Bug #124717 for Perl-Core: Heap buffer over read in hv.c:642 [perl #132952]

Wed Mar 07 20:55:51 2018 hackyzh002 [...] gmail.com - Ticket created

Subject:	Heap buffer over read in hv.c:642
From:	hackyzh002 [...] gmail.com

hackyzh@hackyzh-virtual-machine:~/Desktop$ ./perl-5.27.9/perl 123 ================================================================= ==117879==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000da30 at pc 0x0000008efe02 bp 0x7ffe2421cfd0 sp 0x7ffe2421cfc0 READ of size 8 at 0x60400000da30 thread T0 #0 0x8efe01 in Perl_hv_common /home/hackyzh/Desktop/perl-5.27.9/hv.c:642 #1 0x8f065f in Perl_hv_common_key_len /home/hackyzh/Desktop/perl-5.27.9/hv.c:337 #2 0x59faf4 in Perl_gv_override /home/hackyzh/Desktop/perl-5.27.9/gv.c:3713 #3 0x4c3dda in Perl_ck_require /home/hackyzh/Desktop/perl-5.27.9/op.c:12471 #4 0x48b07a in Perl_newUNOP /home/hackyzh/Desktop/perl-5.27.9/op.c:6134 #5 0x6aeb0d in Perl_yyparse /home/hackyzh/Desktop/perl-5.27.9/perly.y:1154 #6 0xaffbf1 in S_doeval_compile /home/hackyzh/Desktop/perl-5.27.9/pp_ctl.c:3492 #7 0xb695f5 in Perl_pp_entereval /home/hackyzh/Desktop/perl-5.27.9/pp_ctl.c:4468 #8 0x52b73d in Perl_eval_sv /home/hackyzh/Desktop/perl-5.27.9/perl.c:3196 #9 0x52cf47 in Perl_require_pv /home/hackyzh/Desktop/perl-5.27.9/perl.c:3303 #10 0x58393d in Perl_gv_fetchmethod_pvn_flags /home/hackyzh/Desktop/perl-5.27.9/gv.c:1114 #11 0x585823 in Perl_gv_fetchmethod_sv_flags /home/hackyzh/Desktop/perl-5.27.9/gv.c:1007 #12 0x983f58 in Perl_pp_method_named /home/hackyzh/Desktop/perl-5.27.9/pp_hot.c:5533 #13 0x92c74a in Perl_runops_standard /home/hackyzh/Desktop/perl-5.27.9/run.c:41 #14 0x555b39 in S_run_body /home/hackyzh/Desktop/perl-5.27.9/perl.c:2750 #15 0x555b39 in perl_run /home/hackyzh/Desktop/perl-5.27.9/perl.c:2671 #16 0x42b6e5 in main /home/hackyzh/Desktop/perl-5.27.9/perlmain.c:122 #17 0x7fe38e35282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #18 0x42c6c8 in _start (/home/hackyzh/Desktop/perl-5.27.9/perl+0x42c6c8) 0x60400000da36 is located 0 bytes to the right of 38-byte region [0x60400000da10,0x60400000da36) allocated by thread T0 here: #0 0x7fe38f0f6602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602) #1 0x8372dc in Perl_safesysmalloc /home/hackyzh/Desktop/perl-5.27.9/util.c:153 SUMMARY: AddressSanitizer: heap-buffer-overflow /home/hackyzh/Desktop/perl-5.27.9/hv.c:642 Perl_hv_common Shadow bytes around the buggy address: 0x0c087fff9af0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 07 fa 0x0c087fff9b00: fa fa 00 00 00 00 00 02 fa fa 00 00 00 00 07 fa 0x0c087fff9b10: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fff9b20: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa 0x0c087fff9b30: fa fa 00 00 00 00 00 06 fa fa fd fd fd fd fd fd =>0x0c087fff9b40: fa fa 00 00 00 00[06]fa fa fa fd fd fd fd fd fa 0x0c087fff9b50: fa fa 00 00 00 00 04 fa fa fa fd fd fd fd fd fa 0x0c087fff9b60: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 03 fa 0x0c087fff9b70: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 03 fa 0x0c087fff9b80: fa fa 00 00 00 00 03 fa fa fa 00 00 00 00 00 00 0x0c087fff9b90: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 03 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==117879==ABORTING hackyzh@hackyzh-virtual-machine:~/Desktop$ cat 123 ET. @a.\b#d"�.*^o ; for atoNSOCKE,ET, tktoNSCKT,E, tktoNSCKP,ET,Y$\=*^=*^V=$\=*:=*^=*\=*^=*^V=$\=*:=*^=*^V=$\=*^=*^V=$~=*^\=*^=*^V=$\=*:=*^=*\=*^=*^V=$\=*:=*^=*^V=$\=*^=%^V=$\=*^=*^V=$z=*:=*^=*^V=$\=*^=*^V=$^A#=$mm�@^~\��o�j\|�\\\�@^~\\..��F*^V=^=*^=*^V=$z=*:=*^=*^V=$\=*^=*^V=$^A#=$mm�@^~\��o�j\|�\\\�@^~\\..��F*^V=$z=*��:=*^=*^V=$\=*^H.��\h?\Q\|\^~ \dZ..��;l� I have tested on Ubuntu 16.04 x64.

Wed Mar 07 20:56:51 2018 hackyzh002 [...] gmail.com - Correspondence added

在2018-三月-07 20:55:51 星期三时，hackyzh002@gmail.com写到： Show quoted text

> hackyzh@hackyzh-virtual-machine:~/Desktop$ ./perl-5.27.9/perl 123 > ================================================================= > ==117879==ERROR: AddressSanitizer: heap-buffer-overflow on address > 0x60400000da30 at pc 0x0000008efe02 bp 0x7ffe2421cfd0 sp > 0x7ffe2421cfc0 > READ of size 8 at 0x60400000da30 thread T0 > #0 0x8efe01 in Perl_hv_common /home/hackyzh/Desktop/perl- > 5.27.9/hv.c:642 > #1 0x8f065f in Perl_hv_common_key_len /home/hackyzh/Desktop/perl- > 5.27.9/hv.c:337 > #2 0x59faf4 in Perl_gv_override /home/hackyzh/Desktop/perl- > 5.27.9/gv.c:3713 > #3 0x4c3dda in Perl_ck_require /home/hackyzh/Desktop/perl- > 5.27.9/op.c:12471 > #4 0x48b07a in Perl_newUNOP /home/hackyzh/Desktop/perl- > 5.27.9/op.c:6134 > #5 0x6aeb0d in Perl_yyparse /home/hackyzh/Desktop/perl- > 5.27.9/perly.y:1154 > #6 0xaffbf1 in S_doeval_compile /home/hackyzh/Desktop/perl- > 5.27.9/pp_ctl.c:3492 > #7 0xb695f5 in Perl_pp_entereval /home/hackyzh/Desktop/perl- > 5.27.9/pp_ctl.c:4468 > #8 0x52b73d in Perl_eval_sv /home/hackyzh/Desktop/perl- > 5.27.9/perl.c:3196 > #9 0x52cf47 in Perl_require_pv /home/hackyzh/Desktop/perl- > 5.27.9/perl.c:3303 > #10 0x58393d in Perl_gv_fetchmethod_pvn_flags > /home/hackyzh/Desktop/perl-5.27.9/gv.c:1114 > #11 0x585823 in Perl_gv_fetchmethod_sv_flags > /home/hackyzh/Desktop/perl-5.27.9/gv.c:1007 > #12 0x983f58 in Perl_pp_method_named /home/hackyzh/Desktop/perl- > 5.27.9/pp_hot.c:5533 > #13 0x92c74a in Perl_runops_standard /home/hackyzh/Desktop/perl- > 5.27.9/run.c:41 > #14 0x555b39 in S_run_body /home/hackyzh/Desktop/perl- > 5.27.9/perl.c:2750 > #15 0x555b39 in perl_run /home/hackyzh/Desktop/perl- > 5.27.9/perl.c:2671 > #16 0x42b6e5 in main /home/hackyzh/Desktop/perl- > 5.27.9/perlmain.c:122 > #17 0x7fe38e35282f in __libc_start_main (/lib/x86_64-linux- > gnu/libc.so.6+0x2082f) > #18 0x42c6c8 in _start (/home/hackyzh/Desktop/perl- > 5.27.9/perl+0x42c6c8) > > 0x60400000da36 is located 0 bytes to the right of 38-byte region > [0x60400000da10,0x60400000da36) > allocated by thread T0 here: > #0 0x7fe38f0f6602 in malloc (/usr/lib/x86_64-linux- > gnu/libasan.so.2+0x98602) > #1 0x8372dc in Perl_safesysmalloc /home/hackyzh/Desktop/perl- > 5.27.9/util.c:153 > > SUMMARY: AddressSanitizer: heap-buffer-overflow > /home/hackyzh/Desktop/perl-5.27.9/hv.c:642 Perl_hv_common > Shadow bytes around the buggy address: > 0x0c087fff9af0: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 07 fa > 0x0c087fff9b00: fa fa 00 00 00 00 00 02 fa fa 00 00 00 00 07 fa > 0x0c087fff9b10: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa > 0x0c087fff9b20: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa > 0x0c087fff9b30: fa fa 00 00 00 00 00 06 fa fa fd fd fd fd fd fd > =>0x0c087fff9b40: fa fa 00 00 00 00[06]fa fa fa fd fd fd fd fd fa > 0x0c087fff9b50: fa fa 00 00 00 00 04 fa fa fa fd fd fd fd fd fa > 0x0c087fff9b60: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 03 fa > 0x0c087fff9b70: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 03 fa > 0x0c087fff9b80: fa fa 00 00 00 00 03 fa fa fa 00 00 00 00 00 00 > 0x0c087fff9b90: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 03 fa > Shadow byte legend (one shadow byte represents 8 application bytes): > Addressable: 00 > Partially addressable: 01 02 03 04 05 06 07 > Heap left redzone: fa > Heap right redzone: fb > Freed heap region: fd > Stack left redzone: f1 > Stack mid redzone: f2 > Stack right redzone: f3 > Stack partial redzone: f4 > Stack after return: f5 > Stack use after scope: f8 > Global redzone: f9 > Global init order: f6 > Poisoned by user: f7 > Container overflow: fc > Array cookie: ac > Intra object redzone: bb > ASan internal: fe > ==117879==ABORTING > > hackyzh@hackyzh-virtual-machine:~/Desktop$ cat 123 > ET. @a.\b#d"�.*^o ; > > for atoNSOCKE,ET, tktoNSCKT,E, > tktoNSCKP,ET,Y$\=*^=*^V=$\=*:=*^=*\=*^=*^V=$\=*:=*^=*^V=$\=*^=*^V=$~=*^\=*^=*^V=$\=*:=*^=*\=*^=*^V=$\=*:=*^=*^V=$\=*^=%^V=$\=*^=*^V=$z=*:=*^=*^V=$\=*^=*^V=$^A#=$mm�@^~\��o�j\|�\\\�@^~\\..��F*^V=^=*^=*^V=$z=*:=*^=*^V=$\=*^=*^V=$^A#=$mm�@^~\��o�j\|�\\\�@^~\\..��F*^V=$z=*��:=*^=*^V=$\=*^H.��\h?\Q\|\^~ > \dZ..��;l� > > I have tested on Ubuntu 16.04 x64.

Subject:

123

Download 123
application/octet-stream 1.2k

Message body not shown because it is not plain text.

