In pp_require and code refs in @INC, avoid using memory after free().

d8723a6a74b2c12e wasn't perfect, as the char * returned by SvPV*() can be
a temporary, freed at the next FREETMPS. There is a FREETMPS in pp_require,
so move the SvPV*() after it.

2 files changed, 19 insertions, 6 deletions

diff --git a/pp_ctl.c b/pp_ctl.c
index 28fc6ffdb3..33ed21e7d8 100644
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -3468,11 +3468,6 @@ PP(pp_require)
 			count = call_sv(loader, G_ARRAY);
 		    SPAGAIN;
 
-		    /* Adjust file name if the hook has set an %INC entry */
-		    svp = hv_fetch(GvHVn(PL_incgv), name, len, 0);
-		    if (svp)
-			tryname = SvPV_nolen_const(*svp);
-
 		    if (count > 0) {
 			int i = 0;
 			SV *arg;
@@ -3534,6 +3529,12 @@ PP(pp_require)
 		    FREETMPS;
 		    LEAVE_with_name("call_INC");
 
+		    /* Adjust file name if the hook has set an %INC entry.
+		       This needs to happen after the FREETMPS above.  */
+		    svp = hv_fetch(GvHVn(PL_incgv), name, len, 0);
+		    if (svp)
+			tryname = SvPV_nolen_const(*svp);
+
 		    if (tryrsfp) {
 			hook_sv = dirsv;
 			break;
diff --git a/t/op/incfilter.t b/t/op/incfilter.t
index f796275f0b..7b09966fb4 100644
--- a/t/op/incfilter.t
+++ b/t/op/incfilter.t
@@ -19,7 +19,7 @@ use strict;
 use Config;
 use Filter::Util::Call;
 
-plan(tests => 141);
+plan(tests => 143);
 
 unshift @INC, sub {
     no warnings 'uninitialized';
@@ -221,3 +221,15 @@ do [\'pa', \&generator_with_state,
     ["ss('And generators which take state');\n",
      "pass('And return multiple lines');\n",
     ]] or die;
+
+# d8723a6a74b2c12e wasn't perfect, as the char * returned by SvPV*() can be
+# a temporary, freed at the next FREETMPS. And there is a FREETMPS in
+# pp_require
+
+for (0 .. 1) {
+    # Need both alternatives on the regexp, because currently the logic in
+    # pp_require for what is written to %INC is somewhat confused
+    open $fh, "<",
+	\'like(__FILE__, qr/(?:GLOB|CODE)\(0x[0-9a-f]+\)/, "__FILE__ is valid");';
+    do $fh or die;
+}