Bug#513935: perl: segfaults under some circumstances when Data::Dumper is loaded

[Axel Beckert]

Package: perl
Version: 5.8.4-8sarge6, 5.8.8-7etch6, 5.10.0-19
Severity: normal

Hi,

by accident I produced a segfault with a perl script. I stripped it
down to the following line:

perl -MData::Dumper -e 'my %c=(d=>[1,2,3]); do { push(@{c{d}}, $d); } until 1'

(Yeah, that's broken code, but that doesn't matter here. ;-)

The segfault goes away, if you either

a) remove "-MData::Dumper" -> Syntax error
b) remove ",3" -> Syntax error
c) replace "@{c{d}}" with "@{$c{d}}" -> runs the script
d) remove the do until loop -> Syntax error

The segfault happens on Etch amd64 and i386, and on Lenny/Sid amd64,
i386 and kfreebsd-i386. It even was present on the oldest Debian box I
found around (which happens to be an Sarge on i386). So I suspect it's
an upstream bug. And a not really new but still yet undiscovered bug.

In my original (much longer) script, I also got a warning about what's
unclean with the code just before the segfault:

# perl /usr/local/sbin/add-backuppc-host.pl
Scalar value @{config{dir} better written as ${config{dir} at /usr/local/sbin/add-backuppc-host.pl line 134.
Segmentation fault

Here's a backtrace on Etch amd64:

!23 Z26 ?0 L2 abe at snitch:pts/6 (zsh 4.3.2) 16:54:47 [~] > gdb perl
GNU gdb 6.4.90-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu"...(no debugging symbols found)
Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) set args -MData::Dumper -e 'my %c=(d=>[1,2,3]); do { push(@{c{d}}, $d); } until 1' 
(gdb) r
Starting program: /usr/bin/perl -MData::Dumper -e 'my %c=(d=>[1,2,3]); do { push(@{c{d}}, $d); } until 1' 
warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7fff92ffe000
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
[Thread debugging using libthread_db enabled]
[New Thread 140529366124240 (LWP 3376)]
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 140529366124240 (LWP 3376)]
0x00007fcf8ac68baa in Perl_linklist () from /usr/lib/libperl.so.5.8
(gdb) bt
#0  0x00007fcf8ac68baa in Perl_linklist () from /usr/lib/libperl.so.5.8
#1  0x00007fcf8ac68bd5 in Perl_linklist () from /usr/lib/libperl.so.5.8
#2  0x00007fcf8ac68bd5 in Perl_linklist () from /usr/lib/libperl.so.5.8
#3  0x00007fcf8ac74cdb in Perl_newPROG () from /usr/lib/libperl.so.5.8
#4  0x00007fcf8ac6774a in Perl_yyparse () from /usr/lib/libperl.so.5.8
#5  0x00007fcf8ac489d0 in perl_free () from /usr/lib/libperl.so.5.8
#6  0x00007fcf8ac497db in perl_parse () from /usr/lib/libperl.so.5.8
#7  0x0000000000401753 in main ()
(gdb) 

(And all just because I forgot a dollar sign. :-)

-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.26.3-amd64-1
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages perl depends on:
ii  libc6                  2.3.6.ds1-13etch8 GNU C Library: Shared libraries
ii  libdb4.4               4.4.20-8          Berkeley v4.4 Database Libraries [
ii  libgdbm3               1.8.3-3           GNU dbm database routines (runtime
ii  perl-base              5.8.8-7etch6      The Pathologically Eclectic Rubbis
ii  perl-modules           5.8.8-7etch6      Core Perl modules

Versions of packages perl recommends:
ii  perl-doc                    5.8.8-7etch6 Perl documentation

-- no debconf information