null pointer dereference in Perl_sv_setpvn at sv.c:4896

[p5pRT]

Migrated from rt.perl.org#127956 (status was 'open')

Searchable as RT127956$

[p5pRT]

From @geeknik

While fuzzing Perl v5.24.0-RC1-2-gde1d2c7 with American Fuzzy Lop\, I discovered that perl -e '$0=$.^=*.=$0=0' causes a null pointer dereference and crash. This crash affects Perl v5.14.2 as well.

Program received signal SIGSEGV\, Segmentation fault. Perl_sv_setpvn (sv=sv@​entry=0x1201948\, ptr=ptr@​entry=0xed4da7 ""\, len=len@​entry=0) at sv.c​:4896 4896 dptr[len] = '\0'; (gdb) bt #0 Perl_sv_setpvn (sv=sv@​entry=0x1201948\, ptr=ptr@​entry=0xed4da7 ""\, len=len@​entry=0) at sv.c​:4896 #1 0x0000000000c2a6f3 in Perl_do_vop (optype=optype@​entry=93\, sv=sv@​entry=0x1201948\,   left=left@​entry=0x1201948\, right=right@​entry=0x1201930) at doop.c​:1011 #2 0x0000000000a763a1 in Perl_pp_bit_or () at pp.c​:2491 #3 0x00000000007ff5d4 in Perl_runops_debug () at dump.c​:2239 #4 0x0000000000539034 in S_run_body (oldscope=1) at perl.c​:2483 #5 perl_run (my_perl=\) at perl.c​:2406 #6 0x000000000042eac8 in main (argc=3\, argv=0x7fffffffe658\, env=0x7fffffffe678) at perlmain.c​:116 (gdb) list 4891 } 4892 SvUPGRADE(sv\, SVt_PV); 4893 4894 dptr = SvGROW(sv\, len + 1); 4895 Move(ptr\,dptr\,len\,char); 4896 dptr[len] = '\0'; 4897 SvCUR_set(sv\, len); 4898 (void)SvPOK_only_UTF8(sv); /* validate pointer */ 4899 SvTAINT(sv); 4900 if (SvTYPE(sv) == SVt_PVCV) CvAUTOLOAD_off(sv);

[p5pRT]

From @Smylers

Brian Carpenter writes​:

While fuzzing Perl v5.24.0-RC1-2-gde1d2c7 with American Fuzzy Lop\, I discovered that perl -e '$0=$.^=*.=$0=0' causes a null pointer dereference and crash. This crash affects Perl v5.14.2 as well.

Smaller case that still yields the crash\, without special variables​:

  perl -e '$x ^= *x = 0'

Also​:  
  perl -e '$x |= *x = 0'

But not​:

  perl -e '$x &= *x = 0'   Can't coerce UNKNOWN to string in bitwise and (&) at -e line 1.

Smylers -- http​://twitter.com/Smylers2

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @cpansprout

On Fri Apr 22 01​:38​:07 2016\, smylers@​stripey.com wrote​:

Brian Carpenter writes​:

While fuzzing Perl v5.24.0-RC1-2-gde1d2c7 with American Fuzzy Lop\, I discovered that perl -e '$0=$.^=*.=$0=0' causes a null pointer dereference and crash. This crash affects Perl v5.14.2 as well.

Smaller case that still yields the crash\, without special variables​:

perl -e '$x ^= *x = 0'

Also​:

perl -e '$x |= *x = 0'

But not​:

perl -e '$x &= *x = 0' Can't coerce UNKNOWN to string in bitwise and (&) at -e line 1.

That UNKNOWN is an internal fallback value that should never be seen. I would say this last case is just as buggy. It smells like a stack issue.

--

Father Chrysostomos

[p5pRT]

From zefram@fysh.org

Brian Carpenter wrote​:

perl -e '$0=$.^=*.=$0=0'

This reduces to

  perl -e '$z ^= *z=0'

which looks almost exactly like [perl #127934]. That one used *= and asserted\, whereas this one uses ^= and segvs. They're probably the same bug underneath. |= and .= also segv​: the pattern seems to be that numeric operations assert and string operations segv on handling the string buffer.

-zefram

[p5pRT]

From @cpansprout

On Fri Apr 22 08​:36​:02 2016\, zefram@​fysh.org wrote​:

Brian Carpenter wrote​:

perl -e '$0=$.^=*.=$0=0'

This reduces to

    perl \-e '$z ^= \*z=0'

which looks almost exactly like [perl #127934]. That one used *= and asserted\, whereas this one uses ^= and segvs. They're probably the same bug underneath. |= and .= also segv​: the pattern seems to be that numeric operations assert and string operations segv on handling the string buffer.

I am pretty sure these are both stack issues. The *z=0 frees *z{SCALAR} while the latter is on the stack.

$ perl -le 'print $^V' v5.12.4 $ perl -e '$z ^= *z=0' Segmentation fault​: 11 $ perl -e '*b=*z; $z ^= *z=0; print "$b\n"' *main​::0

--

Father Chrysostomos

[p5pRT]

From @geeknik

I just ran into this issue again while fuzzing v5.25.1-152-g81b22c1.

[p5pRT]

From [Unknown Contact. See original ticket]

I just ran into this issue again while fuzzing v5.25.1-152-g81b22c1.