[perl #112608] panic: sv_setpvn called with negative strlen -1

On Thu Apr 26 08:35:07 2012, sprout wrote:
> On Thu Apr 26 01:20:30 2012, Steve.Hay@verosoftware.com wrote:
> > Father Chrysostomos via RT wrote on 2012-04-26:
> > > I get the same result on a Mac, both
> >    threaded and unthreaded.
> 
> I should have read Leon Timmerman’s message more closely.  If I use
> :crlf:encoding(...) I get the panic, but not with :crlf after.
> 
> > > 
> > > A C backtrace would help.
> > >
> >    Those messages are, of course, expected given what the program is
> >    being asked to do. I get them first too, but then followed by a
> >    crash (panic).
> > 
> > Is it an EOL issue? (I'm running on Windows
> >    here.) Leon mentioned it only happening when :crlf was combined
> >    with :encoding. I still see the crash with
> > 
> > open my $rh,
> >    '<:encoding(UTF-8):crlf', 'utf8.txt' or die $!;
> > open my $wh,
> >    '>:encoding(ISO-8859-1):crlf', 'iso88591.txt' or die $!;
> > 
> > but not
> >    with
> > 
> > open my $rh, '<:raw:encoding(UTF-8)', 'utf8.txt' or die $!;
> >    open my $wh, '>:raw:encoding(ISO-8859-1)', 'iso88591.txt' or die
> >    $!;
> > 
> > Also, when I download the utf8.txt attachment I find that it
> >    has got mangled somehow from what I uploaded: the line endings are
> >    now \r\r\n rather than the \r\n original which I uploaded.
> >    Furthermore, the program doesn't crash for me if I leave it like
> >    that -- I have to convert it back to \r\n before I see the crash
> >    again.
> 
> I think your browser is trying to convert \n to \r\n when you download
> it.  I downloaded the file and it has \r\n line breaks in it.
> 
> > 
> > I will try to get a backtrace.
> 
> I see your backtrace has Encode’s XS code in it.  I will try to dig
deeper.
> 

This is probably a bug in Encode.  I’ve reduced it to a standalone
script (with no input file), attached as foo.text.  (I know, it’s not
much smaller, but it’s easier to handle.)

This code in cpan/Encode/Encode.xs:encode_method:

 ENCODE_SET_SRC:
    if (check && !(check & ENCODE_LEAVE_SRC)){
    sdone = SvCUR(src) - (slen+sdone);
    if (sdone) {
        sv_setpvn(src, (char*)s+slen, sdone);
    }

calls sv_setpvn with 4294967295 for the length argument.

Before this chunk of code is reached, sdone has a value of 1025, but src
is only 1024 octets long.  slen is 0.  So the sdone assignment sets it
to -1, which becomes 4294967295 because sdone is unsigned.

So somehow Encode is losing track of how far it is through the string.

-- 

Father Chrysostomos


---
via perlbug:  queue: perl5 status: open
https://rt.perl.org:443/rt3/Ticket/Display.html?id=112608

• [perl #112608] panic: sv_setpvn called with negative strlen -1 by Steve Hay
• Re: [perl #112608] panic: sv_setpvn called with negative strlen -1 by Leon Timmermans
• Re: [perl #112608] panic: sv_setpvn called with negative strlen -1 by Karl Williamson
• [perl #112608] panic: sv_setpvn called with negative strlen -1 by Father Chrysostomos via RT
• RE: [perl #112608] panic: sv_setpvn called with negative strlen -1 by Steve Hay
• RE: [perl #112608] panic: sv_setpvn called with negative strlen -1 by Steve Hay
• [perl #112608] panic: sv_setpvn called with negative strlen -1 by Steve Hay via RT
• [perl #112608] panic: sv_setpvn called with negative strlen -1 by Father Chrysostomos via RT
• [perl #112608] panic: sv_setpvn called with negative strlen -1 by Father Chrysostomos via RT
• [rt.cpan.org #76824] [perl #112608] panic: sv_setpvn called withnegative strlen -1 by Pali via RT