From @geeknik

I have a smaller test case for this issue:

perl -e '$q0=q/00|0()0|0()\1/;0=~$q0'

==19699==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60200000dfcf at pc 0x000000b9fd2b bp 0x7ffde9f7a2f0 sp 0x7ffde9f7a2e8
READ of size 1 at 0x60200000dfcf thread T0
#0 0xb9fd2a in S_regmatch /root/perl/regexec.c:5440:9
#1 0xb7340c in S_regtry /root/perl/regexec.c:3622:14
#2 0xb6187e in S_find_byclass /root/perl/regexec.c:2693:44
#3 0xb4b17c in Perl_regexec_flags /root/perl/regexec.c:3371:13
#4 0x8c2978 in Perl_pp_match /root/perl/pp_hot.c:1818:10
#5 0x7f44b3 in Perl_runops_debug /root/perl/dump.c:2246:23
#6 0x5a12b6 in S_run_body /root/perl/perl.c:2526:2
#7 0x5a12b6 in perl_run /root/perl/perl.c:2449
#8 0x4de60d in main /root/perl/perlmain.c:123:9
#9 0x7fe73ece4b44 in __libc_start_main
/build/glibc-daoqzt/glibc-2.19/csu/libc-start.c:287
#10 0x4de27c in _start (/root/perl/perl+0x4de27c)

0x60200000dfcf is located 1 bytes to the left of 10-byte region
[0x60200000dfd0,0x60200000dfda)
allocated by thread T0 here:
#0 0x4c0bfb in malloc (/root/perl/perl+0x4c0bfb)
#1 0x7f82f7 in Perl_safesysmalloc /root/perl/util.c:153:21

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/perl/regexec.c:5440
S_regmatch
Shadow bytes around the buggy address:
0x0c047fff9ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9bc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9bd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9be0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9bf0: fa fa fa fa fa fa fa fa fa[fa]00 02 fa fa fd fd
0x0c047fff9c00: fa fa fd fd fa fa fd fd fa fa 00 00 fa fa fd fd
0x0c047fff9c10: fa fa 00 fa fa fa 05 fa fa fa 00 fa fa fa 00 02
0x0c047fff9c20: fa fa fd fa fa fa 00 01 fa fa fd fd fa fa fd fd
0x0c047fff9c30: fa fa fd fd fa fa 00 07 fa fa fd fd fa fa fd fd
0x0c047fff9c40: fa fa 00 02 fa fa fd fd fa fa fd fd fa fa 02 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
ASan internal: fe
==19699==ABORTING

==12629== Invalid read of size 1
==12629== at 0x5B454A: S_regmatch (regexec.c:5440)
==12629== by 0x5B454A: S_regtry (regexec.c:3622)
==12629== by 0x5BFBD4: S_find_byclass (regexec.c:2693)
==12629== by 0x5C7A80: Perl_regexec_flags (regexec.c:3371)
==12629== by 0x505CFC: Perl_pp_match (pp_hot.c:1818)
==12629== by 0x4D71A1: Perl_runops_debug (dump.c:2246)
==12629== by 0x453156: S_run_body (perl.c:2526)
==12629== by 0x453156: perl_run (perl.c:2449)
==12629== by 0x421984: main (perlmain.c:123)
==12629== Address 0x5f80edf is 1 bytes before a block of size 10 alloc'd
==12629== at 0x4C28C20: malloc (vg_replace_malloc.c:296)
==12629== by 0x4D9500: Perl_safesysmalloc (util.c:153)
==12629== by 0x525977: Perl_sv_grow (sv.c:1605)
==12629== by 0x5268CF: Perl_sv_2pv_flags (sv.c:3095)
==12629== by 0x5066D1: Perl_pp_match (pp_hot.c:1741)
==12629== by 0x4D71A1: Perl_runops_debug (dump.c:2246)
==12629== by 0x453156: S_run_body (perl.c:2526)
==12629== by 0x453156: perl_run (perl.c:2449)
==12629== by 0x421984: main (perlmain.c:123)
==12629==

heap-buffer-overflow in S_regmatch (regexec.c:5439) #15634

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions