[perl #129350] null pointer deref Perl_re_intuit_start(regexec.c:1049)

On Sat Sep 24 17:16:05 2016, brian.carpenter@gmail.com wrote:
> This one crashes both Perl 5.20.2 and Perl v5.25.5-8-g3c42ae1. Found
> with AFL+ASAN.
> 
> od -tx1 test32
> 0000000 73 25 25 22 22 26 28 22 18 5c 37 30 30 22 3d 7e
> 0000020 2f 5c 62 5c 7a 30 2a 5c 37 30 30 2f 29 25 65
> 0000037

This is a simple as I can get it:

$ ./miniperl -e '".\x{100}" =~ /\b\z0*\x{100}/'
Segmentation fault: 11

$ ./perl -Ilib -Mre=debug -e '".\x{100}" =~ /\b\z0*\x{100}/'
Compiling REx "\b\z0*\x{100}"
Final program:
   1: BOUNDU (2)
   2: EOS (3)
   3: STAR (6)
   4:   EXACT <0> (0)
   6: EXACT <\x{100}> (8)
   8: END (0)
anchored ""$ at 0 floating utf8 "%x{100}" at 0..9223372036854775807 (checking floating) stclass BOUNDU minlen 1 
Matching REx "\b\z0*\x{100}" against ".%x{100}"
UTF-8 pattern and string...
Intuit: trying to determine minimum start position...
  doing 'check' fbm scan, [0..3] gave 1
  Found floating substr "%x{100}" at offset 1 (rx_origin now 0)...
  (multiline anchor test skipped)
  looking for class: start_shift: 0 check_at: 1 rx_origin: 0 endpos: 1
  This position contradicts STCLASS...
  about to retry anchored at offset 0 (rx_origin now 0)...
Segmentation fault: 11


-- 

Father Chrysostomos


---
via perlbug:  queue: perl5 status: new
https://rt.perl.org/Ticket/Display.html?id=129350

• [perl #129350] null pointer deref Perl_re_intuit_start(regexec.c:1049) by Father Chrysostomos via RT
• [perl #129350] null pointer deref Perl_re_intuit_start(regexec.c:1049) by Brian Carpenter