Perl / perl5

🐪 The Perl programming language
https://dev.perl.org/perl5/
Other
1.94k stars 554 forks source link

Array bounds problem #4631

Closed p5pRT closed 16 years ago

p5pRT commented 22 years ago

Migrated from rt.perl.org#7960 (status was 'resolved')

Searchable as RT7960$

p5pRT commented 22 years ago

From malch@malch.com

#======== test.pl ========= use strict; my @​items = (1\, 2\, 3); my $k = -1; foreach my $item (@​items) {   $k++;   $items[$k+1]=~m/xxx/; } exit; #======== test.pl =========

perl test.pl Out of memory! ^C

Yeah\, not great code but the failure mode is horrible! This was not a problem on the overwhelming majority of prior releases.

This with ActivePerl Build 630 under Win 2000 SP2

Perl Info ``` This perlbug was built using Perl 5.00503 - Tue Sep 14 01:11:09 1999 It is being executed now by Perl 5.006001 - Wed Oct 31 20:29:27 2001. Site configuration information for perl 5.006001: Configured by malch at Wed Oct 31 20:29:27 2001. Summary of my perl5 (revision 5 version 6 subversion 1) configuration: Platform: osname=MSWin32, osvers=4.0, archname=MSWin32-x86-multi-thread uname='' config_args='undef' hint=recommended, useposix=true, d_sigaction=undef usethreads=undef use5005threads=undef useithreads=define usemultiplicity=define useperlio=undef d_sfio=undef uselargefiles=undef usesocks=undef use64bitint=undef use64bitall=undef uselongdouble=undef Compiler: cc='cl', ccflags ='-nologo -O1 -MD -DNDEBUG -DWIN32 -D_CONSOLE -DNO_STRICT -DHAVE_DES_FCRYPT -DPERL_IMPLICIT_CONTEXT -DPERL_IMPLICIT_SYS -DPERL_MSVCRT_READFIX', optimize='-O1 -MD -DNDEBUG', cppflags='-DWIN32' ccversion='', gccversion='', gccosandvers='' intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234 d_longlong=undef, longlongsize=8, d_longdbl=define, longdblsize=10 ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=4 alignbytes=8, usemymalloc=n, prototype=define Linker and Libraries: ld='link', ldflags ='-nologo -nodefaultlib -release -libpath:"F:\Perl5\lib\CORE" -machine:x86' libpth="F:\Perl5\lib\CORE" libs= oldnames.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib netapi32.lib uuid.lib wsock32.lib mpr.lib winmm.lib version.lib odbc32.lib odbccp32.lib msvcrt.lib perllibs= oldnames.lib kernel32.lib user32.lib gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib ole32.lib oleaut32.lib netapi32.lib uuid.lib wsock32.lib mpr.lib winmm.lib version.lib odbc32.lib odbccp32.lib msvcrt.lib libc=msvcrt.lib, so=dll, useshrplib=yes, libperl=perl56.lib Dynamic Linking: dlsrc=dl_win32.xs, dlext=dll, d_dlsymun=undef, ccdlflags=' ' cccdlflags=' ', lddlflags='-dll -nologo -nodefaultlib -release -libpath:"F:\Perl5\lib\CORE" -machine:x86' Locally applied patches: @INC for perl 5.006001: F:/Perl5/lib F:/Perl5/site/lib . Environment for perl 5.006001: HOME (unset) LANG (unset) LANGUAGE (unset) LD_LIBRARY_PATH (unset) LOGDIR (unset) PATH=G:\Borland\CBUILD~1\Projects\Bpl;G:\Borland\CBUILD~1\Bin;E:\Winnt;E:\Winnt\System32;E:\bin;E:\contrib\bin;F:\Perl5\bin;F:\Wintools;F:\CRTSecure;C:\WIN982;C:\WIN982\COMMAND;C:\PERL\BIN;"" PERL_BADLANG (unset) SHELL (unset) -- |~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| | Malcolm Hoar "The more I practice, the luckier I get". | | malch@malch.com Gary Player. | | http://www.malch.com/ Shpx gur PQN. | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ```
p5pRT commented 22 years ago

From @schwern

Oddly enough\, I have no problem in Linux 5.6.1 with this code\, but bleadperl does. Just chews memory.

