[perl #76540] "print CONSTANT," gives double-free

gv_init() has name and len args, but newCONSTSUB() (which it calls)
doesn't have a len arg, so any trailing garbage in name gets used by
newCONSTSUB.

In the test case, this means that we end up attaching the const CV
to both the "FOO" and qq{FOO, "\\n";\n} GVs. So it gets freed twice.

1 files changed, 9 insertions, 1 deletions

diff --git a/gv.c b/gv.c
index a5c33d93f1..a50878f549 100644
--- a/gv.c
+++ b/gv.c
@@ -288,8 +288,16 @@ Perl_gv_init(pTHX_ GV *gv, HV *stash, const char *name, STRLEN len, int multi)
 	CV *cv;
 	ENTER;
 	if (has_constant) {
+	    char *name0 = NULL;
+	    if (name[len])
+		/* newCONSTSUB doesn't take a len arg, so make sure we
+		 * give it a \0-terminated string */
+		name0 = savepvn(name,len);
+
 	    /* newCONSTSUB takes ownership of the reference from us.  */
-	    cv = newCONSTSUB(stash, name, has_constant);
+	    cv = newCONSTSUB(stash, (name0 ? name0 : name), has_constant);
+	    if (name0)
+		Safefree(name0);
 	    /* If this reference was a copy of another, then the subroutine
 	       must have been "imported", by a Perl space assignment to a GV
 	       from a reference to CV.  */