[perl #123617] Segfault (stack overflow?) while fuzzing Perl 5.21.8

On Sat Jan 17 17:09:43 2015, hv wrote:
> A perl built with debugging gives:
> 
> % ./perl test.pl
> perl: toke.c:2430: S_sublex_done: Assertion `(PL_parser->lex_inwhat)
> == OP_SUBST || (PL_parser->lex_inwhat) == OP_TRANS' failed.
> Aborted (core dumped)
>  %
> 
> Here's a shorter testcase (which doesn't clarify much):
> 
> % cat test.pl
> "$a{m/""$b
> / m ss
> ";@c = split /x/
>  %
> 
> We seem to have a PL_lex_repl with PL_lex_inwhat == OP_MATCH, which
> clearly
> can't happen.

This is no doubt related to my two favourite japhs:

s||${s/.*/|;
/s}Just another Perl hacker,
print

"${;s/.*/Just an";
other Perl hacker,
/s} die or return;
print

I don’t remember exactly how they work.  At the time I wrote them I based them on the interesting implementation details I saw in toke.c, which had something to do with PL_sublex_info.sub_inwhat.

-- 

Father Chrysostomos


---
via perlbug:  queue: perl5 status: open
https://rt.perl.org/Ticket/Display.html?id=123617

• [perl #123617] Segfault (stack overflow?) while fuzzing Perl 5.21.8 by Father Chrysostomos via RT
• [perl #123617] Segfault (stack overflow?) while fuzzing Perl 5.21.8 by Father Chrysostomos via RT