[perl #129090] Perl_pad_fixup_inner_anons Null reference Memorycorruption

# New Ticket Created by  riusksk 
# Please include the string:  [perl #129090]
# in the subject line of all future correspondence about this issue. 
# <URL: https://rt.perl.org/Ticket/Display.html?id=129090 >


valgrind ../../perl poc
==31369== Memcheck, a memory error detector
==31369== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==31369== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==31369== Command: ../../perl id:000079,sig:11,src:024262,op:havoc,rep:4
==31369== 
==31369== Invalid read of size 8
==31369==    at 0x533C3E: Perl_pad_fixup_inner_anons (pad.c:2382)
==31369==    by 0x44323C: Perl_newATTRSUB_x (op.c:8711)
==31369==    by 0x522E8D: Perl_yyparse (perly.y:296)
==31369==    by 0x48EDC9: S_parse_body (perl.c:2373)
==31369==    by 0x48897F: perl_parse (perl.c:1689)
==31369==    by 0x41F1D3: main (perlmain.c:121)
==31369==  Address 0x5fb9020 is 16 bytes after a block of size 48 in arena "client"
==31369== 
==31369== Invalid read of size 1
==31369==    at 0x533C42: Perl_pad_fixup_inner_anons (pad.c:2378)
==31369==    by 0x44323C: Perl_newATTRSUB_x (op.c:8711)
==31369==    by 0x522E8D: Perl_yyparse (perly.y:296)
==31369==    by 0x48EDC9: S_parse_body (perl.c:2373)
==31369==    by 0x48897F: perl_parse (perl.c:1689)
==31369==    by 0x41F1D3: main (perlmain.c:121)
==31369==  Address 0x29 is not stack'd, malloc'd or (recently) free'd
==31369== 
==31369== 
==31369== Process terminating with default action of signal 11 (SIGSEGV)
==31369==  Access not within mapped region at address 0x29
==31369==    at 0x533C42: Perl_pad_fixup_inner_anons (pad.c:2378)
==31369==    by 0x44323C: Perl_newATTRSUB_x (op.c:8711)
==31369==    by 0x522E8D: Perl_yyparse (perly.y:296)
==31369==    by 0x48EDC9: S_parse_body (perl.c:2373)
==31369==    by 0x48897F: perl_parse (perl.c:1689)
==31369==    by 0x41F1D3: main (perlmain.c:121)
==31369==  If you believe this happened as a result of a stack
==31369==  overflow in your program's main thread (unlikely but
==31369==  possible), you can try to increase the size of the
==31369==  main thread stack using the --main-stacksize= flag.
==31369==  The main thread stack size used in this run was 8388608.
==31369== 
==31369== HEAP SUMMARY:
==31369==     in use at exit: 173,452 bytes in 783 blocks
==31369==   total heap usage: 991 allocs, 208 frees, 190,415 bytes allocated
==31369== 
==31369== LEAK SUMMARY:
==31369==    definitely lost: 320 bytes in 1 blocks
==31369==    indirectly lost: 2,601 bytes in 38 blocks
==31369==      possibly lost: 12,552 bytes in 16 blocks
==31369==    still reachable: 157,979 bytes in 728 blocks
==31369==         suppressed: 0 bytes in 0 blocks
==31369== Rerun with --leak-check=full to see details of leaked memory
==31369== 
==31369== For counts of detected and suppressed errors, rerun with: -v
==31369== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)
Segmentation fault


─➤$ ./perl ../poc.pl                                                       2 ↵
ASAN:SIGSEGV
=================================================================
==14425==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000c (pc 0x000108490338 bp 0x7fff579b32f0 sp 0x7fff579b32a0 T0)
    #0 0x108490337 in Perl_pad_fixup_inner_anons pad.c:2386
    #1 0x1082a1f05 in Perl_newATTRSUB_x op.c:8711
    #2 0x10845cf16 in Perl_yyparse perly.y:296
    #3 0x108355087 in perl_parse perl.c:2373
    #4 0x10824c7ee in main perlmain.c:121
    #5 0x7fff985a95ac in start (/usr/lib/system/libdyld.dylib+0x35ac)
    #6 0x1  (<unknown module>)

• [perl #129090] Perl_pad_fixup_inner_anons Null reference Memorycorruption by Dan Collins via RT
• [perl #129090] Perl_pad_fixup_inner_anons Null reference Memorycorruption by riusksk