In perl.git, the branch blead has been updated <https://perl5.git.perl.org/perl.git/commitdiff/06cbc317229e882f379e75eb3adf7cf9c071febd?hp=930ded6545f2602708b01c3a2fdfe43bcaf771a6>
- Log ----------------------------------------------------------------- commit 06cbc317229e882f379e75eb3adf7cf9c071febd Author: David Mitchell <[email protected]> Date: Wed Apr 3 11:06:22 2019 +0100 Fix recent double free in S_parse_gv_stash_name() RT #133977 My recent commit v5.29.9-29-g657ed7c1c1 moved all buffer freeing to the end of the function, but missed removing one of the existing frees. The problem was spotted by James E Keenan and diagnosed by Tony Cook; I just added a test. A simple reproducer is my $def = defined *{"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'x"}; ----------------------------------------------------------------------- Summary of changes: gv.c | 1 - t/op/stash_parse_gv.t | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/gv.c b/gv.c index 61085f5c53..3b8759e88a 100644 --- a/gv.c +++ b/gv.c @@ -1665,7 +1665,6 @@ S_parse_gv_stash_name(pTHX_ HV **stash, GV **gv, const char **name, gvp = (GV**)hv_fetch(*stash, key, is_utf8 ? -((I32)*len) : (I32)*len, add); *gv = gvp ? *gvp : NULL; if (!*gv || *gv == (const GV *)&PL_sv_undef) { - Safefree(tmpfullbuf); /* free our tmpfullbuf if it was used */ goto notok; } /* here we know that *gv && *gv != &PL_sv_undef */ diff --git a/t/op/stash_parse_gv.t b/t/op/stash_parse_gv.t index 05694ca8ce..bd9e95cf37 100644 --- a/t/op/stash_parse_gv.t +++ b/t/op/stash_parse_gv.t @@ -23,7 +23,7 @@ foreach my $t (@tests) { my ( $sub, $name ) = @$t; fresh_perl_is( - qq[sub $sub { print qq[ok\n]} &{"$sub"} ], + qq[sub $sub { print qq[ok\n]} &{"$sub"}; my \$d = defined *{"foo$sub"} ], q[ok], { switches => ['-w'] }, $name -- Perl5 Master Repository
