p5pRT
commented
8 years ago From @dcollinsn
Greetings Porters\,
I have compiled bleadperl with the afl-gcc compiler using:
./Configure -Dusedevel -Dprefix='/usr/local/perl-afl' -Dcc='ccache afl-gcc' -Duselongdouble -Duse64bitint -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -des AFL_HARDEN=1 make && make test
And then fuzzed the resulting binary using:
AFL_NO_VAR_CHECK=1 afl-fuzz -i in -o out bin/perl @@
After reducing testcases using `afl-tmin` and filtering out testcases that are merely iterations of "#!perl -u"\, I have located the following testcase that triggers a segmentation fault in the perl interpreter. The testcase is the 19-character file:
%0=f fffff%::=fffff
which was further manually reduced to the 8-character file:
f f%::=f
Debugging perls instead report:
miniperl: hv.c:355: Perl_hv_common: Assertion `((svtype)((hv)->sv_flags & 0xff)) == SVt_PVHV' failed.
Expected behavior is the same as the similar test 'f f$::=f'\, which crashes with "Can't locate object method "f" via package "f" (perhaps you forgot to load "f"?)". Once upon a time that happened\, however\, interestingly\, that changed when xdg added code to automatically require IO::File when a filehandle method call would fail because the method would not be found (see bisect). What's more\, I tested:
dcollins@nightshade:/usr/local/perl-afl/out$ ../bin/perl -e 'f f%::=f' Segmentation fault dcollins@nightshade:/usr/local/perl-afl/out$ ../bin/perl -MIO::File -e 'f f%::=f' Can't locate object method "f" via package "IO::File" at -e line 1.
So it seems like this is some weird case of an error while loading the module in this way\, or loading it while this odd construct is on the stack.
**GDB**
dcollins@nightshade:\~/perl$ gdb --args ./perl ../crash GNU gdb (GDB) 7.10 Copyright (C) 2015 Free Software Foundation\, Inc. License GPLv3+: GNU GPL version 3 or later \<http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY\, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i686-pc-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions\, please see: \<http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: \<http://www.gnu.org/software/gdb/documentation/>. For help\, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from ./perl...done. (gdb) run Starting program: /home/dcollins/perl/perl ../crash [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/libthread_db.so.1".
Program received signal SIGSEGV\, Segmentation fault.
0x08325e4c in Perl_hv_common (hv=0x87db2e0\, keysv=0x0\,
key=0x8725f9f "require"\, klen=7\, flags=\
Inferior 1 [process 6902] will be killed.
Quit anyway? (y or n) y
'entry' is set to this value on line 637\, entry = (HvARRAY(hv))[hash & (I32) HvMAX(hv)];
where\,
(gdb) p hash
$3 = 4130847814
(gdb) p hv
$4 = (HV *) 0x822e2e0
(gdb) p *hv
$5 = {sv_any = 0x822ef58\, sv_refcnt = 1\, sv_flags = 268452867\, sv_u = {
svu_pv = 0x82393e4 "CORE"\, svu_iv = 136549348\, svu_uv = 136549348\,
svu_rv = 0x82393e4\, svu_rx = 0x82393e4\, svu_array = 0x82393e4\,
svu_hash = 0x82393e4\, svu_gp = 0x82393e4\, svu_fp = 0x82393e4}}
sv_flags decodes to 0x10004403\, SVf_IsCOW | SVp_POK | SVf_POK | SVt_PV. I'm not sure if sv_flags is corrupted here or if sv_u is\, but entry is getting "CORE" written to it (0x45524f43 decodes to "EROC") instead of a pointer value.
**VALGRIND**
dcollins@nightshade:\~/perl$ valgrind ./perl ../crash ==11682== Memcheck\, a memory error detector ==11682== Copyright (C) 2002-2013\, and GNU GPL'd\, by Julian Seward et al. ==11682== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info ==11682== Command: ./perl ../crash ==11682== ==11682== Invalid read of size 4 ==11682== at 0x8325E4C: Perl_hv_common (hv.c:671) ==11682== by 0x83288C5: Perl_hv_common_key_len (hv.c:333) ==11682== by 0x813D435: Perl_gv_override (gv.c:3592) ==11682== by 0x80CDF4E: Perl_ck_require (op.c:10644) ==11682== by 0x80A4AD6: Perl_newUNOP (op.c:4809) ==11682== by 0x81CF858: Perl_yyparse (perly.y:1004) ==11682== by 0x846D51C: S_doeval (pp_ctl.c:3391) ==11682== by 0x84D05C5: Perl_pp_entereval (pp_ctl.c:4198) ==11682== by 0x80FDA65: Perl_eval_sv (perl.c:2882) ==11682== by 0x80FE601: Perl_require_pv (perl.c:2989) ==11682== by 0x8121DDC: Perl_gv_fetchmethod_pvn_flags (gv.c:1088) ==11682== by 0x8123199: Perl_gv_fetchmethod_sv_flags (gv.c:1001) ==11682== Address 0x45524f47 is not stack'd\, malloc'd or (recently) free'd ==11682== ==11682== ==11682== Process terminating with default action of signal 11 (SIGSEGV) ==11682== Access not within mapped region at address 0x45524F47 ==11682== at 0x8325E4C: Perl_hv_common (hv.c:671) ==11682== by 0x83288C5: Perl_hv_common_key_len (hv.c:333) ==11682== by 0x813D435: Perl_gv_override (gv.c:3592) ==11682== by 0x80CDF4E: Perl_ck_require (op.c:10644) ==11682== by 0x80A4AD6: Perl_newUNOP (op.c:4809) ==11682== by 0x81CF858: Perl_yyparse (perly.y:1004) ==11682== by 0x846D51C: S_doeval (pp_ctl.c:3391) ==11682== by 0x84D05C5: Perl_pp_entereval (pp_ctl.c:4198) ==11682== by 0x80FDA65: Perl_eval_sv (perl.c:2882) ==11682== by 0x80FE601: Perl_require_pv (perl.c:2989) ==11682== by 0x8121DDC: Perl_gv_fetchmethod_pvn_flags (gv.c:1088) ==11682== by 0x8123199: Perl_gv_fetchmethod_sv_flags (gv.c:1001) ==11682== If you believe this happened as a result of a stack ==11682== overflow in your program's main thread (unlikely but ==11682== possible)\, you can try to increase the size of the ==11682== main thread stack using the --main-stacksize= flag. ==11682== The main thread stack size used in this run was 8388608. ==11682== ==11682== HEAP SUMMARY: ==11682== in use at exit: 90\,158 bytes in 421 blocks ==11682== total heap usage: 843 allocs\, 422 frees\, 118\,299 bytes allocated ==11682== ==11682== LEAK SUMMARY: ==11682== definitely lost: 156 bytes in 1 blocks ==11682== indirectly lost: 2\,592 bytes in 37 blocks ==11682== possibly lost: 0 bytes in 0 blocks ==11682== still reachable: 87\,410 bytes in 383 blocks ==11682== suppressed: 0 bytes in 0 blocks ==11682== Rerun with --leak-check=full to see details of leaked memory ==11682== ==11682== For counts of detected and suppressed errors\, rerun with: -v ==11682== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0) Segmentation fault
**BISECT**
15e6cdd91beb4cefae4b65e855d68cf64766965d is the first bad commit commit 15e6cdd91beb4cefae4b65e855d68cf64766965d Author: David Golden \dagolden@​cpan\.org Date: Sun Nov 28 23:12:12 2010 -0500
Filehandle method calls load IO::File on demand
When a method call on a filehandle would die because the method can not
be resolved and L\<IO::File> has not been loaded\, Perl now loads IO::File
via C\
open my $fh\, ">"\, $file;
$fh->binmode(":raw"); # loads IO::File and succeeds
This also works for globs like STDOUT\, STDERR and STDIN:
STDOUT->autoflush(1);
Because this on-demand load only happens if method resolution fails\, the
legacy approach of manually loading an IO::File parent class for partial
method support still works as expected:
use IO::Handle;
open my $fh\, ">"\, $file;
$fh->autoflush(1); # IO::File not loaded
:100644 100644 5ddf5ccc2d313c25b50eebbb6f75cc6bdf8b2e8c d9281f462a045d2bbe376d81a8b86a974032156c M MANIFEST :100644 100644 5fd385bd11b37a1c8c20146b1818e751376ec45e 4775bccf3701af1b081a9bf3ee1c30c68f177b9b M gv.c :040000 040000 af27b0f4e6fb40d5844054153ea1db83456d7f2c e41af2cb54480c0010fbde174abab7036745f482 M pod :040000 040000 1c79c8de724651339b2360962d73754e999cc5b5 e4fb3294c6b8f2a69a4ccb849898ad8d6884bd91 M t bisect run success
**PERL -V**
dcollins@nightshade:\~/perl$ ./perl -Ilib -V Summary of my perl5 (revision 5 version 23 subversion 4) configuration: Commit id: e120c24fe257993e9cbf4c567194bec2792f3ccc Platform: osname=linux\, osvers=2.6.32-5-686\, archname=i686-linux-64int-ld uname='linux nightshade 2.6.32-5-686 #1 smp tue may 13 16:33:32 utc 2014 i686 gnulinux ' config_args='-Dusedevel -Dprefix=/usr/local/perl-afl -Dcc=ccache afl-gcc -Duselongdouble -Duse64bitint -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -des' hint=recommended\, useposix=true\, d_sigaction=define useithreads=undef\, usemultiplicity=undef use64bitint=define\, use64bitall=undef\, uselongdouble=define usemymalloc=n\, bincompat5005=undef Compiler: cc='ccache afl-gcc'\, ccflags ='-fwrapv -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64'\, optimize='-g'\, cppflags='-fwrapv -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include' ccversion=''\, gccversion='5.2.0'\, gccosandvers='' intsize=4\, longsize=4\, ptrsize=4\, doublesize=8\, byteorder=12345678\, doublekind=3 d_longlong=define\, longlongsize=8\, d_longdbl=define\, longdblsize=12\, longdblkind=3 ivtype='long long'\, ivsize=8\, nvtype='long double'\, nvsize=12\, Off_t='off_t'\, lseeksize=8 alignbytes=4\, prototype=define Linker and Libraries: ld='ccache afl-gcc'\, ldflags =' -fstack-protector-strong -L/usr/local/lib' libpth=/usr/local/lib /usr/local/lib/gcc/i686-pc-linux-gnu/5.2.0/include-fixed /usr/lib /lib/../lib /usr/lib/../lib /lib /usr/lib/i486-linux-gnu /usr/lib64 libs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc perllibs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc libc=libc-2.22.so\, so=so\, useshrplib=false\, libperl=libperl.a gnulibc_version='2.22' Dynamic Linking: dlsrc=dl_dlopen.xs\, dlext=so\, d_dlsymun=undef\, ccdlflags='-Wl\,-E' cccdlflags='-fPIC'\, lddlflags='-shared -g -L/usr/local/lib -fstack-protector-strong'
Characteristics of this binary (from libperl): Compile-time options: HAS_TIMES PERLIO_LAYERS PERL_COPY_ON_WRITE PERL_DONT_CREATE_GVSV PERL_HASH_FUNC_ONE_AT_A_TIME_HARD PERL_MALLOC_WRAP PERL_PRESERVE_IVUV PERL_USE_DEVEL USE_64_BIT_INT USE_LARGE_FILES USE_LOCALE USE_LOCALE_COLLATE USE_LOCALE_CTYPE USE_LOCALE_NUMERIC USE_LOCALE_TIME USE_LONG_DOUBLE USE_PERLIO USE_PERL_ATOF Built under linux Compiled at Sep 25 2015 09:13:06 @INC: lib /usr/local/perl-afl/lib/site_perl/5.23.4/i686-linux-64int-ld /usr/local/perl-afl/lib/site_perl/5.23.4 /usr/local/perl-afl/lib/5.23.4/i686-linux-64int-ld /usr/local/perl-afl/lib/5.23.4 /usr/local/perl-afl/lib/site_perl/5.23.3 /usr/local/perl-afl/lib/site_perl/5.23.2 /usr/local/perl-afl/lib/site_perl .
Migrated from rt.perl.org#126188 (status was 'open')
Searchable as RT126188$