Open p5pRT opened 7 years ago
While fuzzing perl v5.27.1-37-g4c95ee9f29 built with afl and run under libdislocator\, I found the following program
m|$0[sub{$0[o{warn]]]]|}}
to crash\, even when run under -c for a syntax check. GDB info about the crash location is:
#0 0x0000564b247bd269 in Perl_cv_undef_flags (cv=0x564b257f8340\, flags=0x0) at pad.c:398 398 U32 inner_rc = SvREFCNT(innercv); gdb$ bt #0 0x0000564b247bd269 in Perl_cv_undef_flags (cv=0x564b257f8340\, flags=0x0) at pad.c:398 #1 0x0000564b247bc819 in Perl_cv_undef (cv=0x564b257f8340) at pad.c:289 #2 0x0000564b248e71ed in Perl_sv_clear (orig_sv=0x564b257f8340) at sv.c:6631 #3 0x0000564b248ea37e in Perl_sv_free2 (sv=0x564b257f8340\, rc=0x1) at sv.c:7081 #4 0x0000564b24731e4a in S_SvREFCNT_dec (sv=0x564b257f8340) at inline.h:189 #5 0x0000564b2473301a in perl_destruct (my_perl=0x564b257f6010) at perl.c:867 #6 0x0000564b246effc7 in main (argc=0x2\, argv=0x7ffd34abc078\, env=0x7ffd34abc090) at perlmain.c:134 gdb$ p innercv $1 = (CV * const) 0x0
This is yet another bug based on parser error recovery screwing up stack synchronisation. I've converted the segv into an assertion failure in commit dce3f5c3fd788f1c2e451e3760f05a347c949eff\, but the actual bug with error recovery remains.
-zefram
The RT System itself - Status changed from 'new' to 'open'
Migrated from rt.perl.org#131631 (status was 'open')
Searchable as RT131631$