| CC: | perl5-porters [...] perl-org, doy [...] cpan.org |
| Subject: | heap-use-after-free in List::MoreUtils::all in Moose testsuite |
clang -faddress-sanitizer detected a premature free in the Moose
testsuite.
Tested with latest blead, non-threaded and latest Moose and
List::MoreUtils.
I suggest for you to reproduce it with normal cc and break with gdb
at line 273 and look at the refcnt of cx->blk_sub.
Or use valgrind.
Or set MALLOC_PERTUBE_ as described in
http://udrepper.livejournal.com/11429.html
I have no idea yet how Moose plays with the context, resp. how this
affected by multicall.
$ pb t/metaclasses/metarole_w_metaclass_pm.t 2> list-moreutils.log
$ asan_addr2dis list-moreutils.log
==6918== ERROR: AddressSanitizer heap-use-after-free on address
0x7fc17bc360c0 at pc 0x7fc17983bc29 bp 0x7fff425d28d0 sp 0x7fff425d28c8
READ of size 4 at 0x7fc17bc360c0 thread T0
#0 000000000001dc29 <XS_List__MoreUtils_all+0xb0c9>:
for(i = 1 ; i < items ; i++) {
GvSV(PL_defgv) = args[i];
MULTICALL;
if (!SvTRUE(*PL_stack_sp)) {
273 POP_MULTICALL;
1dc29: 48 8b bc 24 00 11 00 mov 0x1100(%rsp),%rdi
#1 Perl_pp_entersub+0xe968
#2 Perl_runops_debug+0x2d7
#3 S_run_body+0x10ef
#4 perl_run+0x904
#5 main+0x418
#6 __libc_start_main+0xed
0x7fc17bc360c0 is located 64 bytes inside of 1920-byte region
[0x7fc17bc36080,0x7fc17bc36800)
freed by thread T0 here:
previously allocated by thread T0 here:
==6918== ABORTING
Stats: 23M malloced (68M for red zones) by 304711 calls
Stats: 2M realloced by 19439 calls
Stats: 12M freed by 166513 calls
Stats: 0M really freed by 0 calls
Stats: 120M (30728 full pages) mmaped in 30 calls
mmaps by size class: 8:311277; 9:8191; 10:4095; 11:2047; 12:1024;
13:1536; 14:256; 15:128; 16:64; 17:32;
mallocs by size class: 8:297934; 9:3195; 10:1231; 11:488; 12:382;
13:1280; 14:193; 15:3; 16:3; 17:2;
frees by size class: 8:162535; 9:1845; 10:875; 11:408; 12:222;
13:432; 14:191; 15:3; 16:2;
rfrees by size class:
Stats: malloc large: 2 small slow: 733
Shadow byte and word:
0x1ff82f786c18: fd
0x1ff82f786c18: fd fd fd fd fd fd fd fd
More shadow bytes:
0x1ff82f786bf8: fa fa fa fa fa fa fa fa
0x1ff82f786c00: fa fa fa fa fa fa fa fa
0x1ff82f786c08: fa fa fa fa fa fa fa fa
0x1ff82f786c10: fd fd fd fd fd fd fd fd
=>0x1ff82f786c18: fd fd fd fd fd fd fd fd
0x1ff82f786c20: fd fd fd fd fd fd fd fd
0x1ff82f786c28: fd fd fd fd fd fd fd fd
0x1ff82f786c30: fd fd fd fd fd fd fd fd
0x1ff82f786c38: fd fd fd fd fd fd fd fd
#define POP_MULTICALL
STMT_START {
if (! ((CvDEPTH(multicall_cv) = cx->blk_sub.olddepth)) ) {
LEAVESUB(multicall_cv);
}
$ MALLOC_PERTUBE_=1 valgrind /usr/local/bin/perl5.17.0d-nt@40aae1c -
Mblib t/metaclasses/metarole_w_metaclass_pm.t
==8090== Memcheck, a memory error detector
==8090== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==8090== Using Valgrind-3.6.1-Debian and LibVEX; rerun with -h for
copyright info
==8090== Command: /usr/local/bin/perl5.17.0d-nt@40aae1c -Mblib
t/metaclasses/metarole_w_metaclass_pm.t
==8090==
==8090== Invalid read of size 4
==8090== at 0x6B8C1A2: XS_List__MoreUtils_all (MoreUtils.xs:273)
==8090== by 0x581F71: Perl_pp_entersub (pp_hot.c:2767)
==8090== by 0x51D46F: Perl_runops_debug (dump.c:2130)
==8090== by 0x452193: S_run_body (perl.c:2412)
==8090== by 0x45151B: perl_run (perl.c:2330)
==8090== by 0x41E413: main (perlmain.c:120)
==8090== Address 0x5b27720 is 64 bytes inside a block of size 1,920
free'd
==8090== at 0x4C29097: realloc (vg_replace_malloc.c:525)
==8090== by 0x51DE93: Perl_safesysrealloc (util.c:194)
==8090== by 0x605910: Perl_cxinc (scope.c:80)
==8090== by 0x5810A5: Perl_pp_entersub (pp_hot.c:2678)
==8090== by 0x51D46F: Perl_runops_debug (dump.c:2130)
==8090== by 0x6B8BE7A: XS_List__MoreUtils_all (MoreUtils.xs:271)
==8090== by 0x581F71: Perl_pp_entersub (pp_hot.c:2767)
==8090== by 0x51D46F: Perl_runops_debug (dump.c:2130)
==8090== by 0x452193: S_run_body (perl.c:2412)
==8090== by 0x45151B: perl_run (perl.c:2330)
==8090== by 0x41E413: main (perlmain.c:120)
==8090==
ok 1 - apply Role::Foo to My::Class->meta()
--
Reini Urban