Thu Mar 08 03:27:12 2018 hackyzh002 [...] gmail.com - Forwarded Transaction #1775378 to perl5-security-report@perl.org

Thu Mar 08 03:27:29 2018 perl5-security-report-followup [...] perl.org - Correspondence added

Subject:	[perl #132952] AutoReply: Fwd: [rt.cpan.org #124717] Heap buffer over read in hv.c:642
Date:	Thu, 08 Mar 2018 00:27:19 -0800
To:	bug-Perl-Core [...] rt.cpan.org
From:	perl5-security-report-followup [...] perl.org

Greetings, This message has been automatically generated in response to the creation of a perl security report regarding: "Fwd: [rt.cpan.org #124717] Heap buffer over read in hv.c:642". There is no need to reply to this message right now. Your ticket has been assigned an ID of [perl #132952]. Please include the string: [perl #132952] in the subject line of all future correspondence about this issue. To do so, you may reply to this message (please delete unnecessary quotes and text.) Thank you, perl5-security-report-followup@perl.org ------------------------------------------------------------------------- Return-Path: <perlmail@x6.develooper.com> X-Spam-Status: No, score=-2.2 required=6.0 tests=ALL_TRUSTED,BAYES_00, MIME_HEADER_CTYPE_ONLY,T_TVD_MIME_NO_HEADERS,URIBL_BLOCKED autolearn=no version=3.3.1 X-RT-Mail-Extension: perl5-security CC: X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mx3.develooper.com Delivered-To: rt-perl5-security@rtperl.dev Delivered-To: perlmail-perl5-security-report@onion.perl.org From perlmail@x6.develooper.com Thu Mar 8 00:27:19 2018 From: bug-Perl-Core@rt.cpan.org X-Original-To: rt-perl5-security@rtperl.dev Content-Type: multipart/mixed; boundary="----------=_1520497632-26307-0" To: perl5-security-report@perl.org Subject: Fwd: [rt.cpan.org #124717] Heap buffer over read in hv.c:642 Message-ID: <20180308082712.A5B483B6@rtcpan.develooper.com> Received: from xx1.develooper.com (xx1.dev [10.0.100.115]) by rtperl.develooper.com (Postfix) with ESMTP id E176472D for <rt-perl5-security@rtperl.dev>; Thu, 8 Mar 2018 00:27:18 -0800 (PST) Received: from localhost (xx1.develooper.com [127.0.0.1]) by localhost (Postfix) with ESMTP id A371E11FDAF for <rt-perl5-security@rtperl.dev>; Thu, 8 Mar 2018 00:27:18 -0800 (PST) Received: from xx1.develooper.com (xx1.develooper.com [127.0.0.1]) by localhost (Postfix) with SMTP id BB9D9120971 for <rt-perl5-security@rtperl.dev>; Thu, 8 Mar 2018 00:27:16 -0800 (PST) Received: from x6.develooper.com (x6.develooper.com [207.171.7.86]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by xx1.develooper.com (Postfix) with ESMTPS id 06E9511FDAF for <rt-perl5-security@rt.perl.org>; Thu, 8 Mar 2018 00:27:15 -0800 (PST) Received: by x6.develooper.com (Postfix, from userid 514) id D82FE9E8; Thu, 8 Mar 2018 00:27:15 -0800 (PST) Received: (qmail 29651 invoked from network); 8 Mar 2018 08:27:15 -0000 Received: from xx1.develooper.com (207.171.7.115) by x6.develooper.com with SMTP; 8 Mar 2018 08:27:15 -0000 Received: from localhost (xx1.develooper.com [127.0.0.1]) by localhost (Postfix) with ESMTP id 3861211FDAF for <perlmail-perl5-security-report@onion.perl.org>; Thu, 8 Mar 2018 00:27:15 -0800 (PST) Received: from xx1.develooper.com (xx1.develooper.com [127.0.0.1]) by localhost (Postfix) with SMTP id 3D484120971 for <perlmail-perl5-security-report@onion.perl.org>; Thu, 8 Mar 2018 00:27:13 -0800 (PST) Received: from rtcpan.develooper.com (rtcpan.develooper.com [207.171.7.181]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by xx1.develooper.com (Postfix) with ESMTPS id 1F36311FDAF for <perl5-security-report@perl.org>; Thu, 8 Mar 2018 00:27:12 -0800 (PST) Received: by rtcpan.develooper.com (Postfix, from userid 536) id A5B483B6; Thu, 8 Mar 2018 00:27:12 -0800 (PST) Date: Thu, 8 Mar 2018 03:27:12 -0500 X-PMX-Version: 5.6.1.2065439, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2018.3.8.82116 X-PMX-Version: 5.6.1.2065439, Antispam-Engine: 2.7.2.376379, Antispam-Data: 2018.3.8.82116 X-RT-Interface: Email

