[perl] Do not access freed memory when cloning thread
Petr Pisar
ppisar at fedoraproject.org
Tue Sep 11 12:35:26 UTC 2012
commit d0fe0a83844ac75ba53dc258592a95d0101ecc30
Author: Petr Písař <ppisar at redhat.com>
Date: Tue Sep 11 09:44:49 2012 +0200
Do not access freed memory when cloning thread
...-Trouble-with-XS-APItest-t-clone-with-sta.patch | 56 ++++++++++++++++++++
perl.spec | 10 +++-
2 files changed, 65 insertions(+), 1 deletions(-)
---
diff --git a/perl-5.16.1-perl-111610-Trouble-with-XS-APItest-t-clone-with-sta.patch b/perl-5.16.1-perl-111610-Trouble-with-XS-APItest-t-clone-with-sta.patch
new file mode 100644
index 0000000..f3d9fda
--- /dev/null
+++ b/perl-5.16.1-perl-111610-Trouble-with-XS-APItest-t-clone-with-sta.patch
@@ -0,0 +1,56 @@
+From 4a808ed163df1057031bc6d085300fe1ef6f57d2 Mon Sep 17 00:00:00 2001
+From: Michael Schroeder <mls at suse.de>
+Date: Fri, 8 Jun 2012 20:29:54 -0700
+Subject: [PATCH] [perl #111610] Trouble with XS-APItest/t/clone-with-stack.t
+
+I ran into a bit of a problem when building perl-5.16.0.
+'make test' showed a segfault in ext/XS-APItest/t/clone-with-stack.t.
+It seems to be caused by accessing already freed memory, it
+segfaults because I have MALLOC_PERTUBE_ set, thus glibc fills
+freed memory with some value.
+
+Digging deeper, it seems like perl_clone() does not fix
+the cx's blk_oldcop element when doing context cloning, thus
+blk_oldcop still points to PL_compiling in the old interp--the
+calling scope for the BEGIN block being the compilation of the
+code surrounding it--and the POPBLOCK done in leavesub will copy
+the data from the old interp to PL_curcop.
+
+After fixing this, it still crashed because interp_dup->Iop was
+zero after the runops_standard() call (which is probably
+correct as the end of the BEGIN block was reached). So I
+also added an if statement that checks the pointer.
+---
+ ext/XS-APItest/APItest.xs | 3 ++-
+ sv.c | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/ext/XS-APItest/APItest.xs b/ext/XS-APItest/APItest.xs
+index 2c0ee61..69b7066 100644
+--- a/ext/XS-APItest/APItest.xs
++++ b/ext/XS-APItest/APItest.xs
+@@ -3084,7 +3084,8 @@ CODE:
+ PERL_SET_CONTEXT(interp_dup);
+
+ /* continue after 'clone_with_stack' */
+- interp_dup->Iop = interp_dup->Iop->op_next;
++ if (interp_dup->Iop)
++ interp_dup->Iop = interp_dup->Iop->op_next;
+
+ /* run with new perl */
+ Perl_runops_standard(interp_dup);
+diff --git a/sv.c b/sv.c
+index 2034c00..fcd76a9 100644
+--- a/sv.c
++++ b/sv.c
+@@ -12312,6 +12312,7 @@ Perl_cx_dup(pTHX_ PERL_CONTEXT *cxs, I32 ix, I32 max, CLONE_PARAMS* param)
+ Perl_croak(aTHX_ "Cloning substitution context is unimplemented");
+ }
+ else {
++ ncx->blk_oldcop = (COP*)any_dup(ncx->blk_oldcop, param->proto_perl);
+ switch (CxTYPE(ncx)) {
+ case CXt_SUB:
+ ncx->blk_sub.cv = (ncx->blk_sub.olddepth == 0
+--
+1.7.11.4
+
diff --git a/perl.spec b/perl.spec
index 1bcd434..0eb69f3 100644
--- a/perl.spec
+++ b/perl.spec
@@ -29,7 +29,7 @@
Name: perl
Version: %{perl_version}
# release number must be even higher, because dual-lived modules will be broken otherwise
-Release: 232%{?dist}
+Release: 233%{?dist}
Epoch: %{perl_epoch}
Summary: Practical Extraction and Report Language
Group: Development/Languages
@@ -82,6 +82,9 @@ Patch9: perl-5.14.2-find2perl-transtate-question-mark-properly.patch
# Fix broken atof, rhbz#835452, RT#109318
Patch10: perl-5.16.0-fix-broken-atof.patch
+# Do not access freed memory when cloning thread, rhbz#825749, RT#111610
+Patch11: perl-5.16.1-perl-111610-Trouble-with-XS-APItest-t-clone-with-sta.patch
+
# Fix searching for Unicode::Collate::Locale data, rhbz#756118, CPANRT#72666,
# fixed in Unicode-Collate-0.87.
# TODO Looks like it was fixed differently?
@@ -1319,6 +1322,7 @@ tarball from perl.org.
%patch8 -p1
%patch9 -p1
%patch10 -p1
+%patch11 -p1
#copy the example script
cp -a %{SOURCE5} .
@@ -1521,6 +1525,7 @@ pushd %{build_archlib}/CORE/
'Fedora Patch7: Dont run one io test due to random builder failures' \
'Fedora Patch9: Fix find2perl to translate ? glob properly (RT#113054)' \
'Fedora Patch10: Fix broken atof (RT#109318)' \
+ 'Fedora Patch11: Do not access freed memory when cloning thread (RT#111610)' \
%{nil}
rm patchlevel.bak
@@ -2632,6 +2637,9 @@ sed \
# Old changelog entries are preserved in CVS.
%changelog
+* Tue Sep 11 2012 Petr Pisar <ppisar at redhat.com> - 4:5.16.1-233
+- Do not access freed memory when cloning thread (bug #825749)
+
* Wed Sep 05 2012 Petr Pisar <ppisar at redhat.com> - 4:5.16.1-232
- Move App::Cpan from perl-Test-Harness to perl-CPAN (bug #854577)
More information about the scm-commits
mailing list