[Phoenix-pm] Fwd: [perl #40427] Segfault in pack

Scott Walters scott at slowass.net
Fri Sep 29 12:44:56 PDT 2006

----- Forwarded message from "dgay at acm.org" <perlbug-followup at perl.org> -----

Return-Path: perl5-porters-return-116718-scott=slowass.net at perl.org
X-Original-To: scott
Delivered-To: scott at illogics.org
Received: by slowass.net (Postfix, from userid 1012)
	id D0CDC553AC; Fri, 29 Sep 2006 01:23:31 +0000 (GMT)
Received: from gmail-pop.l.google.com []
	by localhost with POP3 (fetchmail-6.2.5)
	for scott at localhost (single-drop); Fri, 29 Sep 2006 01:23:31 +0000 (GMT)
X-Gmail-Received: 55b8e566b0521769dbde980e1349a8942d7e19a4
Delivered-To: scott at slowass.net
Received: by with SMTP id a13cs108hue;
        Thu, 28 Sep 2006 18:12:04 -0700 (PDT)
Received: by with SMTP id i10mr2812474qbo;
        Thu, 28 Sep 2006 18:12:03 -0700 (PDT)
Received: from lists.develooper.com (x6.develooper.com [])
        by mx.gmail.com with SMTP id e16si2775000qba.2006.;
        Thu, 28 Sep 2006 18:12:03 -0700 (PDT)
Received-SPF: pass (gmail.com: domain of perl5-porters-return-116718-scott=slowass.net at perl.org designates as permitted sender)
Received: (qmail 4966 invoked by uid 514); 29 Sep 2006 01:11:51 -0000
Mailing-List: contact perl5-porters-help at perl.org; run by ezmlm
Precedence: bulk
list-help: <mailto:perl5-porters-help at perl.org>
list-unsubscribe: <mailto:perl5-porters-unsubscribe at perl.org>
list-post: <mailto:perl5-porters at perl.org>
X-List-Archive: <http://nntp.perl.org/group/perl.perl5.porters/116718>
List-Id: <perl5-porters.perl.org>
Delivered-To: mailing list perl5-porters at perl.org
Delivered-To: moderator for perl5-porters at perl.org
Received: (qmail 17664 invoked from network); 29 Sep 2006 00:31:10 -0000
Delivered-To: perl5-porters at perl.org
X-Spam-Status: No, hits=-8.4 required=8.0
X-Spam-Check-By: la.mx.develooper.com
Received-SPF: pass (x1.develooper.com: local policy)
Delivered-To: rt-perl5-testers at x1.develooper.com
Mail-From: perlbug-followup at perl.org  Thu Sep 28 17:31:00 2006
Delivered-To: bugs-perl5-testers at netlabs.develooper.com
Received-SPF: pass (x1.develooper.com: local policy)
Received-SPF: pass (x1.develooper.com: local policy)
From: "dgay at acm.org" <perlbug-followup at perl.org>
X-RT-NewTicket: yes
To: bugs-bitbucket at rt.perl.org
Mail-Followup-To: perl5-porters at perl.org
Reply-To: perl5-porters at perl.org
X-RT-Will-Also-CC: dgay at acm.org, 
Subject: [perl #40427] Segfault in pack 
In-Reply-To: <5.8.5_5308_1159489400 at barnowl>
References: <RT-Ticket-40427 at perl.org> <5.8.5_5308_1159489400 at barnowl>
Message-ID: <rt-3.5.HEAD-31259-1159489837-428.40427-75-0 at perl.org>
X-RT-Loop-Prevention: perl
RT-Ticket: perl #40427
Managed-by: RT 3.5.HEAD (http://www.bestpractical.com/rt/)
RT-Originator: dgay at acm.org
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
X-RT-Original-Encoding: utf-8
Date: Thu, 28 Sep 2006 17:30:37 -0700
X-Virus-Checked: Checked
X-Virus-Checked: Checked
X-Old-Spam-Check-By: la.mx.develooper.com
X-Old-Spam-Status: No, hits=-8.4 required=8.0
Resent-To: perl5-porters at perl.org
X-Virus-Checked: Checked
X-Old-Spam-Check-By: la.mx.develooper.com
X-Old-Spam-Status: No, hits=-8.4 required=8.0
Resent-Message-Id: <20060929012331.D0CDC553AC at slowass.net>
Resent-Date: Fri, 29 Sep 2006 01:23:31 +0000 (GMT)
Resent-From: perl5-porters-return-116718-scott=slowass.net at perl.org (Scott Walters)

# New Ticket Created by  dgay at acm.org 
# Please include the string:  [perl #40427]
# in the subject line of all future correspondence about this issue. 
# <URL: http://rt.perl.org/rt3/Ticket/Display.html?id=40427 >

This is a bug report for perl from dgay at acm.org,
generated with the help of perlbug 1.35 running under perl v5.8.5.

[Please enter your report here]

The following program will cause a segfault on perl 5.8.5 and 5.9.4:
  @l = ("aa", "bb");
  $fun = pack "(A)30 N4", @l;
  print "$fun\n";

The following patch (for, and tested on, 5.9.4) fixes this:
--- pp_pack.c	2006-09-28 17:21:31.000000000 -0700
+++ pp_pack.c.new 2006-09-28 16:56:14.000000000 -0700
@@ -2630,6 +2630,7 @@
 		if (savsym.howlen == e_star && beglist == endlist)
 		    break;		/* No way to continue */
+	    items = endlist - beglist;
 	    lookahead.flags  = symptr->flags & ~group_modifiers;
 	    goto no_change;

The problem is that the items consumed by the recursive pack are
not counted in the outer pack, so accesses to random parts of the
stack beyond the top are possible. The fix simply updates the
items local variable after the recursive packs ("make test" reports
no failures).

[Please do not change anything below this line]
This perlbug was built using Perl v5.8.5 in the Red Hat build system.
It is being executed now by Perl v5.8.5 - Fri Dec 16 14:48:17 EST 2005.

Site configuration information for perl v5.8.5:

Configured by Red Hat, Inc. at Fri Dec 16 14:48:17 EST 2005.

Summary of my perl5 (revision 5 version 8 subversion 5) configuration:
    osname=linux, osvers=2.6.9-1.906_elsmp, archname=i386-linux-thread-multi
    uname='linux tweety.build.redhat.com 2.6.9-1.906_elsmp #1 smp sun dec 12 22:58:08 est 2004 i686 i686 i386 gnulinux '
    config_args='-des -Doptimize=-O2 -g -pipe -m32 -march=i386 -mtune=pentium4 -Dversion=5.8.5 -Dmyhostname=localhost -Dperladmin=root at localhost -Dcc=gcc -Dcf_by=Red Hat, Inc. -Dinstallprefix=/usr -Dprefix=/usr -Darchname=i386-linux -Dvendorprefix=/usr -Dsiteprefix=/usr -Duseshrplib -Dusethreads -Duseithreads -Duselargefiles -Dd_dosuid -Dd_semctl_semun -Di_db -Ui_ndbm -Di_gdbm -Di_shadow -Di_syslog -Dman3ext=3pm -Duseperlio -Dinstallusrbinperl -Ubincompat5005 -Uversiononly -Dpager=/usr/bin/less -isr -Dinc_version_list=5.8.4 5.8.3 5.8.2 5.8.1 5.8.0'
    hint=recommended, useposix=true, d_sigaction=define
    usethreads=define use5005threads=undef useithreads=define usemultiplicity=define
    useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
    use64bitint=undef use64bitall=undef uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
    cc='gcc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm',
    optimize='-O2 -g -pipe -m32 -march=i386 -mtune=pentium4',
    cppflags='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -I/usr/include/gdbm'
    ccversion='', gccversion='3.4.4 20050721 (Red Hat 3.4.4-2)', gccosandvers=''
    intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
    alignbytes=4, prototype=define
  Linker and Libraries:
    ld='gcc', ldflags =' -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib
    libs=-lresolv -lnsl -lgdbm -ldb -ldl -lm -lcrypt -lutil -lpthread -lc
    perllibs=-lresolv -lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
    libc=/lib/libc-2.3.6.so, so=so, useshrplib=true, libperl=libperl.so
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E -Wl,-rpath,/usr/lib/perl5/5.8.5/i386-linux-thread-multi/CORE'
    cccdlflags='-fPIC', lddlflags='-shared -L/usr/local/lib'

Locally applied patches:

@INC for perl v5.8.5:

Environment for perl v5.8.5:
    LANGUAGE (unset)
    LOGDIR (unset)
    PERL_BADLANG (unset)

----- End forwarded message -----

More information about the Phoenix-pm mailing list