alanh at fairlite
Jun 16, 2005, 6:58 AM
Post #3 of 4
(1158 views)
Permalink
|
|
Re: [perl #36309] miniperl 5.8.7 fails building DynaLoader
[In reply to]
|
|
On Thu, Jun 16, 2005 at 01:23:37PM -0000, Nicholas Clark via RT wrote:
> On Thu, Jun 16, 2005 at 11:13:28AM -0000, alanh @ fairlite. demon. co. uk wrote:
> > When building perl 5.8.7 with the -fstack-protector patches for GCC,
> > miniperl fails to build DynaLoader and segfaults. This didn't happen
> > with 5.8.6.
>
> I was unaware that these patches exist. Is the output of the debugging trace
> consistent with what you would expect from a stack smashing attack?
> (ie is perl inadvertently overflowing a buffer)
I'm not sure as I haven't dug that deeply, but using -fno-stack-protector
fixes the problem, so I'm assuming so.
> > Here's a backtrace of the crash in miniperl.
> >
> > Starting program: /usr/src/perl-5.8.7/miniperl "-I../../lib"
> > "-I../../lib" ../../lib/ExtUtils/xsubpp -noprototypes -typemap
> > ../../lib/ExtUtils/typemap DynaLoader.xs > DynaLoader.xsc && mv
> > DynaLoader.xsc DynaLoader.c
> >
> > Program received signal SIGSEGV, Segmentation fault.
> > 0x080d5a45 in S_regmatch (prog=0x8) at regexec.c:2886
> > 2886 PL_op = (OP_4tree*)PL_regdata->data[n];
> > (gdb) bt
> > #0 0x080d5a45 in S_regmatch (prog=0x8) at regexec.c:2886
> > #1 0x080d67fb in S_regmatch (prog=0x8) at regexec.c:3323
> > #2 0x080d67fb in S_regmatch (prog=0x8) at regexec.c:3323
> > #3 0x080d80e2 in S_regmatch (prog=0x8) at regexec.c:3845
> > #4 0x081b2c98 in ?? ()
> > #5 0x00000091 in ?? ()
> > #6 0x00000091 in ?? ()
> > #7 0x0824032c in ?? ()
> > #8 0x0000007f in ?? ()
> > #9 0xbfffe4b8 in ?? ()
> > #10 0x080d697e in S_regmatch (prog=0x8) at regexec.c:3348
> > #11 0x080d6153 in S_regmatch (prog=0x8) at regexec.c:3151
> > #12 0x080d5dbb in S_regmatch (prog=0x8) at regexec.c:2978
> > #13 0x080d67fb in S_regmatch (prog=0x8) at regexec.c:3323
> > #14 0x080d67fb in S_regmatch (prog=0x8) at regexec.c:3323
> > #15 0x080d6153 in S_regmatch (prog=0x8) at regexec.c:3151
> > #16 0x080d5dbb in S_regmatch (prog=0x8) at regexec.c:2978
> > #17 0x080d7fd0 in S_regmatch (prog=0x8) at regexec.c:3818
> > #18 0x08240313 in ?? ()
> > #19 0x0823f3dc in ?? ()
> > #20 0x0000002c in ?? ()
> > #21 0x08240317 in ?? ()
> > #22 0x00000023 in ?? ()
> > #23 0x00000000 in ?? ()
> > #24 0x080d7fd0 in S_regmatch (prog=0x8) at regexec.c:3818
> > #25 0x0814adc8 in ?? ()
> > #26 0x0815f558 in ?? ()
> > #27 0x00000029 in ?? ()
> > #28 0x08240313 in ?? ()
> > #29 0x00000023 in ?? ()
> > #30 0xbfffeff8 in ?? ()
> > #31 0x080d697e in S_regmatch (prog=0x8) at regexec.c:3348
> > #32 0x080d6153 in S_regmatch (prog=0x8) at regexec.c:3151
> > #33 0x080d7fd0 in S_regmatch (prog=0x8) at regexec.c:3818
> > #34 0x00000000 in ?? ()
> > #35 0x0823f438 in ?? ()
> > #36 0x00000028 in ?? ()
> > #37 0x08240312 in ?? ()
> > #38 0x00000023 in ?? ()
> > #39 0x00000000 in ?? ()
> > #40 0x080d7fd0 in S_regmatch (prog=0x8) at regexec.c:3818
> > #41 0x3931895a in ?? ()
> > #42 0x0823f2fc in ?? ()
> > #43 0x0823f9e0 in ?? ()
> > #44 0x08240312 in ?? ()
> > #45 0x00000023 in ?? ()
> > #46 0x00000002 in ?? ()
> > #47 0x080d7e7e in S_regmatch (prog=0x8) at regexec.c:3795
> > #48 0xb7fc93f4 in mylock () from /lib/libc.so.0
> > #49 0x0005021c in ?? ()
> > #50 0x00000073 in ?? ()
> > #51 0x08240309 in ?? ()
> > #52 0x00000023 in ?? ()
> > #53 0x00000000 in ?? ()
> > #54 0x080d7fd0 in S_regmatch (prog=0x8) at regexec.c:3818
> > #55 0x0823ab4c in ?? ()
> > #56 0x00000067 in ?? ()
> > #57 0x0823f2a8 in ?? ()
> > #58 0x00000000 in ?? ()
> > #59 0x00000023 in ?? ()
> > #60 0x08240308 in ?? ()
> > #61 0x080d88db in S_regtry (prog=0x8240308,
> > startpos=0x3931895a <Address 0x3931895a out of bounds>) at
> > regexec.c:2196
> > #62 0x080dc03b in Perl_regexec_flags (prog=0x823f2a8,
> > stringarg=0x8240308 "\tsv_setpvn($arg,
> > $var.context.value().chp(),\n\t\t$var.context.value().size());\n",
> > strend=0x8240355 "",
> > strbeg=0x8240308 "\tsv_setpvn($arg,
> > $var.context.value().chp(),\n\t\t$var.context.value().size());\n",
> > minend=0, sv=0x823ab4c, data=0x0, flags=3)
> > at regexec.c:1750
> > ---Type <return> to continue, or q <return> to quit---
> > #63 0x08097e3e in Perl_pp_match () at pp_hot.c:1340
> > #64 0x0808713f in Perl_runops_debug () at dump.c:1452
> > #65 0x0805cbfe in perl_run (my_perl=0x8114100) at perl.c:2000
> > #66 0x0804b34a in main (argc=-1073743736, argv=0xbffff864, env=0x8049ccd)
> > at miniperlmain.c:98
>
>
>
> > Compiler:
> > cc='gcc', ccflags ='-fno-strict-aliasing -pipe -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
> > optimize='-O3 -march=pentium3 -fprefetch-loop-arrays -funroll-loops -pipe',
> > cppflags='-DPERL5 -fno-strict-aliasing -pipe'
> > ccversion='', gccversion='3.3.5 (Gentoo Linux 3.3.5-r1, ssp-3.3.2-3, pie-8.7.7.1)', gccosandvers=''
> > intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
> > d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
> > ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
> > alignbytes=4, prototype=define
>
> As you have line numbers in your stack backtrace, you must have compiled
> with debuging, which means that you're not using the same compiler flags as
> the perl that perlbug ran with.
>
> Could you run ./myconfig and send the output?
>
> I don't have any guesses as to what changed in 5.8.7, but I'm hoping someone
> will spot something in that output and figure out why.
Attached the output of ./myconfig below. Note that -fstack-protector
is implicitly enabled by default and doesn't show it in this log.
Alan.
Summary of my perl5 (revision 5 version 8 subversion 7) configuration:
Platform:
osname=linux, osvers=2.6.11-gentoo-r4, archname=i486-linux
uname='linux ipcop 2.6.11-gentoo-r4 #1 smp wed mar 30 16:12:54 bst 2005 i486 pentium3 i486 gnulinux '
config_args='-ds -e -Dprefix=/usr -Dpager=/bin/less -isR -Dd_dosuid -Ui_db -Ui_gdbm -Ui_ndbm -Ui_dbm -Dmyhostname=localhost -Doptimize=-g -Dccflags= -Os -fomit-frame-pointer -march=i486 -mtune=pentium -pipe'
hint=recommended, useposix=true, d_sigaction=define
usethreads=undef use5005threads=undef useithreads=undef usemultiplicity=undef
useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
use64bitint=undef use64bitall=undef uselongdouble=undef
usemymalloc=n, bincompat5005=undef
Compiler:
cc='cc', ccflags ='-Os -fomit-frame-pointer -march=i486 -mtune=pentium -pipe -DDEBUGGING -fno-strict-aliasing -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
optimize='-g',
cppflags='-Os -fomit-frame-pointer -march=i486 -mtune=pentium -pipe -DDEBUGGING -fno-strict-aliasing'
ccversion='', gccversion='3.4.3', gccosandvers=''
intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
alignbytes=4, prototype=define
Linker and Libraries:
ld='cc', ldflags =''
libpth=/usr/lib
libs=-lnsl -ldl -lm -lcrypt -lutil -lc
perllibs=-lnsl -ldl -lm -lcrypt -lutil -lc
libc=/usr/lib/libc.so, so=so, useshrplib=false, libperl=libperl.a
gnulibc_version=''
Dynamic Linking:
dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
cccdlflags='-fpic', lddlflags='-shared'
|
