[perl #50270] Perl 5.8.8: double free occurs with s/// + loop + recursion

# New Ticket Created by  "Kazutaka Matsuda" 
# Please include the string:  [perl #50270]
# in the subject line of all future correspondence about this issue. 
# <URL: http://rt.perl.org/rt3/Ticket/Display.html?id=50270 >


The following perl code aborts with double-free-error on Perl 5.8.8
while it runs properly on Perl 5.10.0.

  my $str = "aabaa";
  func1($str);

  sub func1 {
    my $str = shift;
    my $r1 = qr/a/;
    my $r2 = qr/something_cannot_be_matched/;
    print "[1]",$str,"\n";

    my @qr = map {qr{${_}(.+)}} ($r1,$r2);
    for my $qr (@qr) {
      $str =~ s{$qr}{func2($1)}eg;
    }
    return $str;
  }

  sub func2 {
    my $str = shift;
    my $r   = shift;
    print "[2]",$str,"\n";
    my $qr  = qr/(ab.+)/;
    $str =~ s{$qr}{func1($1)}ge;
    return $str;
  }

The following in the output of the above code.

  [1]aabaa
  [2]abaa
  [1]abaa
  [2]baa
  *** glibc detected *** double free or corruption (fasttop): 0x0816e318 ***
  Aborted

---
Flags:
  category=core
  severity=low
---
Site configuration information for perl v5.8.8:

Configured by Debian Project at Mon Nov  5 06:19:33 UTC 2007.

Summary of my perl5 (revision 5 version 8 subversion 8) configuration:
 Platform:
  osname=linux, osvers=2.6.22-3-amd64, archname=i486-linux-gnu-thread-multi
  uname='linux deneb 2.6.22-3-amd64 #1 smp thu oct 11 15:23:23 utc
2007 i686 gnulinux '
  config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN
-Dcccdlflags=-fPIC -Darchname=i486-linux-gnu -Dprefix=/usr
-Dprivlib=/usr/share/perl/5.8 -Darchlib=/usr/lib/perl/5.8
-Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5
-Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local
-Dsitelib=/usr/local/share/perl/5.8.8
-Dsitearch=/usr/local/lib/perl/5.8.8 -Dman1dir=/usr/share/man/man1
-Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1
-Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl
-Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Uusesfio -Uusenm
-Duseshrplib -Dlibperl=libperl.so.5.8.8 -Dd_dosuid -des'
  hint=recommended, useposix=true, d_sigaction=define
  usethreads=define use5005threads=undef useithreads=define
usemultiplicity=define
  useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
  use64bitint=undef use64bitall=undef uselongdouble=undef
  usemymalloc=n, bincompat5005=undef
 Compiler:
  cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS
-DDEBIAN -fno-strict-aliasing -pipe -I/usr/local/include
-D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
  optimize='-O2',
  cppflags='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN
-fno-strict-aliasing -pipe -I/usr/local/include'
  ccversion='', gccversion='4.1.2 20061115 (prerelease) (Debian
4.1.1-21)', gccosandvers=''
  intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
  d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
  ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t',
lseeksize=8
  alignbytes=4, prototype=define
 Linker and Libraries:
  ld='cc', ldflags =' -L/usr/local/lib'
  libpth=/usr/local/lib /lib /usr/lib
  libs=-lgdbm -lgdbm_compat -ldb -ldl -lm -lpthread -lc -lcrypt
  perllibs=-ldl -lm -lpthread -lc -lcrypt
  libc=/lib/libc-2.3.6.so, so=so, useshrplib=true, libperl=libperl.so.5.8.8
  gnulibc_version='2.3.6'
 Dynamic Linking:
  dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
  cccdlflags='-fPIC', lddlflags='-shared -L/usr/local/lib'

Locally applied patches:


---
@INC for perl v5.8.8:
  /etc/perl
  /usr/local/lib/perl/5.8.8
  /usr/local/share/perl/5.8.8
  /usr/lib/perl5
  /usr/share/perl5
  /usr/lib/perl/5.8
  /usr/share/perl/5.8
  /usr/local/lib/site_perl
  .

---
Environment for perl v5.8.8:
  HOME=/home/kztk
  LANG (unset)
  LANGUAGE (unset)
  LD_LIBRARY_PATH (unset)
  LOGDIR (unset)
  PATH=/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games
  PERL_BADLANG (unset)
  SHELL=/bin/bash

• [perl #50270] Perl 5.8.8: double free occurs with s/// + loop + recursion by Kazutaka Matsuda
• Re: [perl #50270] Perl 5.8.8: double free occurs with s/// + loop + recursion by andreas.koenig.7os6VVqR