This repository has been archived by the owner on Jun 1, 2023. It is now read-only.
-
-
Notifications
You must be signed in to change notification settings - Fork 17
fix @_ corruption in goto sig2pp (global destruction PERL_DESTRUCT_LEVEL=2 only) #134
Comments
Still fails on darwin DEBUGGING clang: https://travis-ci.org/perl11/cperl/jobs/122719501 |
With https://travis-ci.org/perl11/cperl/builds/122727369 linux passes, but darwin has a better allocator, and catches the invalid free. |
Removed blocking. It's only a PERL_DESTRUCT_LEVEL=2 issue in global destruction of that invalid pointer, so only observed by the core test suite, not in any real code, i.e. at scope end. |
rurban
pushed a commit
that referenced
this issue
Jun 3, 2016
After a goto from a signatured sub to a pure-perl sub, @_ / GvAV(PL_defgv) gets corrupted, which can SEGV/Invalid free esp. with valgrind in global destruction with PERL_DESTRUCT_LEVEL=2. There are also 2 other GVs being freed wrongly: Attempt to free temp prematurely with *\x08, $@ and @_. The root cause is cx->blk_sub.savearray being a random SP* pointer, not a AV which gets assigned to @_. Protect @_ assignment in goto from savearray, only for AVs. Protect @_ gp_av in gp_free similar to the gp_hv which is already protected like this. But the @_ gp_av case is different according to valgrind: the SP* can be any PADSV which was already deleted, so the av check may read from invalid freed memory. So delete and NULL @_ before sv_clean_all() Add -DDv debugging for symbols being destroyed. Fixes cperl #134 # Conflicts: # pp_ctl.c
rurban
changed the title
fix @_ corruption in goto sig2pp
fix @_ corruption in goto sig2pp (global destruction PERL_DESTRUCT_LEVEL=2 only)
Jun 8, 2016
Closed
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
in the #7 signatures branch we have this remaining blocker:
After a goto from a signatured sub to a pure-perl sub,
@_ / GvAV(PL_defgv) gets corrupted, which can SEGV/Invalid free in global destruction with PERL_DESTRUCT_LEVEL=2.
There are also 2 other GVs being freed wrongly: Attempt to free temp prematurely with *\x08, $@ and @_.
The root cause is cx->blk_sub.savearray being corrupted:
This needs to be reverse debugged
The text was updated successfully, but these errors were encountered: