Multiple segfaults in Storable. #15714
Comments
From @lightseyThis is a bug report for perl from john@nixnuts.net, AFL pointed out multiple null pointer dereference bugs in Storable. retrieve_code() will dereference a null "text" variable, I'll attach a patch that fixes the issues AFL identified. Flags: Site configuration information for perl 5.25.7: Configured by jd at Wed Nov 9 09:22:44 CST 2016. Summary of my perl5 (revision 5 version 25 subversion 7) configuration: Locally applied patches: @INC for perl 5.25.7: Environment for perl 5.25.7: |
From @lightseyPatch for this issue. |
From @lightsey0001-Fix-Storable-segfaults.patchFrom fecd3be8dbdb747b9cbf4cbb9299ce40faabc8e6 Mon Sep 17 00:00:00 2001
From: John Lightsey <[email protected]>
Date: Mon, 14 Nov 2016 11:56:15 +0100
Subject: [PATCH] Fix Storable segfaults.
Fix a null pointed dereference segfault in storable when the
retrieve_code logic was unable to read the string that contained
the code.
Also fix several locations where retrieve_other was called with a
null context pointer. This also resulted in a null pointer
dereference.
---
dist/Storable/Storable.xs | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/dist/Storable/Storable.xs b/dist/Storable/Storable.xs
index 053951c..caa489c 100644
--- a/dist/Storable/Storable.xs
+++ b/dist/Storable/Storable.xs
@@ -5647,6 +5647,10 @@ static SV *retrieve_code(pTHX_ stcxt_t *cxt, const char *cname)
CROAK(("Unexpected type %d in retrieve_code\n", type));
}
+ if (!text) {
+ CROAK(("Unable to retrieve code\n"));
+ }
+
/*
* prepend "sub " to the source
*/
@@ -5767,7 +5771,7 @@ static SV *old_retrieve_array(pTHX_ stcxt_t *cxt, const char *cname)
continue; /* av_extend() already filled us with undef */
}
if (c != SX_ITEM)
- (void) retrieve_other(aTHX_ (stcxt_t *) 0, 0); /* Will croak out */
+ (void) retrieve_other(aTHX_ cxt, 0); /* Will croak out */
TRACEME(("(#%d) item", i));
sv = retrieve(aTHX_ cxt, 0); /* Retrieve item */
if (!sv)
@@ -5844,7 +5848,7 @@ static SV *old_retrieve_hash(pTHX_ stcxt_t *cxt, const char *cname)
if (!sv)
return (SV *) 0;
} else
- (void) retrieve_other(aTHX_ (stcxt_t *) 0, 0); /* Will croak out */
+ (void) retrieve_other(aTHX_ cxt, 0); /* Will croak out */
/*
* Get key.
@@ -5855,7 +5859,7 @@ static SV *old_retrieve_hash(pTHX_ stcxt_t *cxt, const char *cname)
GETMARK(c);
if (c != SX_KEY)
- (void) retrieve_other(aTHX_ (stcxt_t *) 0, 0); /* Will croak out */
+ (void) retrieve_other(aTHX_ cxt, 0); /* Will croak out */
RLEN(size); /* Get key size */
KBUFCHK((STRLEN)size); /* Grow hash key read pool if needed */
if (size)
--
2.10.2
|
|
The RT System itself - Status changed from 'new' to 'open' |
From @lightseyUpdated patch to correct several null pointer deference bugs in Storable is |
From @lightsey0001-Fix-Storable-segfaults.patchFrom d1964dfd8a2d38a29c5dbb94c0cf1ac46d022fff Mon Sep 17 00:00:00 2001
From: John Lightsey <[email protected]>
Date: Mon, 14 Nov 2016 11:56:15 +0100
Subject: [PATCH] Fix Storable segfaults.
Fix a null pointer dereference segfault in storable when the
retrieve_code logic was unable to read the string that contained
the code.
Also fix several locations where retrieve_other was called with a
null context pointer. This also resulted in a null pointer
dereference.
---
Porting/checkAUTHORS.pl | 1 +
dist/Storable/Storable.pm | 2 +-
dist/Storable/Storable.xs | 10 +++++++---
3 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/Porting/checkAUTHORS.pl b/Porting/checkAUTHORS.pl
index b869c11..fcddf51 100755
--- a/Porting/checkAUTHORS.pl
+++ b/Porting/checkAUTHORS.pl
@@ -660,6 +660,7 @@ jasons\100cs.unm.edu jasons\100sandy-home.arc.unm.edu
jbuehler\100hekimian.com jhpb\100hekimian.com
jcromie\100100divsol.com jcromie\100cpan.org
+ jim.cromie\100gmail.com
+jd\100cpanel.net lightsey\100debian.org
jdhedden\100cpan.org jerry\100hedden.us
+ jdhedden\1001979.usna.com
+ jdhedden\100gmail.com
diff --git a/dist/Storable/Storable.pm b/dist/Storable/Storable.pm
index 7101641..18aa1f0 100644
--- a/dist/Storable/Storable.pm
+++ b/dist/Storable/Storable.pm
@@ -22,7 +22,7 @@ package Storable; @ISA = qw(Exporter);
use vars qw($canonical $forgive_me $VERSION);
-$VERSION = '2.59';
+$VERSION = '2.60';
BEGIN {
if (eval {
diff --git a/dist/Storable/Storable.xs b/dist/Storable/Storable.xs
index 3788f57..a72d84c 100644
--- a/dist/Storable/Storable.xs
+++ b/dist/Storable/Storable.xs
@@ -5660,6 +5660,10 @@ static SV *retrieve_code(pTHX_ stcxt_t *cxt, const char *cname)
CROAK(("Unexpected type %d in retrieve_code\n", type));
}
+ if (!text) {
+ CROAK(("Unable to retrieve code\n"));
+ }
+
/*
* prepend "sub " to the source
*/
@@ -5780,7 +5784,7 @@ static SV *old_retrieve_array(pTHX_ stcxt_t *cxt, const char *cname)
continue; /* av_extend() already filled us with undef */
}
if (c != SX_ITEM)
- (void) retrieve_other(aTHX_ (stcxt_t *) 0, 0); /* Will croak out */
+ (void) retrieve_other(aTHX_ cxt, 0); /* Will croak out */
TRACEME(("(#%d) item", i));
sv = retrieve(aTHX_ cxt, 0); /* Retrieve item */
if (!sv)
@@ -5857,7 +5861,7 @@ static SV *old_retrieve_hash(pTHX_ stcxt_t *cxt, const char *cname)
if (!sv)
return (SV *) 0;
} else
- (void) retrieve_other(aTHX_ (stcxt_t *) 0, 0); /* Will croak out */
+ (void) retrieve_other(aTHX_ cxt, 0); /* Will croak out */
/*
* Get key.
@@ -5868,7 +5872,7 @@ static SV *old_retrieve_hash(pTHX_ stcxt_t *cxt, const char *cname)
GETMARK(c);
if (c != SX_KEY)
- (void) retrieve_other(aTHX_ (stcxt_t *) 0, 0); /* Will croak out */
+ (void) retrieve_other(aTHX_ cxt, 0); /* Will croak out */
RLEN(size); /* Get key size */
KBUFCHK((STRLEN)size); /* Grow hash key read pool if needed */
if (size)
--
2.10.2
|
From @jkeenanOn Thu, 01 Dec 2016 02:36:15 GMT, john@nixnuts.net wrote:
Can you provide a bit more specific evidence of the problem? Are there any tests we could write for this that would expose regressions? Thank you very much. -- |
From @lightseyOn Wed, 2016-11-30 at 19:19 -0800, James E Keenan via RT wrote:
I've bundled up three of the crashing Storable files into the attached test $ gdb -ex run -ex bt -batch -args perl ./null_crashes.pl old_retrieve_array Program received signal SIGSEGV, Segmentation fault. |
From @lightsey |
From @jkeenanOn Fri, 02 Dec 2016 02:32:34 GMT, john@nixnuts.net wrote:
John, In the smoke-me/jkeenan/130098-storable branch I applied your patch for Storable.xs. Storable::$VERSION had already been incremented, so I manually re-incremented. I worked your test program into 3 regression tests in t/store.t -- though you might want to suggest better descriptions than mine. P5P: Could this be reviewed by someone more familiar with Storable than I? (Otherwise, I will push to blead within 7 days.) Thank you very much. |
From @jkeenanOn Sun, 25 Dec 2016 02:46:38 GMT, jkeenan wrote:
Can you confirm that commit adf9095 remedies this situation? Thank you very much. -- |
From @lightseyOn Sun, 2017-01-01 at 07:19 -0800, James E Keenan via RT wrote:
The changes look good and the segfaults are no longer reproducible on my test |
From @jkeenanSince the other ticket cited in this one has been marked Resolved, I am marking this one Resolved as well. Thank you very much. -- |
|
@jkeenan - Status changed from 'open' to 'resolved' |
Migrated from rt.perl.org#130098 (status was 'resolved')
Searchable as RT130098$
The text was updated successfully, but these errors were encountered: