[perl #22727] split() with re_eval segfaults/panics
Steve Grazzini
# Please include the string: [perl #22727]
# in the subject line of all future correspondence about this issue.
# <URL: http://rt.perl.org/rt2/Ticket/Display.html?id=22727 >
This is a bug report for perl from gr...@pobox.com,
generated with the help of perlbug 1.34 running under perl v5.8.1.
-----------------------------------------------------------------
[Please enter your report here]
% maintperl -e 'split /(?{ $x })/, "xxxxx"'
% maintperl -e 'split /(?{ $x })/, "xxxxxx"'
Segmentation fault (core dumped)
% bleadperl -e 'split /(?{ $x })/, "xxxx"'
% bleadperl -e 'split /(?{ $x })/, "xxxxx"'
panic: POPSTACK
panic: POPSTACK
panic: POPSTACK
panic: POPSTACK
panic: POPSTACK
panic: POPSTACK
panic: POPSTACK
panic: POP...
Doesn't seem to be there in 5.8.0.
[Please do not change anything below this line]
-----------------------------------------------------------------
---
Flags:
category=core
severity=low
---
Site configuration information for perl v5.8.1:
Configured by grazz at Wed Jun 18 01:13:40 EDT 2003.
Summary of my perl5 (revision 5.0 version 8 subversion 1) configuration:
Platform:
osname=linux, osvers=2.4.20, archname=i686-linux-thread-multi
uname='linux pobox.com 2.4.20 #1 smp tue apr 15 21:16:02 local time zone must be set--see zic i686 unknown '
config_args='-Dusethreads -Doptimize=-g -Dprefix=/usr -de'
hint=recommended, useposix=true, d_sigaction=define
usethreads=define use5005threads=undef useithreads=define usemultiplicity=define
useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
use64bitint=undef use64bitall=undef uselongdouble=undef
usemymalloc=n, bincompat5005=undef
Compiler:
cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
optimize='-g',
cppflags='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing'
ccversion='', gccversion='3.2.2 (CRUX)', gccosandvers=''
intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
alignbytes=4, prototype=define
Linker and Libraries:
ld='cc', ldflags =''
libpth=/lib /usr/lib
libs=-lnsl -lgdbm -ldb -ldl -lm -lpthread -lc -lcrypt -lutil -lrt
perllibs=-lnsl -ldl -lm -lpthread -lc -lcrypt -lutil -lrt
libc=/lib/libc-2.3.2.so, so=so, useshrplib=false, libperl=libperl.a
gnulibc_version='2.3.2'
Dynamic Linking:
dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-rdynamic'
cccdlflags='-fpic', lddlflags='-shared'
Locally applied patches:
MAINT19791
---
@INC for perl v5.8.1:
/usr/lib/perl5/5.8.1/i686-linux-thread-multi
/usr/lib/perl5/5.8.1
/usr/lib/perl5/site_perl/5.8.1/i686-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.1
/usr/lib/perl5/site_perl/5.8.0
/usr/lib/perl5/site_perl
.
---
Environment for perl v5.8.1:
HOME=/home/grazz
LANG (unset)
LANGUAGE (unset)
LD_LIBRARY_PATH (unset)
LOGDIR (unset)
PATH=/bin:/usr/bin:/usr/X11R6/bin:/opt/bin
PERLDOC=-n 'nroff -c'
PERL_BADLANG (unset)
SHELL=/bin/bash
Andreas J Koenig
> perl -e 'split /(?{ $x })/, "xxxxxx"'
Binary blame search tells me that 18805 looks suspicious.
--
andreas
Enache Adrian
Again, I already fixed that months ago, and hours after 18805 was
committed.
Look up my patch and testcase at:
http://nntp.perl.org/group/perl.perl5.porters/73117
[ there is also another bug/fix concerning regexp caching/split() there ]
I included an updated patch below.
Regards,
Adi
------------------------------------------------------------------------
diff -rup /arc/bleadperl/pp.c ./bleadperl/pp.c
--- /arc/bleadperl/pp.c 2003-06-13 23:36:54.000000000 +0300
+++ ./bleadperl/pp.c 2003-06-18 22:41:49.000000000 +0300
@@ -4658,13 +4658,13 @@ PP(pp_split)
}
else {
maxiters += slen * rx->nparens;
- while (s < strend && --limit
-/* && (!rx->check_substr
- || ((s = CALLREG_INTUIT_START(aTHX_ rx, sv, s, strend,
- 0, NULL))))
-*/ && CALLREGEXEC(aTHX_ rx, s, strend, orig,
- 1 /* minend */, sv, NULL, 0))
+ while (s < strend && --limit)
{
+ PUTBACK;
+ i = CALLREGEXEC(aTHX_ rx, s, strend, orig, 1 , sv, NULL, 0);
+ SPAGAIN;
+ if (i == 0)
+ break;
TAINT_IF(RX_MATCH_TAINTED(rx));
if (RX_MATCH_COPIED(rx) && rx->subbeg != orig) {
m = s;
@@ -4703,7 +4703,6 @@ PP(pp_split)
}
}
s = rx->endp[0] + orig;
- PUTBACK;
}
}
diff -rup /arc/bleadperl/regexec.c ./bleadperl/regexec.c
--- /arc/bleadperl/regexec.c 2003-05-06 00:25:16.000000000 +0300
+++ ./bleadperl/regexec.c 2003-06-18 22:41:49.000000000 +0300
@@ -2835,6 +2835,7 @@ S_regmatch(pTHX_ regnode *prog)
COP *ocurcop = PL_curcop;
PAD *old_comppad;
SV *ret;
+ struct regexp *oreg = PL_reg_re;
n = ARG(scan);
PL_op = (OP_4tree*)PL_regdata->data[n];
@@ -2967,8 +2968,10 @@ S_regmatch(pTHX_ regnode *prog)
sw = SvTRUE(ret);
logical = 0;
}
- else
+ else {
sv_setsv(save_scalar(PL_replgv), ret);
+ cache_re(oreg);
+ }
break;
}
case OPEN:
diff -rup /arc/bleadperl/t/op/pat.t ./bleadperl/t/op/pat.t
--- /arc/bleadperl/t/op/pat.t 2003-06-13 23:36:54.000000000 +0300
+++ ./bleadperl/t/op/pat.t 2003-06-18 22:57:45.000000000 +0300
@@ -6,7 +6,7 @@
$| = 1;
-print "1..1004\n";
+print "1..1006\n";
BEGIN {
chdir 't' if -d 't';
@@ -3140,7 +3140,15 @@ ok("bbbbac" =~ /$pattern/ && $1 eq 'a',
{
my $i;
ok('-1-3-5-' eq join('', split /((??{$i++}))/, '-1-3-5-'),
- "[perl #21411] (??{ .. }) corrupts split's stack")
+ "[perl #21411] (??{ .. }) corrupts split's stack");
+ split /(?{'WOW'})/, 'abc';
+ ok('a|b|c' eq join ('|', @_),
+ "[perl #21411] (?{ .. }) version of the above");
+}
+
+{
+ split /(?{ split "" })/, "abc";
+ ok(1,'cache_re & "(?{": it dumps core in 5.6.1 & 5.8.0');
}
{
Jarkko Hietaniemi
> committed.
Your patch now applied less than an hour after it was resubmitted :-)
Any other patches of yours lost?
--
Jarkko Hietaniemi <j...@iki.fi> http://www.iki.fi/jhi/ "There is this special
biologist word we use for 'stable'. It is 'dead'." -- Jack Cohen