From @khwilliamson

On 06/18/2017 09:53 AM, Jakub Wilk (via RT) wrote:

# New Ticket Created by Jakub Wilk
# Please include the string: [perl #131598]
# in the subject line of all future correspondence about this issue.
# <URL: https://rt-archive.perl.org/perl5/Ticket/Display.html?id=131598 >

Consider the following program:

m'\N{U+.}';
__END__

When you run it under valgrind, you get:

 Invalid read of size 2
   at 0x402E020&#8203;: memcpy \(in /usr/lib/valgrind/vgpreload\_memcheck\-x86\-linux\.so\)
   by 0x815243E&#8203;: Perl\_sv\_vcatpvfn\_flags \(sv\.c&#8203;:13067\)
   by 0x814D860&#8203;: Perl\_sv\_vsetpvfn \(sv\.c&#8203;:10953\)
   by 0x810985B&#8203;: Perl\_vmess \(util\.c&#8203;:1485\)
   by 0x8109E4C&#8203;: Perl\_vcroak \(util\.c&#8203;:1714\)
   by 0x8109EE5&#8203;: Perl\_croak \(util\.c&#8203;:1761\)
   by 0x80E8FFF&#8203;: S\_grok\_bslash\_N \(regcomp\.c&#8203;:12168\)
   by 0x80EB5B8&#8203;: S\_regatom \(regcomp\.c&#8203;:12880\)
   by 0x80E6A9D&#8203;: S\_regpiece \(regcomp\.c&#8203;:11669\)
   by 0x80E6872&#8203;: S\_regbranch \(regcomp\.c&#8203;:11594\)
   by 0x80E58D4&#8203;: S\_reg \(regcomp\.c&#8203;:11332\)
   by 0x80D7CCD&#8203;: Perl\_re\_op\_compile \(regcomp\.c&#8203;:7101\)
 Address 0x4288d1e is 6 bytes after a block of size 120 free'd
   at 0x402A3A8&#8203;: free \(in /usr/lib/valgrind/vgpreload\_memcheck\-x86\-linux\.so\)
   by 0x810837B&#8203;: Perl\_safesysfree \(util\.c&#8203;:388\)
   by 0x816F501&#8203;: Perl\_leave\_scope \(scope\.c&#8203;:929\)
   by 0x816DA76&#8203;: Perl\_pop\_scope \(scope\.c&#8203;:124\)
   by 0x809BF63&#8203;: S\_sublex\_done \(toke\.c&#8203;:2569\)
   by 0x80A1E24&#8203;: Perl\_yylex \(toke\.c&#8203;:4918\)
   by 0x80BE6A1&#8203;: Perl\_yyparse \(perly\.c&#8203;:340\)
   by 0x8086637&#8203;: S\_parse\_body \(perl\.c&#8203;:2377\)
   by 0x808578B&#8203;: perl\_parse \(perl\.c&#8203;:1692\)
   by 0x8061751&#8203;: main \(perlmain\.c&#8203;:121\)

The above was tested on v5.26.0 built for i686-linux.

The exact symptoms seem to vary with Perl version. For example, when I run it
on Debian perl v5.24.1 on i386 (without valgrind this time), I get the
following warning on stderr:

 Invalid hexadecimal number in \\N\{U\+\.\.\.\} in regex; marked by \<\-\- HERE in m/ \<\-\- HERE \<binary garbage>

where binary garbage looks like a large chunk of the program memory, including
values of environment variables. :(

I single stepped through this in blead. On a DEBUGGING build, instead
an assertion fails:

==15879== Process terminating with default action of signal 6 (SIGABRT)
==15879== at 0x5B5A77F: raise (raise.c:58)
==15879== by 0x5B5C379: abort (abort.c:89)
==15879== by 0x5B52B46: __assert_fail_base (assert.c:92)
==15879== by 0x5B52BF1: __assert_fail (assert.c:101)
==15879== by 0x37E8AE: Perl_sv_vcatpvfn_flags (sv.c:12485)
==15879== by 0x37A431: Perl_sv_vsetpvfn (sv.c:10961)
==15879== by 0x2B3BEC: Perl_vmess (util.c:1487)
==15879== by 0x2B50C9: Perl_vcroak (util.c:1716)
==15879== by 0x2B54CA: Perl_croak (util.c:1763)
==15879== by 0x26D817: S_grok_bslash_N (regcomp.c:12168)
==15879== by 0x271CA3: S_regatom (regcomp.c:12932)
==15879== by 0x2694D5: S_regpiece (regcomp.c:11668)

Without DEBUGGING, and with -O2 optimization, I get

Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info
==16556== Command: ./perl -le m'\\N{U+.}';
==16556==
==16556== Invalid read of size 2
==16556== at 0x4C34618: memmove (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16556== by 0x1EB097: memcpy (string3.h:53)
==16556== by 0x1EB097: Perl_sv_vcatpvfn_flags (sv.c:13338)
==16556== by 0x1EE430: Perl_sv_vsetpvfn (sv.c:10961)
==16556== by 0x1BB42D: Perl_vmess (util.c:1487)
==16556== by 0x1BABB2: Perl_vcroak (util.c:1716)
==16556== by 0x1BB693: Perl_croak (util.c:1763)
==16556== by 0x19B638: S_grok_bslash_N (regcomp.c:12168)
==16556== by 0x1A20B5: S_regatom (regcomp.c:12932)
==16556== by 0x1A4C8C: S_regpiece (regcomp.c:11668)
==16556== by 0x1A4C8C: S_regbranch (regcomp.c:11593)
==16556== by 0x198431: S_reg (regcomp.c:11331)
==16556== by 0x1AED3B: Perl_re_op_compile (regcomp.c:7100)
==16556== by 0x14DE8C: Perl_pmruntime (op.c:5882)
==16556== Address 0x5bb16a6 is 14 bytes after a block of size 120 free'd
==16556== at 0x4C2ED5B: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16556== by 0x2194BB: Perl_leave_scope (scope.c:929)
==16556== by 0x185986: S_sublex_done (toke.c:2562)
==16556== by 0x174DC9: Perl_yylex (toke.c:4912)
==16556== by 0x1865FB: Perl_yyparse (perly.c:340)
==16556== by 0x15A815: S_parse_body (perl.c:2401)
==16556== by 0x15A815: perl_parse (perl.c:1719)
==16556== by 0x1331F2: main (perlmain.c:121)
==16556== Block was alloc'd at
==16556== at 0x4C2DB2F: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16556== by 0x1BA191: Perl_safesysmalloc (util.c:153)
==16556== by 0x1703F8: S_sublex_push (toke.c:2475)
==16556== by 0x1703F8: Perl_yylex (toke.c:4908)
==16556== by 0x1865FB: Perl_yyparse (perly.c:340)
==16556== by 0x15A815: S_parse_body (perl.c:2401)
==16556== by 0x15A815: perl_parse (perl.c:1719)
==16556== by 0x1331F2: main (perlmain.c:121)
==16556==
==16556== Invalid read of size 2
==16556== at 0x4C34627: memmove (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16556== by 0x1EB097: memcpy (string3.h:53)
==16556== by 0x1EB097: Perl_sv_vcatpvfn_flags (sv.c:13338)
==16556== by 0x1EE430: Perl_sv_vsetpvfn (sv.c:10961)
==16556== by 0x1BB42D: Perl_vmess (util.c:1487)
==16556== by 0x1BABB2: Perl_vcroak (util.c:1716)
==16556== by 0x1BB693: Perl_croak (util.c:1763)
==16556== by 0x19B638: S_grok_bslash_N (regcomp.c:12168)
==16556== by 0x1A20B5: S_regatom (regcomp.c:12932)
==16556== by 0x1A4C8C: S_regpiece (regcomp.c:11668)
==16556== by 0x1A4C8C: S_regbranch (regcomp.c:11593)
==16556== by 0x198431: S_reg (regcomp.c:11331)
==16556== by 0x1AED3B: Perl_re_op_compile (regcomp.c:7100)
==16556== by 0x14DE8C: Perl_pmruntime (op.c:5882)
==16556== Address 0x5bb16aa is 18 bytes after a block of size 120 free'd
==16556== at 0x4C2ED5B: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16556== by 0x2194BB: Perl_leave_scope (scope.c:929)
==16556== by 0x185986: S_sublex_done (toke.c:2562)
==16556== by 0x174DC9: Perl_yylex (toke.c:4912)
==16556== by 0x1865FB: Perl_yyparse (perly.c:340)
==16556== by 0x15A815: S_parse_body (perl.c:2401)
==16556== by 0x15A815: perl_parse (perl.c:1719)
==16556== by 0x1331F2: main (perlmain.c:121)
==16556== Block was alloc'd at
==16556== at 0x4C2DB2F: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==16556== by 0x1BA191: Perl_safesysmalloc (util.c:153)
==16556== by 0x1703F8: S_sublex_push (toke.c:2475)
==16556== by 0x1703F8: Perl_yylex (toke.c:4908)
==16556== by 0x1865FB: Perl_yyparse (perly.c:340)
==16556== by 0x15A815: S_parse_body (perl.c:2401)
==16556== by 0x15A815: perl_parse (perl.c:1719)
==16556== by 0x1331F2: main (perlmain.c:121)
==16556==
Invalid hexadecimal number in \N{U+...} in regex; marked by <-- HERE in
m/ <-- HERE �PPp0��pP\N{U+.}/ at -e line 1.

It looks to me that S_grok_bslash_N is passing correct stuff to the
error routines. I single stepped through it, but I would have to do
much more detailed study of an area I don't really understand to figure
out what's going wrong.

[CVE-2017-12883]Buffer over-read in S_grok_bslash_N #16025

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions