diff --git a/perl-5.16.1-perl-111610-Trouble-with-XS-APItest-t-clone-with-sta.patch b/perl-5.16.1-perl-111610-Trouble-with-XS-APItest-t-clone-with-sta.patch new file mode 100644 index 0000000..f3d9fda --- /dev/null +++ b/perl-5.16.1-perl-111610-Trouble-with-XS-APItest-t-clone-with-sta.patch @@ -0,0 +1,56 @@ +From 4a808ed163df1057031bc6d085300fe1ef6f57d2 Mon Sep 17 00:00:00 2001 +From: Michael Schroeder +Date: Fri, 8 Jun 2012 20:29:54 -0700 +Subject: [PATCH] [perl #111610] Trouble with XS-APItest/t/clone-with-stack.t + +I ran into a bit of a problem when building perl-5.16.0. +'make test' showed a segfault in ext/XS-APItest/t/clone-with-stack.t. +It seems to be caused by accessing already freed memory, it +segfaults because I have MALLOC_PERTUBE_ set, thus glibc fills +freed memory with some value. + +Digging deeper, it seems like perl_clone() does not fix +the cx's blk_oldcop element when doing context cloning, thus +blk_oldcop still points to PL_compiling in the old interp--the +calling scope for the BEGIN block being the compilation of the +code surrounding it--and the POPBLOCK done in leavesub will copy +the data from the old interp to PL_curcop. + +After fixing this, it still crashed because interp_dup->Iop was +zero after the runops_standard() call (which is probably +correct as the end of the BEGIN block was reached). So I +also added an if statement that checks the pointer. +--- + ext/XS-APItest/APItest.xs | 3 ++- + sv.c | 1 + + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/ext/XS-APItest/APItest.xs b/ext/XS-APItest/APItest.xs +index 2c0ee61..69b7066 100644 +--- a/ext/XS-APItest/APItest.xs ++++ b/ext/XS-APItest/APItest.xs +@@ -3084,7 +3084,8 @@ CODE: + PERL_SET_CONTEXT(interp_dup); + + /* continue after 'clone_with_stack' */ +- interp_dup->Iop = interp_dup->Iop->op_next; ++ if (interp_dup->Iop) ++ interp_dup->Iop = interp_dup->Iop->op_next; + + /* run with new perl */ + Perl_runops_standard(interp_dup); +diff --git a/sv.c b/sv.c +index 2034c00..fcd76a9 100644 +--- a/sv.c ++++ b/sv.c +@@ -12312,6 +12312,7 @@ Perl_cx_dup(pTHX_ PERL_CONTEXT *cxs, I32 ix, I32 max, CLONE_PARAMS* param) + Perl_croak(aTHX_ "Cloning substitution context is unimplemented"); + } + else { ++ ncx->blk_oldcop = (COP*)any_dup(ncx->blk_oldcop, param->proto_perl); + switch (CxTYPE(ncx)) { + case CXt_SUB: + ncx->blk_sub.cv = (ncx->blk_sub.olddepth == 0 +-- +1.7.11.4 + diff --git a/perl.spec b/perl.spec index 1bcd434..0eb69f3 100644 --- a/perl.spec +++ b/perl.spec @@ -29,7 +29,7 @@ Name: perl Version: %{perl_version} # release number must be even higher, because dual-lived modules will be broken otherwise -Release: 232%{?dist} +Release: 233%{?dist} Epoch: %{perl_epoch} Summary: Practical Extraction and Report Language Group: Development/Languages @@ -82,6 +82,9 @@ Patch9: perl-5.14.2-find2perl-transtate-question-mark-properly.patch # Fix broken atof, rhbz#835452, RT#109318 Patch10: perl-5.16.0-fix-broken-atof.patch +# Do not access freed memory when cloning thread, rhbz#825749, RT#111610 +Patch11: perl-5.16.1-perl-111610-Trouble-with-XS-APItest-t-clone-with-sta.patch + # Fix searching for Unicode::Collate::Locale data, rhbz#756118, CPANRT#72666, # fixed in Unicode-Collate-0.87. # TODO Looks like it was fixed differently? @@ -1319,6 +1322,7 @@ tarball from perl.org. %patch8 -p1 %patch9 -p1 %patch10 -p1 +%patch11 -p1 #copy the example script cp -a %{SOURCE5} . @@ -1521,6 +1525,7 @@ pushd %{build_archlib}/CORE/ 'Fedora Patch7: Dont run one io test due to random builder failures' \ 'Fedora Patch9: Fix find2perl to translate ? glob properly (RT#113054)' \ 'Fedora Patch10: Fix broken atof (RT#109318)' \ + 'Fedora Patch11: Do not access freed memory when cloning thread (RT#111610)' \ %{nil} rm patchlevel.bak @@ -2632,6 +2637,9 @@ sed \ # Old changelog entries are preserved in CVS. %changelog +* Tue Sep 11 2012 Petr Pisar - 4:5.16.1-233 +- Do not access freed memory when cloning thread (bug #825749) + * Wed Sep 05 2012 Petr Pisar - 4:5.16.1-232 - Move App::Cpan from perl-Test-Harness to perl-CPAN (bug #854577)