From owner-freebsd-ports-bugs@FreeBSD.ORG Mon Dec 29 19:40:02 2008 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 12FC71065673 for ; Mon, 29 Dec 2008 19:40:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id E0EEB8FC12 for ; Mon, 29 Dec 2008 19:40:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id mBTJe19j084479 for ; Mon, 29 Dec 2008 19:40:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id mBTJe1dU084478; Mon, 29 Dec 2008 19:40:01 GMT (envelope-from gnats) Resent-Date: Mon, 29 Dec 2008 19:40:01 GMT Resent-Message-Id: <200812291940.mBTJe1dU084478@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, kevin brintnall Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DC797106566C for ; Mon, 29 Dec 2008 19:38:15 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id C8D008FC1E for ; Mon, 29 Dec 2008 19:38:15 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id mBTJcF6f021343 for ; Mon, 29 Dec 2008 19:38:15 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id mBTJcFh0021342; Mon, 29 Dec 2008 19:38:15 GMT (envelope-from nobody) Message-Id: <200812291938.mBTJcFh0021342@www.freebsd.org> Date: Mon, 29 Dec 2008 19:38:15 GMT From: kevin brintnall To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: ports/130033: ports/lang/perl5.8: sv_dup() bug causes memory corruption in threaded perl X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Dec 2008 19:40:02 -0000 >Number: 130033 >Category: ports >Synopsis: ports/lang/perl5.8: sv_dup() bug causes memory corruption in threaded perl >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Dec 29 19:40:01 UTC 2008 >Closed-Date: >Last-Modified: >Originator: kevin brintnall >Release: 7.0-RELEASE >Organization: >Environment: FreeBSD hamachi.rufus.net 7.0-RELEASE-p6 FreeBSD 7.0-RELEASE-p6 #6: Mon Nov 24 14:35:54 CST 2008 root@hamachi.rufus.net:/usr/obj/usr/src/sys/RUFUS i386 >Description: A bug in Perl's sv_dup() causes potential memory corruption when new threads are spawned. The nature of the bug is exacerbated by FreeBSD 7's malloc() implementation, which packs like-sized allocations tightly together. A full description of the bug can be found at: http://marc.info/?l=perl5-porters&m=123018610517259&w=2 >How-To-Repeat: >Fix: The fix has already been intetgrated into Perl's official development branch ("blead"): http://perl5.git.perl.org/perl.git/commitdiff/2779b694b3fbb69a13c300a6e239e050151abf6d?hp=f08e0584288c021de71ecd212ba86a45c8f96a5b That patch does not apply cleanly to Perl 5.8 due to some context changes. Please consider adding the attached patch to ports/lang/perl5.8 until a version of Perl 5.8 is released with the fix. Patch attached with submission follows: --- sv.c.orig +++ sv.c @@ -10233,7 +10233,8 @@ Perl_sv_dup(pTHX_ SV *sstr, CLONE_PARAMS* param) SvSTASH_set(dstr, hv_dup_inc(SvSTASH(sstr), param)); AvARYLEN((AV*)dstr) = sv_dup_inc(AvARYLEN((AV*)sstr), param); AvFLAGS((AV*)dstr) = AvFLAGS((AV*)sstr); - if (AvARRAY((AV*)sstr)) { + /* avoid cloning an empty array */ + if (AvARRAY((AV*)sstr) && AvFILLp((AV*)sstr) >= 0) { SV **dst_ary, **src_ary; SSize_t items = AvFILLp((AV*)sstr) + 1; @@ -10258,6 +10259,8 @@ Perl_sv_dup(pTHX_ SV *sstr, CLONE_PARAMS* param) else { SvPV_set(dstr, Nullch); AvALLOC((AV*)dstr) = (SV**)NULL; + AvMAX( (AV*)dstr) = -1; + AvFILLp((AV*)dstr) = -1; } break; case SVt_PVHV: >Release-Note: >Audit-Trail: >Unformatted: