develooper Front page | perl.perl5.porters | Postings from August 2019

[perl #134342] Invalid read of size 4

Thread Next
From:
Manh-Dung Nguyen
Date:
August 7, 2019 08:38
Subject:
[perl #134342] Invalid read of size 4
Message ID:
rt-4.0.24-10694-1565167101-419.134342-75-0@perl.org
# New Ticket Created by  Manh-Dung Nguyen 
# Please include the string:  [perl #134342]
# in the subject line of all future correspondence about this issue. 
# <URL: https://rt.perl.org/Ticket/Display.html?id=134342 >


Hi All,
I found an invalid read bug of size 4 in the commit *45f8e7b* on branch
*blead*. This bug causes Perl to crash. I use gcc v5.5.0 to compile Perl on
Ubuntu 16.04 (64 bit) as follows:
   ./Configure -des -Dusedevel -Dprefix=`pwd` -Dccflags="-g" -Dloclibpth='
'; make

Thanks,
Manh Dung

======================================
*perl -v*
This is perl 5, version 31, subversion 3 (v5.31.3 (v5.31.2-37-ga3c7756))
built for x86_64-linux

- Crafted PoC:
https://github.com/strongcourage/PoCs/blob/master/perl_82007f7/PoC_segv_mro_core.c:501
- Command: perl $PoC

Valgrind says:
==10475== Invalid read of size 4
==10475==    at 0x4B4EC7: Perl_mro_isa_changed_in (mro_core.c:501)
==10475==    by 0x4B5769: Perl_mro_package_moved (mro_core.c:877)
==10475==    by 0x4DD485: S_glob_assign_glob (sv.c:3936)
==10475==    by 0x4D7917: Perl_sv_setsv_flags (sv.c:4418)
==10475==    by 0x4C2328: Perl_pp_sassign (pp_hot.c:226)
==10475==    by 0x4C1C72: Perl_runops_standard (run.c:41)
==10475==    by 0x446595: S_run_body (perl.c:2701)
==10475==    by 0x446595: perl_run (perl.c:2624)
==10475==    by 0x421814: main (perlmain.c:127)
==10475==  Address 0x4 is not stack'd, malloc'd or (recently) free'd

ASAN says:
==7970==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc
0x0000005d02a7 bp 0x7ffea50397e0 sp 0x7ffea50396f0 T0)
    #0 0x5d02a6 in Perl_mro_isa_changed_in
/home/dungnguyen/gueb-testing/perl-head/mro_core.c:501
    #1 0x5d1c43 in Perl_mro_package_moved
/home/dungnguyen/gueb-testing/perl-head/mro_core.c:877
    #2 0x64a131 in S_glob_assign_glob
/home/dungnguyen/gueb-testing/perl-head/sv.c:3936
    #3 0x6375dd in Perl_sv_setsv_flags
/home/dungnguyen/gueb-testing/perl-head/sv.c:4418
    #4 0x5fb863 in Perl_pp_sassign
/home/dungnguyen/gueb-testing/perl-head/pp_hot.c:226
    #5 0x5fa20a in Perl_runops_standard
/home/dungnguyen/gueb-testing/perl-head/run.c:41
    #6 0x48f0b7 in S_run_body
/home/dungnguyen/gueb-testing/perl-head/perl.c:2696
    #7 0x48f0b7 in perl_run
/home/dungnguyen/gueb-testing/perl-head/perl.c:2624
    #8 0x425674 in main
/home/dungnguyen/gueb-testing/perl-head/perlmain.c:127
    #9 0x7fcc2a3cc82f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #10 0x425be8 in _start
(/home/dungnguyen/PoCs/perl_82007f7/perl-asan+0x425be8)
======================================


Thread Next


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About