develooper Front page | perl.perl5.porters | Postings from July 2013

[perl #115752] crash with invalid free in regex engine

Thread Previous
From:
Father Chrysostomos via RT
Date:
July 27, 2013 13:54
Subject:
[perl #115752] crash with invalid free in regex engine
Message ID:
rt-3.6.HEAD-2552-1374933241-46.115752-15-0@perl.org
On Sat Jul 27 01:04:34 2013, andreas.koenig.7os6VVqR@franz.ak.mind.de wrote:
> "Father Chrysostomos via RT" <perlbug-followup@perl.org> writes:
> 
> > On Thu Nov 15 17:21:55 2012, mauke- wrote:
> >> $ cat irc.pl
> >> #!/usr/bin/perl
> >> use warnings;
> >> use strict;
> >>
> >> for my $num ('4000752057698530', '4000608912607415',
> >>    '4000966220145415') {
> >>     my $tmp = $num;
> >>     my $x;
> >>     $tmp =~ s/^(.{6})(.*?)(?{ $x = $^N; $x =~ s{.}{%}g;
> >>    })(.{4})$/$1#$2/;
> >> }
> >> __END__
> >
> > This appears to be fixed in blead.  Anyone want to do a bisect?
> 
> I did not see the double free corruption,

I think Dave Mitchell’s re-eval work fixed that in 5.18.

> just the unini warnings,
> hope
> this would trigger the same result.
> 
> commit f5df269c5cef57294662d0b1f80a468b91f13643
> Author: Father Chrysostomos <sprout@cpan.org>
> Date:   Fri Jul 5 23:59:46 2013 -0700
> 
>     [perl #117917] /(?{ m|...| }) (?{ $1 })/
> 
>     A regular expression invoked inside a regular expression code
> block
>     can cause other code blocks in the same outer regular expression
> to
>     see the wrong values in $1.
...
> bisect run success
> That took 459 seconds

Thank you.  That makes sense.  Closing ticket.

-- 

Father Chrysostomos


---
via perlbug:  queue: perl5 status: open
https://rt.perl.org:443/rt3/Ticket/Display.html?id=115752

Thread Previous


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About