Perl / perl5

🐪 The Perl programming language
https://dev.perl.org/perl5/
Other
1.96k stars 555 forks source link

Perl 5.8.8: double free occurs with s/// + loop + recursion #9210

Closed p5pRT closed 16 years ago

p5pRT commented 16 years ago

Migrated from rt.perl.org#50270 (status was 'resolved')

Searchable as RT50270$

p5pRT commented 16 years ago

From kztk.matsuda@gmail.com

The following perl code aborts with double-free-error on Perl 5.8.8 while it runs properly on Perl 5.10.0.

  my $str = "aabaa";   func1($str);

  sub func1 {   my $str = shift;   my $r1 = qr/a/;   my $r2 = qr/something_cannot_be_matched/;   print "[1]"\,$str\,"\n";

  my @​qr = map {qr{${_}(.+)}} ($r1\,$r2);   for my $qr (@​qr) {   $str =~ s{$qr}{func2($1)}eg;   }   return $str;   }

  sub func2 {   my $str = shift;   my $r = shift;   print "[2]"\,$str\,"\n";   my $qr = qr/(ab.+)/;   $str =~ s{$qr}{func1($1)}ge;   return $str;   }

The following in the output of the above code.

  [1]aabaa   [2]abaa   [1]abaa   [2]baa   *** glibc detected *** double free or corruption (fasttop)​: 0x0816e318 ***   Aborted


Flags​:   category=core   severity=low


Site configuration information for perl v5.8.8​:

Configured by Debian Project at Mon Nov 5 06​:19​:33 UTC 2007.

Summary of my perl5 (revision 5 version 8 subversion 8) configuration​: Platform​:   osname=linux\, osvers=2.6.22-3-amd64\, archname=i486-linux-gnu-thread-multi   uname='linux deneb 2.6.22-3-amd64 #1 smp thu oct 11 15​:23​:23 utc 2007 i686 gnulinux '   config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN -Dcccdlflags=-fPIC -Darchname=i486-linux-gnu -Dprefix=/usr -Dprivlib=/usr/share/perl/5.8 -Darchlib=/usr/lib/perl/5.8 -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5 -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local -Dsitelib=/usr/local/share/perl/5.8.8 -Dsitearch=/usr/local/lib/perl/5.8.8 -Dman1dir=/usr/share/man/man1 -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1 -Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Uusesfio -Uusenm -Duseshrplib -Dlibperl=libperl.so.5.8.8 -Dd_dosuid -des'   hint=recommended\, useposix=true\, d_sigaction=define   usethreads=define use5005threads=undef useithreads=define usemultiplicity=define   useperlio=define d_sfio=undef uselargefiles=define usesocks=undef   use64bitint=undef use64bitall=undef uselongdouble=undef   usemymalloc=n\, bincompat5005=undef Compiler​:   cc='cc'\, ccflags ='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64'\,   optimize='-O2'\,   cppflags='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -pipe -I/usr/local/include'   ccversion=''\, gccversion='4.1.2 20061115 (prerelease) (Debian 4.1.1-21)'\, gccosandvers=''   intsize=4\, longsize=4\, ptrsize=4\, doublesize=8\, byteorder=1234   d_longlong=define\, longlongsize=8\, d_longdbl=define\, longdblsize=12   ivtype='long'\, ivsize=4\, nvtype='double'\, nvsize=8\, Off_t='off_t'\, lseeksize=8   alignbytes=4\, prototype=define Linker and Libraries​:   ld='cc'\, ldflags =' -L/usr/local/lib'   libpth=/usr/local/lib /lib /usr/lib   libs=-lgdbm -lgdbm_compat -ldb -ldl -lm -lpthread -lc -lcrypt   perllibs=-ldl -lm -lpthread -lc -lcrypt   libc=/lib/libc-2.3.6.so\, so=so\, useshrplib=true\, libperl=libperl.so.5.8.8   gnulibc_version='2.3.6' Dynamic Linking​:   dlsrc=dl_dlopen.xs\, dlext=so\, d_dlsymun=undef\, ccdlflags='-Wl\,-E'   cccdlflags='-fPIC'\, lddlflags='-shared -L/usr/local/lib'

Locally applied patches​:


@​INC for perl v5.8.8​:   /etc/perl   /usr/local/lib/perl/5.8.8   /usr/local/share/perl/5.8.8   /usr/lib/perl5   /usr/share/perl5   /usr/lib/perl/5.8   /usr/share/perl/5.8   /usr/local/lib/site_perl   .


Environment for perl v5.8.8​:   HOME=/home/kztk   LANG (unset)   LANGUAGE (unset)   LD_LIBRARY_PATH (unset)   LOGDIR (unset)   PATH=/usr/local/bin​:/usr/bin​:/bin​:/usr/bin/X11​:/usr/games   PERL_BADLANG (unset)   SHELL=/bin/bash

p5pRT commented 16 years ago

From @andk

On Sat\, 26 Jan 2008 13​:17​:21 -0800\, "Kazutaka Matsuda" (via RT) \perlbug\-followup@​perl\.org said​:

  > # New Ticket Created by "Kazutaka Matsuda"   > # Please include the string​: [perl #50270]   > # in the subject line of all future correspondence about this issue.   > # \<URL​: http​://rt.perl.org/rt3/Ticket/Display.html?id=50270 >

  > The following perl code aborts with double-free-error on Perl 5.8.8   > while it runs properly on Perl 5.10.0.

The bug seems to have been fixed in the upcoming 5.8.9.

Thanks for the report\, -- andreas

p5pRT commented 16 years ago

The RT System itself - Status changed from 'new' to 'open'

p5pRT commented 16 years ago

p5p@spam.wizbit.be - Status changed from 'open' to 'resolved'