AddressSanitizer: heap-buffer-overflow in Perl_pp_unpack #15909
Comments
From mtowalski@pentest.net.plHello, I've attached the poc and the asan log. Configure options: “./Configure -des -Dusedevel -DDEBUGGING -Dcc=clang -Doptimize=-O2 -Accflags="-fsanitize=address -fsanitize-coverage=edge" -Aldflags="-fsanitize=address -fsanitize-coverage=edge" -Alddlflags=-shared" Information about configuration: Distributor ID: Ubuntu Best Regards, |
From mtowalski@pentest.net.pl/usr/bin/llvm-symbolizer
|
From @arcRT <perl5-security-report@perl.org> wrote:
Minor reduction: ./miniperl -e 'BEGIN { $SIG{__DIE__} = sub { exit } } unpack' But the unpack is a red herring here: the bug is actually that exit(0) When this happens, execution proceeds to the run-time phase. So afaict The same happens for other builtins that have one or more required arguments. $ ./miniperl -le 'BEGIN { $SIG{__DIE__} = sub { print "exiting: not ok Calling a builtin with too many arguments still exhibits the This is probably related to #2754 "[BUG] can't exit 0 from CHECK{}"; -- |
|
The RT System itself - Status changed from 'new' to 'open' |
From mtowalski@pentest.net.plHello, I've attached the poc and the asan log. Configure options: “./Configure -des -Dusedevel -DDEBUGGING -Dcc=clang -Doptimize=-O2 -Accflags="-fsanitize=address -fsanitize-coverage=edge" -Aldflags="-fsanitize=address -fsanitize-coverage=edge" -Alddlflags=-shared" Information about configuration: Distributor ID: Ubuntu Best Regards, |
From mtowalski@pentest.net.pl/usr/bin/llvm-symbolizer
|
From mtowalski@pentest.net.plHello, I've attached the poc and the asan log. Configure options: “./Configure -des -Dusedevel -DDEBUGGING -Dcc=clang -Doptimize=-O2 -Accflags="-fsanitize=address -fsanitize-coverage=edge" -Aldflags="-fsanitize=address -fsanitize-coverage=edge" -Alddlflags=-shared" Information about configuration: Distributor ID: Ubuntu Best Regards, |
From mtowalski@pentest.net.pl/usr/bin/llvm-symbolizer
|
From @arcThis reduces to: BEGIN { $SIG{__DIE__} = sub { exit } } and has the same cause as #130917 (namely, that doing exit in a __DIE__ hook visible at compile-time both fails to exit and prevents compilation errors from being thrown). I've therefore merged it into #130917. -- |
From @arcThis is exactly the same underlying bug as #130917 and #130931, so I've merged it into #130917. -- |
From mtowalski@pentest.net.plHello, I've attached the poc and the asan log. Configure options: “./Configure -des -Dusedevel -DDEBUGGING -Dcc=clang -Doptimize=-O2 -Accflags="-fsanitize=address -fsanitize-coverage=edge" -Aldflags="-fsanitize=address -fsanitize-coverage=edge" -Alddlflags=-shared" Information about configuration: Distributor ID: Ubuntu Best Regards, |
From mtowalski@pentest.net.pl/usr/bin/llvm-symbolizer
|
From @iabynOn Mon, Mar 06, 2017 at 08:25:34AM -0800, via RT wrote:
This is the same issue as RT #130917 - I'll merge the tickets. -- |
From @iabynOn Mon, Mar 06, 2017 at 08:55:51AM -0800, via RT wrote:
This is the same issue as RT #130917. I'll merge the tickets. -- |
|
The RT System itself - Status changed from 'new' to 'open' |
From @tonycozOn Thu, 09 Mar 2017 03:44:29 -0800, davem wrote:
This doesn't look like a security issue, since it requires feeding code to the interpreter, I'll move it to the public queue in a couple of days unless someone disagrees (or beats me to it.) Tony |
Migrated from rt.perl.org#130917 (status was 'open')
Searchable as RT130917$
The text was updated successfully, but these errors were encountered: