From @geeknik

I cloned the git repo on 01/02/2015 and built from source using the afl-gcc
compiler:

CC=/path/to/afl-gcc ./Configure
AFL_HARDEN=1 make

This is perl 5, version 21, subversion 8 (v5.21.8 (v5.21.7-209-g4e27940))
built for x86_64-linux

Besides the above information, this version of Perl was compiled using all
defaults (enter was pressed for every question).

While fuzzing the new perl binary, I found a testcase that causes a
segfault. I've attached the file for inclusion in the bug report. Please
note that a file named = containing zero bytes was also created in a tmp
directory around 1 minute 5 seconds before the testcase was written to
disk. Not sure if this is related but I wanted to add the information just
in case it was important. Please advise if this is a security issue and if
you will handle the CVE request.

@@ VALGRIND OUTPUT @@

valgrind -q /home/geeknik/perl5/perl
./id\:000000\,sig\:11\,src\:002461+016504\,op\:splice\,rep\:32
==54123== Use of uninitialised value of size 8
==54123== at 0x651E15: S_regatom (regcomp.c:12632)
==54123== by 0x656B49: S_regpiece (regcomp.c:10821)
==54123== by 0x65AB0D: S_regbranch (regcomp.c:10747)
==54123== by 0x66C9A5: S_reg.constprop.9 (regcomp.c:10497)
==54123== by 0x690D3B: Perl_re_op_compile (regcomp.c:6697)
==54123== by 0x4C1222: Perl_pmruntime (op.c:5629)
==54123== by 0x5CBEBC: Perl_yyparse (perly.y:1000)
==54123== by 0x4F3114: perl_parse (perl.c:2273)
==54123== by 0x42A92B: main (perlmain.c:114)
==54123==
==54123== Invalid write of size 1
==54123== at 0x64C878: S_regatom (regcomp.c:12484)
==54123== by 0x656B49: S_regpiece (regcomp.c:10821)
==54123== by 0x65AB0D: S_regbranch (regcomp.c:10747)
==54123== by 0x66C9A5: S_reg.constprop.9 (regcomp.c:10497)
==54123== by 0x693D3B: Perl_re_op_compile (regcomp.c:6895)
==54123== by 0x4C1222: Perl_pmruntime (op.c:5629)
==54123== by 0x5CBEBC: Perl_yyparse (perly.y:1000)
==54123== by 0x4F3114: perl_parse (perl.c:2273)
==54123== by 0x42A92B: main (perlmain.c:114)
==54123== Address 0x5eea96c is 0 bytes after a block of size 3,500 alloc'd
==54123== at 0x4C28BED: malloc (vg_replace_malloc.c:263)
==54123== by 0x6CEFBC: Perl_safesysmalloc (util.c:144)
==54123== by 0x692C7A: Perl_re_op_compile (regcomp.c:6746)
==54123== by 0x4C1222: Perl_pmruntime (op.c:5629)
==54123== by 0x5CBEBC: Perl_yyparse (perly.y:1000)
==54123== by 0x4F3114: perl_parse (perl.c:2273)
==54123== by 0x42A92B: main (perlmain.c:114)
==54123==
syntax error at ./id:000000,sig:11,src:002461+016504,op:splice,rep:32 line
11, near "printr)"
Unknown regexp modifier "/b" at
./id:000000,sig:11,src:002461+016504,op:splice,rep:32 line 17, at end of
line
Unknown regexp modifier "/G" at
./id:000000,sig:11,src:002461+016504,op:splice,rep:32 line 17, at end of
line
Unknown regexp modifier "/e" at
./id:000000,sig:11,src:002461+016504,op:splice,rep:32 line 17, at end of
line
Unknown regexp modifier "/r" at
./id:000000,sig:11,src:002461+016504,op:splice,rep:32 line 17, at end of
line
panic: reg_node overrun trying to emit 0, 5eea97c>=5eea96c at
./id:000000,sig:11,src:002461+016504,op:splice,rep:32 line 20.

@@ GDB OUTPUT @@

gdb /home/geeknik/perl5/perl core
GNU gdb (GDB) 7.4.1-debian
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html

This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /home/geeknik/perl5/perl...done.
[New LWP 12797]

warning: Can't read pathname for load map: Input/output error.
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/geeknik/perl5/perl
./id:000000,sig:11,src:002461+016504,op:splice,rep:32'.
Program terminated with signal 11, Segmentation fault.
#0 0x00007f1223db11f0 in _int_free (av=0x7f12240c0e40, p=0x238f260) at
malloc.c:5002
5002 malloc.c: No such file or directory.
(gdb) bt
#0 0x00007f1223db11f0 in _int_free (av=0x7f12240c0e40, p=0x238f260) at
malloc.c:5002
#1 0x00007f1223db47bc in *__GI___libc_free (mem=<optimized out>) at
malloc.c:3738
#2 0x00000000007bf7e8 in Perl_sv_clear (orig_sv=orig_sv@entry=0x238bbf8)
at sv.c:6743
#3 0x00000000007b75f8 in Perl_sv_free2 (sv=0x238bbf8, rc=<optimized out>)
at sv.c:7018
#4 0x000000000043cc85 in S_SvREFCNT_dec (sv=<optimized out>) at
inline.h:166
#5 Perl_op_clear (o=o@entry=0x238df50) at op.c:931
#6 0x000000000043d568 in Perl_op_free (o=0x238df50) at op.c:781
#7 0x000000000043e119 in Perl_opslab_force_free (slab=0x2389980) at
op.c:443
#8 0x00000000005f12c1 in Perl_cv_undef_flags (cv=0x2368328, flags=0) at
pad.c:350
#9 0x00000000007bedc0 in Perl_sv_clear (orig_sv=orig_sv@entry=0x2368328)
at sv.c:6592
#10 0x00000000007b75f8 in Perl_sv_free2 (sv=0x2368328, rc=<optimized out>)
at sv.c:7018
#11 0x00000000004e77b5 in S_SvREFCNT_dec (sv=<optimized out>) at
inline.h:166
#12 perl_destruct (my_perl=<optimized out>) at perl.c:780
#13 0x000000000042ab24 in main (argc=2, argv=0x7fff5c8b3a58,
env=0x7fff5c8b3a70) at perlmain.c:127
#14 0x00007f1223d57ead in __libc_start_main (main=<optimized out>,
argc=<optimized out>,
ubp_av=<optimized out>, init=<optimized out>, fini=<optimized out>,
rtld_fini=<optimized out>,
stack_end=0x7fff5c8b3a48) at libc-start.c:244
#15 0x000000000042ac45 in _start ()
(gdb)

geeknik@deb7fuzz:~/perl5/utils$ ./perlbug -d

Flags:
category=core
severity=low

This perlbug was built using Perl 5.21.8 - Fri Jan 2 19:02:59 CST 2015
It is being executed now by Perl 5.21.7 - Thu Dec 18 14:34:01 CST 2014.

Site configuration information for perl 5.21.7:

Configured by geeknik at Thu Dec 18 14:34:01 CST 2014.

Summary of my perl5 (revision 5 version 21 subversion 7) configuration:
Commit id: e9d2bd8
Platform:
osname=linux, osvers=3.2.0-4-amd64, archname=x86_64-linux
uname='linux deb7fuzz 3.2.0-4-amd64 #1 smp debian 3.2.63-2+deb7u2
x86_64 gnulinux '
config_args=''
hint=recommended, useposix=true, d_sigaction=define
useithreads=undef, usemultiplicity=undef
use64bitint=define, use64bitall=define, uselongdouble=undef
usemymalloc=n, bincompat5005=undef
Compiler:
cc='/home/geeknik/afl/afl-gcc', ccflags ='-fwrapv -fno-strict-aliasing
-pipe -fstack-protector -I/usr/local/include -D_LARGEFILE_SOURCE
-D_FILE_OFFSET_BITS=64 -D_FORTIFY_SOURCE=2',
optimize='-O2',
cppflags='-fwrapv -fno-strict-aliasing -pipe -fstack-protector
-I/usr/local/include'
ccversion='', gccversion='4.7.2', gccosandvers=''
intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678,
doublekind=3
d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16,
longdblkind=3
ivtype='long', ivsize=8, nvtype='double', nvsize=8, Off_t='off_t',
lseeksize=8
alignbytes=8, prototype=define
Linker and Libraries:
ld='/home/geeknik/afl/afl-gcc', ldflags =' -fstack-protector
-L/usr/local/lib'
libpth=/usr/local/lib /usr/lib/gcc/x86_64-linux-gnu/4.7/include-fixed
/usr/include/x86_64-linux-gnu /usr/lib /lib/x86_64-linux-gnu /lib/../lib
/usr/lib/x86_64-linux-gnu /usr/lib/../lib /lib
libs=-lnsl -ldl -lm -lcrypt -lutil -lc -lpthread
perllibs=-lnsl -ldl -lm -lcrypt -lutil -lc -lpthread
libc=libc-2.13.so, so=so, useshrplib=false, libperl=libperl.a
gnulibc_version='2.13'
Dynamic Linking:
dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
cccdlflags='-fPIC', lddlflags='-shared -O2 -L/usr/local/lib
-fstack-protector'

@INC for perl 5.21.7:
/usr/local/lib/perl5/site_perl/5.21.7/x86_64-linux
/usr/local/lib/perl5/site_perl/5.21.7
/usr/local/lib/perl5/5.21.7/x86_64-linux
/usr/local/lib/perl5/5.21.7
.

Environment for perl 5.21.7:
HOME=/home/geeknik
LANG=en_US.UTF-8
LANGUAGE (unset)
LD_LIBRARY_PATH (unset)
LOGDIR (unset)
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
PERL_BADLANG (unset)
SHELL=/bin/bash

Segmentation Fault in Perl 5.21.8 while fuzzing Perl binary #14389

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions