heap-buffer-overflow Perl_pp_split (pp.c:6145) #15749
Comments
From @geeknikTriggered with Perl v5.25.7-26-g7332835. ./perl -e 'map{int"";split//.0>60for"0000000000000000"}split//
|
From @tonycozOn Sun, 04 Dec 2016 13:56:12 -0800, brian.carpenter@gmail.com wrote:
From valgrind: ==26813== Invalid write of size 8 This is a stack overflow from the final: PUSHi(iters); in pp_split. An attacker has no control over the value stored, and it's always stored Fixed by the attached. Tony |
From @tonycoz0001-perl-130262-split-scalar-context-stack-overflow-fix.patchFrom 071b4693c6bfb5496be82ae23e136b7f58c7e86d Mon Sep 17 00:00:00 2001
From: Tony Cook <[email protected]>
Date: Mon, 5 Dec 2016 11:48:14 +1100
Subject: (perl #130262) split scalar context stack overflow fix
pp_split didn't ensure there was space for its return value
in scalar context.
---
pp.c | 2 +-
t/op/split.t | 6 +++++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/pp.c b/pp.c
index b198b47..737111a 100644
--- a/pp.c
+++ b/pp.c
@@ -6142,7 +6142,7 @@ PP(pp_split)
}
GETTARGET;
- PUSHi(iters);
+ XPUSHi(iters);
RETURN;
}
diff --git a/t/op/split.t b/t/op/split.t
index ceaea00..6d1ed25 100644
--- a/t/op/split.t
+++ b/t/op/split.t
@@ -7,7 +7,7 @@ BEGIN {
set_up_inc('../lib');
}
-plan tests => 161;
+plan tests => 162;
$FS = ':';
@@ -621,3 +621,7 @@ is "@a", '1 2 3', 'assignment to split-to-array (stacked)';
ok eval { $a[0] = 'a'; 1; }, "array split filling AvARRAY: assign 0";
is "@a", "a b", "array split filling AvARRAY: result";
}
+
+fresh_perl_is(<<'CODE', '', {}, "scalar split stack overflow");
+map{int"";split//.0>60for"0000000000000000"}split// for"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+CODE
--
2.1.4
|
|
The RT System itself - Status changed from 'new' to 'open' |
From @dur-randirCreated by @dur-randirWhile fuzzing perl v5.25.8-207-gcbe2fc5001 built with afl and run @0=s//000000000000000000000000000000000000000000000000000000000000000000000000000000000\000000000000000000000000000000000000000000000000000000000000f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f00000000000000000000000000000000000000000000000000000000000000000000000/; to perform an access outside of an allocated memory slot. ASAN diagnostics are: % ./perl /tmp/0002==18293==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62400000bed8 is located 0 bytes to the right of 7640-byte region SUMMARY: AddressSanitizer: heap-buffer-overflow GDB reports the following program state: Perl Info |
From @tonycozOn Sun, 04 Dec 2016 16:58:42 -0800, tonyc wrote:
No comments, so treating as a non-security issue, and moved to the perl5
Applied as 02c161e (with some noise). Tony |
|
@tonycoz - Status changed from 'open' to 'pending release' |
From @tonycozOn Sat, 14 Jan 2017 14:02:01 -0800, randir wrote:
This looks like a duplicate of #130262, and my fix from that seems to fix this issue. As with that I don't think this is a security issue. Tony |
|
The RT System itself - Status changed from 'new' to 'open' |
From @tonycozOn Sun, 15 Jan 2017 21:40:27 -0800, tonyc wrote:
No dissent, so merging into 130262. Tony |
From @khwilliamsonThank you for filing this report. You have helped make Perl better. With the release today of Perl 5.26.0, this and 210 other issues have been Perl 5.26.0 may be downloaded via: If you find that the problem persists, feel free to reopen this ticket. |
|
@khwilliamson - Status changed from 'pending release' to 'resolved' |
Migrated from rt.perl.org#130262 (status was 'resolved')
Searchable as RT130262$
The text was updated successfully, but these errors were encountered: