
    perllibs=-lpthread -ldl -lm -lutil -lc
    libc=
    so=dylib
    useshrplib=false
    libperl=libperl.a
    gnulibc_version=''
  Dynamic Linking:
    dlsrc=dl_dlopen.xs
    dlext=bundle
    d_dlsymun=undef
    ccdlflags=' '
    cccdlflags=' '
    lddlflags=' -mmacosx-version-min=10.9 -bundle -undefined
dynamic_lookup -L/usr/local/lib -fstack-protector'



@INC for perl 5.29.9:
    lib
    /usr/local/lib/perl5/site_perl/5.29.9/darwin-thread-multi-2level
    /usr/local/lib/perl5/site_perl/5.29.9
    /usr/local/lib/perl5/5.29.9/darwin-thread-multi-2level
    /usr/local/lib/perl5/5.29.9


Environment for perl 5.29.9:
    DYLD_LIBRARY_PATH (unset)
    HOME=/Users/dur-randir
    LANG=en_US.UTF-8
    LANGUAGE (unset)
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
    PATH=/Users/dur-randir/perlbrew/bin:/Users/dur-randir/perlbrew/perls/perl-5.22.1/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/texbin
    PERLBREW_HOME=/Users/dur-randir/.perlbrew
    PERLBREW_MANPATH=/Users/dur-randir/perlbrew/perls/perl-5.22.1/man
    PERLBREW_PATH=/Users/dur-randir/perlbrew/bin:/Users/dur-randir/perlbrew/perls/perl-5.22.1/bin
    PERLBREW_PERL=perl-5.22.1
    PERLBREW_ROOT=/Users/dur-randir/perlbrew
    PERLBREW_SHELLRC_VERSION=0.84
    PERLBREW_VERSION=0.84
    PERL_BADLANG (unset)
    SHELL=/usr/local/bin/zsh

@p5pRT
Copy link
Author

p5pRT commented Apr 14, 2019

@khwilliamson - Status changed from 'new' to 'open'

@p5pRT
Copy link
Author

p5pRT commented Apr 14, 2019

From @khwilliamson

Fixed by
commit 8e9f3ee
Author​: Karl Williamson <khw@​cpan.org>
Date​: Sat Apr 13 19​:55​:56 2019 -0600

  PATCH​: [perl #133997] Assert fail with script runs
 
  The cause of this is the emulation of recursion in executing regex
  patterns and that the script run feature did not cooperate with it. The
  result is that the input pointers got pushed (but not the script run)
  and popped, so that the script run was pointing to something that had
  been tried, failed and otherwise popped.
 
  The solution I've adopted is to always push the current script run start
  position whenever a push is done; and pop it whenever a pop is done.
 
  If someone has suggestions about this code, please step forward.
--
Karl Williamson

@p5pRT
Copy link
Author

p5pRT commented Apr 14, 2019

@khwilliamson - Status changed from 'open' to 'pending release'

@p5pRT
Copy link
Author

p5pRT commented May 22, 2019

From @khwilliamson

Thank you for filing this report. You have helped make Perl better.

With the release today of Perl 5.30.0, this and 160 other issues have been
resolved.

Perl 5.30.0 may be downloaded via​:
https://metacpan.org/release/XSAWYERX/perl-5.30.0

If you find that the problem persists, feel free to reopen this ticket.

@p5pRT
Copy link
Author

p5pRT commented May 22, 2019

@khwilliamson - Status changed from 'pending release' to 'resolved'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant