HTTP/2 200 cache-control: max-age=43200 server: Combust/Plack (Perl) vary: Accept-Encoding content-encoding: gzip content-length: 1733 content-type: text/html; charset=utf-8 last-modified: Tue, 14 Oct 2025 13:55:42 GMT traceparent: ed06b92380d7a713ef8a94763d74b39c strict-transport-security: max-age=15768000 Front page | perl.perl5.porters | Postings from January 2015

[perl #123542] Segmentation fault in Perl5 while fuzzing Perl binary (possible stack overflow?)

Thread Previous | Thread Next

On Sun Jan 04 18:21:03 2015, tonyc wrote:
> On Sun Jan 04 16:23:21 2015, jkeenan wrote:
> > The patch provided by khw in RT #123539 to address a different
> > segfault reported by the same tester does not address the problem in
> > *this* ticket.  So this is a different problem.
> 
> Right, this is a problem with the construction of the op-tree.
> 
> The loop:
> 
> while (OpSIBLING(kid) != repl)
>     kid = OpSIBLING(kid);
> op_sibling_splice(expr, kid, 1, NULL);
> 
> attempts to deref a NULL kid because it can't find repl in the op's
> children.
> 
> Adding NULL checks here crashes in op_free() instead.
> 
> I'm working on producing a smaller test-case.
I cannot reproduce this on a Mac.  I do get a crash on dromedary, but no debugging symbols, which makes it a little hard to debug. :-(
This has to be some sort of memory corruption if op_last points to something not found in the op_first->op_sibling->... chain.
-- 
Father Chrysostomos
---
via perlbug:  queue: perl5 status: open
https://rt.perl.org/Ticket/Display.html?id=123542

Thread Previous | Thread Next

• [perl #123542] Segmentation fault in Perl5 while fuzzing Perl binary (possible stack overflow?) by Father Chrysostomos via RT
• Re: [perl #123542] Segmentation fault in Perl5 while fuzzing Perl binary (possible stack overflow?) by Andreas Koenig
• [perl #123542] Segmentation fault in Perl5 while fuzzing Perl binary (possible stack overflow?) by Father Chrysostomos via RT
• [perl #123542] Segmentation fault in Perl5 while fuzzing Perl binary (possible stack overflow?) by Tony Cook via RT
• [perl #123542] Segmentation fault in Perl5 while fuzzing Perl binary (possible stack overflow?) by Tony Cook via RT
• [perl #123542] Segmentation fault in Perl5 while fuzzing Perl binary (possible stack overflow?) by James E Keenan via RT
• [perl #123542] Segmentation fault in Perl5 while fuzzing Perl binary (possible stack overflow?) by Brian Carpenter