develooper Front page | perl.perl5.porters | Postings from January 2003

[perl #20522] perl segfaults growing large Av

From:
perlbug-followup
Date:
January 23, 2003 16:49
Subject:
[perl #20522] perl segfaults growing large Av
Message ID:
rt-20522-49613.3.40840557570985@bugs6.perl.org
# New Ticket Created by  sbeck@gossamer-threads.com 
# Please include the string:  [perl #20522]
# in the subject line of all future correspondence about this issue. 
# <URL: http://rt.perl.org/rt2/Ticket/Display.html?id=20522 >


This is a bug report for perl from sbeck@gossamer-threads.com,
generated with the help of perlbug 1.34 running under perl v5.8.0.


-----------------------------------------------------------------

On my version of perl running:

    perl -we 'print 1043346115 .. 2140038393'

Causes a segfault. After the segfault I recompiled perl with -g
so I could investigate what was causing it. An assertion in
Perl_av_extend caught the problem with -g flag enabled.

    sbeck@sbeck sbeck $ perl -we 'print 1043346115 .. 2140038393'
    Assertion itmp > newmax failed: file "av.c", line 126 at -e line 1.

With further debugging I found:
(gdb) print newmax
$19 = 1103692432
(gdb) print itmp
$20 = 135872276
(gdb) n
121                     itmp = MALLOC_OVERHEAD;
(gdb) l
116     #if defined(STRANGE_MALLOC) || defined(MYMALLOC)
117                     Renew(AvALLOC(av),newmax+1, SV*);
118     #else
119                     bytes = (newmax + 1) * sizeof(SV*);
120     #define MALLOC_OVERHEAD 16
121                     itmp = MALLOC_OVERHEAD;
122                     while ((MEM_SIZE)(itmp - MALLOC_OVERHEAD) <
bytes)
(gdb) print itmp
$21 = 135872276
(gdb) n
122                     while ((MEM_SIZE)(itmp - MALLOC_OVERHEAD) <
bytes)
(gdb) print itmp
$22 = 16
(gdb) print bytes
$23 = 119802436

This is inside av.c Perl_av_extend. It looks like bytes is an unsigned
long which is assgned to

    '(newmax + 1) * sizeof(SV*)' => 4414769732
    wrapped turns into => 119802436

With debug on, the assertion

    assert(itmp > newmax);

Catches this a few lines down. Without debug on I would guess not enough
memory if malloced to contain everything.

[Please do not change anything below this line]
-----------------------------------------------------------------
---
Flags:
    category=core
    severity=low
---
Site configuration information for perl v5.8.0:

Configured by root at Thu Jan 23 13:30:45 PST 2003.

Summary of my perl5 (revision 5.0 version 8 subversion 0) configuration:
  Platform:
    osname=linux, osvers=2.4.19-gentoo-r10, archname=i686-linux
    uname='linux sbeck.office.gossamer-threads.com 2.4.19-gentoo-r10 #3
sat jan 11 16:23:34 pst 2003 i686 amd athlon(tm) xp 1700+ authenticamd
gnulinux '
    config_args='-des -Darchname=i686-linux -Dcc=gcc -Dprefix=/usr
-Dvendorprefix=/usr -Dsiteprefix=/usr -Dlocincpth=  -Doptimize=-g
-Duselargefiles -Dd_dosuid -Dd_semctl_semun -Dscriptdir=/usr/bin
-Dman3ext=3pm -Dcf_by=Gentoo -Ud_csh -Di_gdbm -Di_db -Di_ndbm'
    hint=recommended, useposix=true, d_sigaction=define
    usethreads=undef use5005threads=undef useithreads=undef
usemultiplicity=undef
    useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
    use64bitint=undef use64bitall=undef uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='gcc', ccflags ='-DPERL5 -DDEBUGGING -fno-strict-aliasing
-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
    optimize='-g',
    cppflags='-DPERL5 -DPERL5 -DDEBUGGING -fno-strict-aliasing'
    ccversion='', gccversion='3.2.1 20021207 (Gentoo Linux
3.2.1-20021207)', gccosandvers=''
    intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t',
lseeksize=8
    alignbytes=4, prototype=define
  Linker and Libraries:
    ld='gcc', ldflags =' -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib
    libs=-lnsl -lndbm -lgdbm -ldb -ldl -lm -lc -lcrypt -lutil
    perllibs=-lnsl -ldl -lm -lc -lcrypt -lutil
    libc=/lib/libc-2.3.1.so, so=so, useshrplib=false, libperl=libperl.a
    gnulibc_version='2.3.1'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-rdynamic'
    cccdlflags='-fpic', lddlflags='-shared -L/usr/local/lib'

Locally applied patches:
    

---
@INC for perl v5.8.0:
    /usr/lib/perl5/5.8.0/i686-linux
    /usr/lib/perl5/5.8.0
    /usr/lib/perl5/site_perl/5.8.0/i686-linux
    /usr/lib/perl5/site_perl/5.8.0
    /usr/lib/perl5/site_perl/5.6.1
    /usr/lib/perl5/site_perl
    /usr/lib/perl5/vendor_perl/5.8.0/i686-linux
    /usr/lib/perl5/vendor_perl/5.8.0
    /usr/lib/perl5/vendor_perl
    .

---
Environment for perl v5.8.0:
    HOME=/home/sbeck
    LANG (unset)
    LANGUAGE (unset)
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
   
PATH=/home/sbeck/bin:/usr/local/bin:/opt/gnome/bin:/usr/local/mozilla:/bin:/usr/bin:/usr/local/bin:/opt/bin:/usr/i686-pc-linux-gnu/gcc-bin/3.2:/opt/Acrobat5:/usr/X11R6/bin:/opt/blackdown-jdk-1.4.1_beta/bin:/opt/blackdown-jdk-1.4.1_beta/jre/bin:/usr/qt/3/bin:/usr/kde/3.1/bin:/usr/e17/bin:/usr/qt/2/bin:/usr/kde/3/bin:/usr/games/bin:/opt/vmware/bin
    PERLDOC_PAGER=sh -c 'cat $0 | view -c "set ft=perldoc nomod nolist"
-'
    PERL_BADLANG (unset)
    SHELL=/bin/bash





nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About