Bleadperl v5.31.2-54-g8c47b5bce7 breaks RIBASUSHI/DBIx-Class-0.082841.tar.gz #17121
Comments
From @andkXRef: https://rt.cpan.org/Ticket/Display.html?id=130271 |
From @andkAlso affected: SREZIC/Tk-804.034.tar.gz -- |
From @andkAlso affected: SKAJI/Text-Xslate-v3.5.6.tar.gz -- |
From @nwc10On Thu, Aug 08, 2019 at 03:21:58PM +0200, Andreas Koenig wrote:
commit 8c47b5b OPSLOT: replace opslot_next with opslot_size Currently, each allocated opslot has a pointer to the opslot that was This saves space. ASAN is very excited (blead at 21dce8f): :~/Perl/p5-Text-Xslate$ ~/Sandpit/snap-v5.31.2-65-g21dce8f4eb-ASAN/bin/perl5.31.3 -T -Mblib t/010_internals/028_taint.t==30795==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6210002c8870 at pc 0x55a1eacf4e53 bp 0x7ffe0a628f50 sp 0x7ffe0a628f40 0x6210002c8870 is located 144 bytes to the left of 4096-byte region [0x6210002c8900,0x6210002c9900) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/nick/Perl/perl/op.c:864 in Perl_op_free (don't have any time to investigate further - need to get the bus to the Nicholas Clark |
|
The RT System itself - Status changed from 'new' to 'open' |
From @nwc10On Thu, Aug 08, 2019 at 05:16:30PM +0100, Nicholas Clark wrote:
which is a bit strange because it seems that the memory access is somewhere
And to confirm, this failure case is not yet covered by any core regression All tests successful. I hope this is useful to others. Nicholas Clark |
From @iabynOn Fri, Aug 09, 2019 at 07:25:05AM +0100, Nicholas Clark wrote:
I'm looking at it today -- |
From @iabynOn Fri, Aug 09, 2019 at 09:18:16AM +0100, Dave Mitchell wrote:
Now fixed (and the three mentioned distributions are passing) with: commit 5d26d78 fix size-miscalculation upgrading LISTOP TO LOOPOP Affected files ... Differences ... Inline Patchdiff --git a/op.c b/op.c
index 5d0b1dae3a..86251047b6 100644
--- a/op.c
+++ b/op.c
@@ -9287,7 +9287,8 @@ Perl_newFOROP(pTHX_ I32 flags, OP *sv, OP *expr, OP *block, OP *cont)
/* upgrade loop from a LISTOP to a LOOPOP;
* keep it in-place if there's space */
if (loop->op_slabbed
- && OpSLOT(loop)->opslot_size < SIZE_TO_PSIZE(sizeof(LOOP)))
+ && OpSLOT(loop)->opslot_size
+ < SIZE_TO_PSIZE(sizeof(LOOP)) + OPSLOT_HEADER_P)
{
/* no space; allocate new op */
LOOP *tmp;
-- "I do not resent criticism, even when, for the sake of emphasis, |
|
@iabyn - Status changed from 'open' to 'resolved' |
Migrated from rt.perl.org#134344 (status was 'resolved')
Searchable as RT134344$
The text was updated successfully, but these errors were encountered: