writing to magic variables connected to the selected output GV when its IO object has been cleared crashes perl

[sigdevel]

Description

Tested at 5.15.78-2.el7.3.x86_64 (RED OS release MUROM 7.3.2 - Centos based system), but also reproduced this bug on other platforms x86_64.

Steps to Reproduce

Fonded several examples were found using endless recursion and causing falls.
Insert this string and run with perl -e or run string from file.

while(()){$0=();int""}((unpack("p>",pack("P"))))

for(0){$0=('',unpack('P>',pack('P')))}

sub o{}*STDOUT=0;{{$~=0}{()}}

Expected behavior

Is it correct that the interpreter does not processing such samples (even with the flag -w) and just calling SEGFAULT when trying to address the memory areas inaccessible to recording?

Perl configuration

perl version: v5.30.1

[jkeenan]

Steps to Reproduce

Found several examples were found using endless recursion and causing falls. Insert this string and run with perl -e or run string from file.

while(()){$0=();int""}((unpack("p>",pack("P"))))

for(0){$0=('',unpack('P>',pack('P')))}

Rewritten slightly for quotation marks as:
$ perl -e 'for(0){$0=(q||,unpack(q|P>|,pack(q|P|)))}'

sub o{}*STDOUT=0;{{$~=0}{()}}

In all cases, confirmed on FreeBSD-12 at both perl-5.32 and blead. Output:

Bus error (core dumped)

[demerphq]

On Sun, 22 Jan 2023, 05:48 a-shvedov, ***@***.***> wrote: Binary builded without Asan instrumented flags. Would it be necessary to add a asanlog file?

No, thanks for offering. We have reproducible case, anything else can be done by whomever picks up this bug. If you felt like accelerating the debugging of this or wanted to try your hand at a fix you could building a debugging perl, run the cases under gdb and get a stack trace of what blew up. Yves

…

[tonycoz]

while(()){$0=();int""}((unpack("p>",pack("P"))))

for(0){$0=('',unpack('P>',pack('P')))}

You're creating a pointer to something (pack 'P') then swapping the byte order of the pointer, and trying to access what it refers to.

The P/p pack/unpack template characters are very low level, you can't blindly use them and expect a sane result.

If you have a specific case where you expect some behaviour from these template characters and don't get it, please provide all the details, not just a "this crashes". You can assume unpack "P" or "p" crashes by default.

sub o{}*STDOUT=0;{{$~=0}{()}}

This is a real problem, and applies to other magic variables when *STDOUT has been cleared:

tony@venus:.../git/perl6$ ./perl -e '*STDOUT=0; $~ = 0;'
Segmentation fault
tony@venus:.../git/perl6$ ./perl -e '*STDOUT=0; $^ = 0;'
Segmentation fault
tony@venus:.../git/perl6$ ./perl -e '*STDOUT=0; $% = 0;'
Segmentation fault
tony@venus:.../git/perl6$ ./perl -e '*STDOUT=0; $- = 0;'
Segmentation fault
tony@venus:.../git/perl6$ ./perl -e '*STDOUT=0; $= = 0;'
Segmentation fault