Segfault in the perl-5.8.x Compilation Phase

Shlomi Fish on 2006-12-01T17:24:39

I discovered a segfault in the perl-5.8.x compilation stage. I discovered it by accident: I was refactoring some code, and added a function, and then it segfaulted. After reducing the code to a minimal form that still exhibited the problem, I found it had a syntax error which triggered the segfault.

The following code when run by perl-5.8.x triggers the segfault:

sub
{
    my ($i, $j) = @_;
    sub { [ $i->f(); ] };
}

It doesn't segfault perl-5.6.2. Since it is also no longer exhibited in bleadperl, it was closed as "resolved". However, I wrote the following on what should still be done:

1. Add this as a test-case to the perl 5 test-suite.
2. Write a patch for the perl-5.8.x line. (Which is still heavily used).
3. Investigate the crash, and see if it poses security risks. (Other than the obvious DoS that is caused by the segfault of evaluating such code.)

I hope it will be dealt with appropriately. And finally here's some IRC conversation about this:

  Hi all.
  buu: can I try to crash buubot?
      rindolf: Be my guest. Just do it in #buubot
  buu: OK.

And later on on #buubot:

  Hi all.
     hi rindolf - the fun thing is, no-one so 
           far has been able to crash it :)
  MUBA: OK.
     at least not that I know of
  eval: sub func1{my ($i, $j) = @_; 
           sub { return [ $i->func2(); ]; };}
   (eval):23: [BUG] Segmentation fault ruby 
           1.8.5 (2006-08-25) [i486-linux]  rindolf: 
  Hmmm... there was a segfault. I guess it forked 
           or something.
  eval: 5+6
   rindolf:  11 
  buu: it's a perl bug I discovered.
      Of course it forks
      But nice segfault.
     I don't get the error... you make a sub that 
           returs a sub that returns the result of a method 
           on a non-initialized object inside an arrayref? 
           But you never call any of those? How can it crash?
  MUBA: it's in the compilation stage.
  MUBA: notice that I have [ $i->func2() ; ]. A 
           semicolon inside an array ref is illegal.
     ooh that is what causes the crash?
     eval: [3;
   MUBA: Error: syntax error at eval line 1, at 
           EOF Missing right curly or square bracket at
           eval line 1, at end of line  
     eval: [3;]
   MUBA: Error: syntax error at eval line 1, at 
           EOF  
     not that alone
  MUBA: no, it requires more sophisticated code.

"Nice segfault"... ;-)

Happens with perl-5.8.1 too

Shlomi Fish on 2006-12-01T18:34:08

{{{
$ ~/apps/perl/perl-5.8.1-debug/bin/perl5.8.1 segfault.pl
Segmentation fault
}}}

Fun, fun, fun...