Perl core dumps when running out of memory [PATCH]

$ ulimit -v 10000
$ perl -e 'push(@a, "foo") for 1..1e6'
Segmentation fault (core dumped)

The stack in the core dump looks like this:

[...]
#175 0x081011de in PerlIOBuf_get_base ()
#176 0x0810119c in PerlIOBuf_write ()
#177 0x08104993 in PerlIO_puts ()
#178 0x080a3275 in Perl_safesysmalloc ()
#179 0x081011de in PerlIOBuf_get_base ()
#180 0x0810119c in PerlIOBuf_write ()
#181 0x08104993 in PerlIO_puts ()
#182 0x080a3275 in Perl_safesysmalloc ()
#183 0x081011de in PerlIOBuf_get_base ()
#184 0x0810119c in PerlIOBuf_write ()
#185 0x08104993 in PerlIO_puts ()
#186 0x080a3275 in Perl_safesysmalloc ()
#187 0x081011de in PerlIOBuf_get_base ()
#188 0x0810119c in PerlIOBuf_write ()
#189 0x08104993 in PerlIO_puts ()
#190 0x080a3275 in Perl_safesysmalloc ()
#191 0x080b5db8 in Perl_sv_grow ()
#192 0x080b8b52 in Perl_sv_setsv_flags ()
#193 0x080cbe23 in Perl_pp_push ()
#194 0x080adcb8 in Perl_runops_standard ()
#195 0x08060f8a in S_run_body ()
#196 0x08060d82 in perl_run ()
#197 0x0805e2f1 in main ()
#198 0x420156a4 in __libc_start_main () from /lib/tls/libc.so.6

The problem is that Perl_safesysmalloc() calls PerlIO_puts() to print
out the "Out of memory!" message, but PerlIO needs to allocate more
memory to print, so it soon ends up calling Perl_safesysmalloc again
and we recuse until we blow the stack.

I suggest the attached patch to fix this problem.

--- util.c.5.8.3	2004-01-17 15:05:17.000000000 +0100
+++ util.c	2004-01-17 15:13:15.000000000 +0100
@@ -72,7 +72,9 @@
     else if (PL_nomemok)
 	return Nullch;
     else {
-	PerlIO_puts(Perl_error_log,PL_no_mem) FLUSH;
+	/* Can't use PerlIO to write as it allocates memory */
+	PerlLIO_write(PerlIO_fileno(Perl_error_log),
+		      PL_no_mem, strlen(PL_no_mem));
 	my_exit(1);
 	return Nullch;
     }
@@ -119,7 +121,9 @@
     else if (PL_nomemok)
 	return Nullch;
     else {
-	PerlIO_puts(Perl_error_log,PL_no_mem) FLUSH;
+	/* Can't use PerlIO to write as it allocates memory */
+	PerlLIO_write(PerlIO_fileno(Perl_error_log),
+		      PL_no_mem, strlen(PL_no_mem));
 	my_exit(1);
 	return Nullch;
     }
@@ -171,7 +175,9 @@
     else if (PL_nomemok)
 	return Nullch;
     else {
-	PerlIO_puts(Perl_error_log,PL_no_mem) FLUSH;
+	/* Can't use PerlIO to write as it allocates memory */
+	PerlLIO_write(PerlIO_fileno(Perl_error_log),
+		      PL_no_mem, strlen(PL_no_mem));
 	my_exit(1);
 	return Nullch;
     }

• Perl core dumps when running out of memory [PATCH] by Gisle Aas