Thu Mar 08 03:27:30 2018 The RT System itself - Status changed from 'new' to 'open'

Thu Mar 08 03:27:30 2018 The RT System itself - Subject changed from 'Heap buffer over read in hv.c:642' to 'Heap buffer over read in hv.c:642 [perl #132952]'

Fri Mar 09 10:01:02 2018 perl5-security-report-followup [...] perl.org - Correspondence added

Subject:	Re: [perl #132952] Fwd: [rt.cpan.org #124717] Heap buffer over read in hv.c:642
Date:	Fri, 09 Mar 2018 07:00:49 -0800
To:	bug-Perl-Core [...] rt.cpan.org
From:	"Dave Mitchell via RT" <perl5-security-report-followup [...] perl.org>

On Thu, Mar 08, 2018 at 12:27:19AM -0800, via RT wrote: Show quoted text

> ================================================================= > ==117879==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000da30 at pc 0x0000008efe02 bp 0x7ffe2421cfd0 sp 0x7ffe2421cfc0 > READ of size 8 at 0x60400000da30 thread T0 > #0 0x8efe01 in Perl_hv_common /home/hackyzh/Desktop/perl-5.27.9/hv.c:642

[snip] Show quoted text

> 0x60400000da36 is located 0 bytes to the right of 38-byte region [0x60400000da10,0x60400000da36)

This can be reduced to %:: = (); *STDOUT->foo; The whole main stash is emptied, then using an IO glob as an object in a method call lookup triggers requiring IO::File, which (on debugging builds) dies with this assertion: perl: hv.c:360: Perl_hv_common: Assertion `((svtype)((hv)->sv_flags & 0xff)) == SVt_PVHV' failed. This is because something expected to be a hash has been freed and then reused as a different type of scalar. Although in an ideal world we'd like perl not to crash when the main stash is emptied, it's not a terribly high priority, and its definitely not a security issue. -- "Procrastination grows to fill the available time" -- Mitchell's corollary to Parkinson's Law

Mon Mar 12 19:07:56 2018 perlbug-followup [...] perl.org - Correspondence added

Subject:	[perl #132952] Fwd: [rt.cpan.org #124717] Heap buffer over read in hv.c:642
Date:	Mon, 12 Mar 2018 16:07:45 -0700
To:	bug-Perl-Core [...] rt.cpan.org
From:	"Tony Cook via RT" <perlbug-followup [...] perl.org>

On Fri, 09 Mar 2018 07:00:49 -0800, davem wrote: Show quoted text

> On Thu, Mar 08, 2018 at 12:27:19AM -0800, via RT wrote:

> > ================================================================= > > ==117879==ERROR: AddressSanitizer: heap-buffer-overflow on address > > 0x60400000da30 at pc 0x0000008efe02 bp 0x7ffe2421cfd0 sp > > 0x7ffe2421cfc0 > > READ of size 8 at 0x60400000da30 thread T0 > > #0 0x8efe01 in Perl_hv_common /home/hackyzh/Desktop/perl- > > 5.27.9/hv.c:642

> [snip]

> > 0x60400000da36 is located 0 bytes to the right of 38-byte region > > [0x60400000da10,0x60400000da36)

> > This can be reduced to > > %:: = (); > *STDOUT->foo; > > The whole main stash is emptied, then using an IO glob as an object in > a > method call lookup triggers requiring IO::File, which (on debugging > builds) dies with this assertion: > > perl: hv.c:360: Perl_hv_common: Assertion `((svtype)((hv)->sv_flags & > 0xff)) == SVt_PVHV' failed. > > This is because something expected to be a hash has been freed and > then > reused as a different type of scalar. > > Although in an ideal world we'd like perl not to crash when the main > stash > is emptied, it's not a terribly high priority, and its definitely not > a > security issue.

Now in the public queue. Tony

Bug #124717 for Perl-Core: Heap buffer over read in hv.c:642 [perl #132952]

Preferred bug tracker