Perl crash with recursive sub and regex with code eval. #22869
Comments
|
Crash stack (blead): Valgrind indicates this is a use-after-free: |
I found that if I modified the test program as follows to include |
|
Interesting... Just checked, if you add (btw I thought |
|
The crashing regex compiles to: Without the alternate i.e. The backtracking interplay between the TRIE-EXACT and OPFAIL seems to matter. The last few steps of re debugging output are: |
|
This also crashes, so it's not specific to TRIE-EXACT: |
|
I did a little testing with ASan, seems to be related to qr// handling. This works without issues: use v5.40;
sub foo($x) {
say $x || '- fin -';
$x =~ /^aa?(*{foo(substr $_, pos)})(*F)/o;
}
foo 'aaaaaaaaaaa';ASan summary (when using qr//): ==111559==ERROR: AddressSanitizer: heap-use-after-free on address 0x503000001818 at pc 0x636d608b6668 bp 0x7fffe54f9240 sp 0x7fffe54f9230
WRITE of size 8 at 0x503000001818 thread T0
#0 0x636d608b6667 in S_regmatch regexec.c:8335
#1 0x636d608b6ba2 in S_regtry regexec.c:4422
#2 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#3 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#4 0x636d60521d06 in Perl_runops_debug dump.c:2998
#5 0x636d6089bcb2 in S_regmatch regexec.c:8352
#6 0x636d608b6ba2 in S_regtry regexec.c:4422
#7 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#8 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#9 0x636d60521d06 in Perl_runops_debug dump.c:2998
#10 0x636d6089bcb2 in S_regmatch regexec.c:8352
#11 0x636d608b6ba2 in S_regtry regexec.c:4422
#12 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#13 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#14 0x636d60521d06 in Perl_runops_debug dump.c:2998
#15 0x636d604e0fc5 in S_run_body perl.c:2883
#16 0x636d604e0fc5 in perl_run perl.c:2798
#17 0x636d6045239f in main perlmain.c:127
#18 0x7bbcf0c34e07 (/usr/lib/libc.so.6+0x25e07) (BuildId: 98b3d8e0b8c534c769cb871c438b4f8f3a8e4bf3)
#19 0x7bbcf0c34ecb in __libc_start_main (/usr/lib/libc.so.6+0x25ecb) (BuildId: 98b3d8e0b8c534c769cb871c438b4f8f3a8e4bf3)
#20 0x636d60452b04 in _start (perl+0x1adb04) (BuildId: fe6c66138928c1eb6c9dd7687e6331b2c8fb5f4e)
0x503000001818 is located 8 bytes inside of 24-byte region [0x503000001810,0x503000001828)
freed by thread T0 here:
#0 0x7bbcf0efc282 in free /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x636d607c6313 in Perl_pregfree2 regcomp.c:13288
#2 0x636d608fd751 in Perl_sv_clear sv.c:6812
#3 0x636d60900587 in Perl_sv_free2 sv.c:7337
#4 0x636d606a5a7e in Perl_SvREFCNT_dec sv_inline.h:696
#5 0x636d606a5a7e in Perl_pp_regcomp pp_ctl.c:163
#6 0x636d60521d06 in Perl_runops_debug dump.c:2998
#7 0x636d6089bcb2 in S_regmatch regexec.c:8352
#8 0x636d608b6ba2 in S_regtry regexec.c:4422
#9 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#10 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#11 0x636d60521d06 in Perl_runops_debug dump.c:2998
#12 0x636d6089bcb2 in S_regmatch regexec.c:8352
#13 0x636d608b6ba2 in S_regtry regexec.c:4422
#14 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#15 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#16 0x636d60521d06 in Perl_runops_debug dump.c:2998
#17 0x636d6089bcb2 in S_regmatch regexec.c:8352
#18 0x636d608b6ba2 in S_regtry regexec.c:4422
#19 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#20 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#21 0x636d60521d06 in Perl_runops_debug dump.c:2998
#22 0x636d6089bcb2 in S_regmatch regexec.c:8352
#23 0x636d608b6ba2 in S_regtry regexec.c:4422
#24 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#25 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#26 0x636d60521d06 in Perl_runops_debug dump.c:2998
#27 0x636d6089bcb2 in S_regmatch regexec.c:8352
#28 0x636d608b6ba2 in S_regtry regexec.c:4422
#29 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#30 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
previously allocated by thread T0 here:
#0 0x7bbcf0efd891 in malloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x636d60a1b978 in Perl_safesysmalloc util.c:176
#2 0x636d607c72df in Perl_reg_temp_copy regcomp.c:13397
#3 0x636d606a4ffa in Perl_pp_regcomp pp_ctl.c:157
#4 0x636d60521d06 in Perl_runops_debug dump.c:2998
#5 0x636d6089bcb2 in S_regmatch regexec.c:8352
#6 0x636d608b6ba2 in S_regtry regexec.c:4422
#7 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#8 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#9 0x636d60521d06 in Perl_runops_debug dump.c:2998
#10 0x636d6089bcb2 in S_regmatch regexec.c:8352
#11 0x636d608b6ba2 in S_regtry regexec.c:4422
#12 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#13 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#14 0x636d60521d06 in Perl_runops_debug dump.c:2998
#15 0x636d6089bcb2 in S_regmatch regexec.c:8352
#16 0x636d608b6ba2 in S_regtry regexec.c:4422
#17 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#18 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#19 0x636d60521d06 in Perl_runops_debug dump.c:2998
#20 0x636d6089bcb2 in S_regmatch regexec.c:8352
#21 0x636d608b6ba2 in S_regtry regexec.c:4422
#22 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#23 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#24 0x636d60521d06 in Perl_runops_debug dump.c:2998
#25 0x636d6089bcb2 in S_regmatch regexec.c:8352
#26 0x636d608b6ba2 in S_regtry regexec.c:4422
#27 0x636d608d5b90 in Perl_regexec_flags regexec.c:3941
#28 0x636d606eef46 in Perl_pp_match pp_hot.c:3829
#29 0x636d60521d06 in Perl_runops_debug dump.c:2998
SUMMARY: AddressSanitizer: heap-use-after-free regexec.c:8335 in S_regmatch
Shadow bytes around the buggy address:
0x503000001580: fd fa fa fa fd fd fd fd fa fa 00 00 00 fa fa fa
0x503000001600: fd fd fd fa fa fa fd fd fd fd fa fa fd fd fd fa
0x503000001680: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
0x503000001700: fd fa fa fa 00 00 00 00 fa fa fd fd fd fa fa fa
0x503000001780: 00 00 00 00 fa fa fd fd fd fa fa fa fd fd fd fa
=>0x503000001800: fa fa fd[fd]fd fa fa fa fd fd fd fa fa fa 00 00
0x503000001880: 00 fa fa fa fd fd fd fa fa fa 00 00 00 fa fa fa
0x503000001900: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000001980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000001a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000001a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==111559==ABORTING |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
Perl crashes (malloc assertion or general segfault) when trying to run the following script:
Steps to Reproduce
Expected behavior
The code should run.
Perl configuration
The text was updated successfully, but these errors were encountered: