develooper Front page | perl.perl5.porters | Postings from February 2015

[perl #123736] Perl_utf16_to_utf8: Assertion `(sizeof((uv)) == 1) || !(((unsigned long)((uv))) & ~0x3FF)' failed (utf8.c:1273)

Thread Previous
From:
Brian Carpenter
Date:
February 5, 2015 04:54
Subject:
[perl #123736] Perl_utf16_to_utf8: Assertion `(sizeof((uv)) == 1) || !(((unsigned long)((uv))) & ~0x3FF)' failed (utf8.c:1273)
Message ID:
rt-4.0.18-23795-1423112060-1564.123736-75-0@perl.org
# New Ticket Created by  Brian Carpenter 
# Please include the string:  [perl #123736]
# in the subject line of all future correspondence about this issue. 
# <URL: https://rt.perl.org/Ticket/Display.html?id=123736 >


Built v5.21.9 (v5.21.8-200-ga57d3d4) using the following command line:

./Configure -des -Dusedevel -DDEBUGGING -Dcc=afl-gcc -Doptimize=-O2\ -g && AFL_HARDEN=1 make -j6 test-prep

Bug found with AFL (http://lcamtuf.coredump.cx/afl)

GDB output:
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
perl: utf8.c:1273: Perl_utf16_to_utf8: Assertion `(sizeof((uv)) == 1) || !(((unsigned long)((uv))) & ~0x3FF)' failed.

Program received signal SIGABRT, Aborted.
[----------------------------------registers-----------------------------------]
RAX: 0x0 
RBX: 0x7fffffffe617 --> 0x3a6469006c726570 ('perl')
RCX: 0xffffffffffffffff 
RDX: 0x6 
RSI: 0x18b8 
RDI: 0x18b8 
RBP: 0x7ffff6ea9a07 --> 0x257325732500203a (': ')
RSP: 0x7fffffffd658 --> 0x7ffff6d923e0 (<*__GI_abort+384>:	mov    rdx,QWORD PTR fs:0x10)
RIP: 0x7ffff6d8f165 (<*__GI_raise+53>:	cmp    rax,0xfffffffffffff000)
R8 : 0x7ffff7fdd700 (0x00007ffff7fdd700)
R9 : 0x6f6c2064656e6769 ('igned lo')
R10: 0x8 
R11: 0x206 
R12: 0xf2bb08 ("(sizeof((uv)) == 1) || !(((unsigned long)((uv))) & ~0x3FF)")
R13: 0xf2cae0 ("Perl_utf16_to_utf8")
R14: 0x7ffff6ea9a07 --> 0x257325732500203a (': ')
R15: 0x4f9
EFLAGS: 0x206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x7ffff6d8f15b <*__GI_raise+43>:	movsxd rdi,eax
   0x7ffff6d8f15e <*__GI_raise+46>:	mov    eax,0xea
   0x7ffff6d8f163 <*__GI_raise+51>:	syscall 
=> 0x7ffff6d8f165 <*__GI_raise+53>:	cmp    rax,0xfffffffffffff000
   0x7ffff6d8f16b <*__GI_raise+59>:	ja     0x7ffff6d8f182 <*__GI_raise+82>
   0x7ffff6d8f16d <*__GI_raise+61>:	repz ret 
   0x7ffff6d8f16f <*__GI_raise+63>:	nop
   0x7ffff6d8f170 <*__GI_raise+64>:	test   eax,eax
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffd658 --> 0x7ffff6d923e0 (<*__GI_abort+384>:	mov    rdx,QWORD PTR fs:0x10)
0008| 0x7fffffffd660 --> 0xf2bb08 ("(sizeof((uv)) == 1) || !(((unsigned long)((uv))) & ~0x3FF)")
0016| 0x7fffffffd668 --> 0x7ffff6eab9c1 --> 0x706c6568007325 ('%s')
0024| 0x7fffffffd670 --> 0x7fffffffd690 --> 0x3000000018 
0032| 0x7fffffffd678 --> 0x4f9 
0040| 0x7fffffffd680 --> 0x7fffffffd780 --> 0x7fffffffe617 --> 0x3a6469006c726570 ('perl')
0048| 0x7fffffffd688 --> 0x7ffff6dc3fe6 (<__fxprintf+310>:	lea    rsp,[rbp-0x20])
0056| 0x7fffffffd690 --> 0x3000000018 
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGABRT
0x00007ffff6d8f165 in *__GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
gdb-peda$ bt
#0  0x00007ffff6d8f165 in *__GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff6d923e0 in *__GI_abort () at abort.c:92
#2  0x00007ffff6d88311 in *__GI___assert_fail (assertion=assertion@entry=0xf2bb08 "(sizeof((uv)) == 1) || !(((unsigned long)((uv))) & ~0x3FF)", file=<optimized out>, file@entry=0xf2af29 "utf8.c", line=line@entry=0x4f9, function=function@entry=0xf2cae0 "Perl_utf16_to_utf8") at assert.c:81
#3  0x0000000000cf2c31 in Perl_utf16_to_utf8 (p=<optimized out>, d=<optimized out>, bytelen=<optimized out>, newlen=<optimized out>) at utf8.c:1273
#4  0x00000000005a049e in S_utf16_textfilter (idx=0x0, sv=0x117a0d8, maxlen=<optimized out>) at toke.c:10929
#5  0x00000000004263f4 in S_add_utf16_textfilter (s=s@entry=0x1182122 "\004", reversed=reversed@entry=0x0) at toke.c:10969
#6  0x0000000000632e7a in S_swallow_bom (s=0x1182122 "\004") at toke.c:10804
#7  Perl_yylex () at toke.c:4735
#8  0x000000000065c275 in Perl_yyparse (gramtype=<optimized out>) at perly.c:322
#9  0x000000000052d275 in S_parse_body (env=env@entry=0x0, xsinit=xsinit@entry=0x42d080 <xs_init>) at perl.c:2273
#10 0x000000000053324f in perl_parse (my_perl=<optimized out>, xsinit=0x42d080 <xs_init>, argc=<optimized out>, argv=<optimized out>, env=0x0) at perl.c:1607
#11 0x000000000042cc8c in main (argc=0x2, argv=0x7fffffffe398, env=0x7fffffffe3b0) at perlmain.c:114
#12 0x00007ffff6d7bead in __libc_start_main (main=<optimized out>, argc=<optimized out>, ubp_av=<optimized out>, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe388) at libc-start.c:244
#13 0x000000000042cfa5 in _start ()

Test case hexdump:
0000000 fffe 0004                              
0000004
Thread Previous


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About