Skip to content

the mark stack (and dMARK etc) are I32 even on 64-bit platforms #20917

Description

@tonycoz

Module:

Description

mark indexes (which point to the beginning of a list on the value stack) are I32, this means that a list that starts above the 2**32 item mark typically crashes perl.

Steps to Reproduce

# no error, but warning: uses 48GB virtual memory
$ ./perl -Ilib  -E 'my @x; $x[0x7FFF_FFF0] = "Hello"; sub x { @x } my @y = grep defined, x();'
# crash:
$ ./perl -Ilib  -E 'my @x; $x[0x8000_0000] = "Hello"; sub x { @x } my @y = grep defined, x();'
Segmentation fault
$ gdb --args  ./perl -Ilib  -E 'my @x; $x[0x8000_0000] = "Hello"; sub x { @x } my @y = grep defined, x();'
...
Program received signal SIGSEGV, Segmentation fault.
0x00005555556fa0c2 in Perl_pp_grepwhile () at pp_hot.c:4874
4874            if (SvPADTMP(src)) {
(gdb) p PL_markstack_ptr[0]
$1 = -2147483648
(gdb)

Expected behavior

No crash.
Perl configuration

Summary of my perl5 (revision 5 version 37 subversion 10) configuration:
  Commit id: 7a993362d98aecd43ecb9827773e5bd30947a5a2
  Platform:
    osname=linux
    osvers=5.10.0-21-amd64
    archname=x86_64-linux
    uname='linux venus 5.10.0-21-amd64 #1 smp debian 5.10.162-1 (2023-01-21) x86_64 gnulinux '
    config_args='-des -Dusedevel -DDEBUGGING'
    hint=recommended
    useposix=true
    d_sigaction=define
    useithreads=undef
    usemultiplicity=undef
    use64bitint=define
    use64bitall=define
    uselongdouble=undef
    usemymalloc=n
    default_inc_excludes_dot=define
  Compiler:
    cc='cc'
    ccflags ='-fwrapv -DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -D_FORTIFY_SOURCE=2'
    optimize='-O2 -g'
    cppflags='-fwrapv -DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include'
    ccversion=''
    gccversion='10.2.1 20210110'
    gccosandvers=''
    intsize=4
    longsize=8
    ptrsize=8
    doublesize=8
    byteorder=12345678
    doublekind=3
    d_longlong=define
    longlongsize=8
    d_longdbl=define
    longdblsize=16
    longdblkind=3
    ivtype='long'
    ivsize=8
    nvtype='double'
    nvsize=8
    Off_t='off_t'
    lseeksize=8
    alignbytes=8
    prototype=define
  Linker and Libraries:
    ld='cc'
    ldflags =' -fstack-protector-strong -L/usr/local/lib'
    libpth=/usr/local/lib /usr/lib/x86_64-linux-gnu /usr/lib /usr/lib64
    libs=-lpthread -lgdbm -ldl -lm -lcrypt -lutil -lc -lgdbm_compat
    perllibs=-lpthread -ldl -lm -lcrypt -lutil -lc
    libc=libc-2.31.so
    so=so
    useshrplib=false
    libperl=libperl.a
    gnulibc_version='2.31'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs
    dlext=so
    d_dlsymun=undef
    ccdlflags='-Wl,-E'
    cccdlflags='-fPIC'
    lddlflags='-shared -O2 -g -L/usr/local/lib -fstack-protector-strong'


Characteristics of this binary (from libperl): 
  Compile-time options:
    DEBUGGING
    HAS_TIMES
    PERLIO_LAYERS
    PERL_COPY_ON_WRITE
    PERL_DONT_CREATE_GVSV
    PERL_HASH_FUNC_SIPHASH13
    PERL_HASH_USE_SBOX32
    PERL_MALLOC_WRAP
    PERL_OP_PARENT
    PERL_PRESERVE_IVUV
    PERL_USE_DEVEL
    PERL_USE_SAFE_PUTENV
    USE_64_BIT_ALL
    USE_64_BIT_INT
    USE_LARGE_FILES
    USE_LOCALE
    USE_LOCALE_COLLATE
    USE_LOCALE_CTYPE
    USE_LOCALE_NUMERIC
    USE_LOCALE_TIME
    USE_PERLIO
    USE_PERL_ATOF
  Built under linux
  Compiled at Mar  9 2023 14:35:48
  %ENV:
    PERLBREW_BASHRC_VERSION="0.43"
    PERLBREW_HOME="/home/tony/.perlbrew"
    PERLBREW_MANPATH=""
    PERLBREW_PATH="/home/tony/perl5/perlbrew/bin"
    PERLBREW_ROOT="/home/tony/perl5/perlbrew"
    PERLBREW_VERSION="0.67"
  @INC:
    lib
    /usr/local/lib/perl5/site_perl/5.37.10/x86_64-linux
    /usr/local/lib/perl5/site_perl/5.37.10
    /usr/local/lib/perl5/5.37.10/x86_64-linux
    /usr/local/lib/perl5/5.37.10

Activity

  1. tonycoz commented on Mar 9, 2023

    @tonycoz
    ContributorAuthor

    My original example from #20841 is also a problem:

    ./perl -e 'my @x; $x[0x8000_0000] = 1; sub x { @x } my @y = x(); printf "%x\n", scalar(@y)'
    

    but it runs my machine out of memory for the slightly smaller case.

  2. added a commit that references this issue on Jan 25, 2024
    fdf5d79
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions