Fix edge case in pp_eof where the stack extent was not checked.

Analogous to pp_getc and pp_tell in ac3697cd90b00fae, pp_eof has a conditional
POP from the stack, but an unconditional PUSH to the stack, but no check that
the stack had space for the PUSH. This bug has been present since perl 5.000.

1 files changed, 8 insertions, 4 deletions

diff --git a/pp_sys.c b/pp_sys.c
index 9d4887f6c6..3525bfe33b 100644
--- a/pp_sys.c
+++ b/pp_sys.c
@@ -2010,10 +2010,14 @@ PP(pp_eof)
 
     if (MAXARG)
 	gv = PL_last_in_gv = MUTABLE_GV(POPs);	/* eof(FH) */
-    else if (PL_op->op_flags & OPf_SPECIAL)
-	gv = PL_last_in_gv = GvEGVx(PL_argvgv);	/* eof() - ARGV magic */
-    else
-	gv = PL_last_in_gv;			/* eof */
+    else {
+	EXTEND(SP, 1);
+
+	if (PL_op->op_flags & OPf_SPECIAL)
+	    gv = PL_last_in_gv = GvEGVx(PL_argvgv);	/* eof() - ARGV magic */
+	else
+	    gv = PL_last_in_gv;			/* eof */
+    }
 
     if (!gv)
 	RETPUSHNO;