I think the problem is $foo[23] =~ /failed match/ is causing that element to spring into existence\, which is used to not do.

$ perl -le '$foo[23] =~ /moo/; print $#foo' -1 $ bleadperl -wle '$foo[23] =~ /moo/; print $#foo' 23

Thus the array is extended inside the foreach loop\, which causes an infinite loop.

--

Michael G. Schwern \schwern@​pobox\.com http​://www.pobox.com/~schwern/ Perl Quality Assurance \perl\-qa@​perl\.org Kwalitee Is Job One viscosity dawns creamy\, juicy\, filling paste open wide fucker   -- imploded

p5pRT commented 22 years ago

From @vanstyn

Malcolm Hoar \malch@​malch\.com wrote​: :perl test.pl :Out of memory! :^C

As noted by Schwern\, this was caused by the new autovivification of array elements under a pattern match​:

  perl -e '$a[0]=~/x/;print scalar @​a'

prints '1' with bleadperl\, '0' with previous releases.

This is caused by Radu Greab's patch​:   [PATCH perl@​11099]Re​: [ID 20010704.003] Taint mode breaks global match at​:   http​://www.xray.mpe.mpg.de/mailing-lists/perl5-porters/2001-07/msg00207.html ... in which it says (in effect) "if the LHS of a pattern match is an array or hash element\, make it an lvalue'.

I also don't understand the implied parallel between the comment​:   if SV has magic and the code​:   if SV is an array or hash element but I guess the relationship is the one referred to in pp_helem()​:   /* This makes C\<local $tied{foo} = $tied{foo}> possible.   * Pushing the magical RHS on to the stack is useless\, since   * that magic is soon destined to be misled by the local()\,   * and thus the later pp_sassign() will fail to mg_get() the   * old value. This should also cure problems with delayed   * mg_get()s. GSAR 98-07-03 */

Radu\, have you got any ideas on this? We will get subtle breakage in old scripts if this autovivification remains.

Hugo

p5pRT commented 22 years ago

From [Unknown Contact. See original ticket]

On Mon\, 3 Dec 2001 02​:03 +0000\, Hugo van der Sanden wrote​:

Malcolm Hoar \malch@&#8203;malch\.com wrote​: :perl test.pl :Out of memory! :^C

As noted by Schwern\, this was caused by the new autovivification of array elements under a pattern match​:

perl -e '$a[0]=~/x/;print scalar @​a'

prints '1' with bleadperl\, '0' with previous releases.

This is caused by Radu Greab's patch​: [PATCH perl@​11099]Re​: [ID 20010704.003] Taint mode breaks global match at​: http​://www.xray.mpe.mpg.de/mailing-lists/perl5-porters/2001-07/msg00207.html ... in which it says (in effect) "if the LHS of a pattern match is an array or hash element\, make it an lvalue'.

I also don't understand the implied parallel between the comment​: if SV has magic and the code​: if SV is an array or hash element but I guess the relationship is the one referred to in pp_helem()​: /* This makes C\<local $tied{foo} = $tied{foo}> possible. * Pushing the magical RHS on to the stack is useless\, since * that magic is soon destined to be misled by the local()\, * and thus the later pp_sassign() will fail to mg_get() the * old value. This should also cure problems with delayed * mg_get()s. GSAR 98-07-03 */

Yes\, my patch was a work around against Sarathy's change described in the above comment.

Radu\, have you got any ideas on this? We will get subtle breakage in old scripts if this autovivification remains.

I'll try to find a better solution to prevent the autovivification.

Thanks\, Radu Greab

p5pRT commented 16 years ago

p5p@spam.wizbit.be - Status changed from 'open' to 'resolved'