summaryrefslogtreecommitdiff
path: root/gv.c
diff options
context:
space:
mode:
authorDavid Mitchell <davem@iabyn.com>2019-04-03 11:06:22 +0100
committerDavid Mitchell <davem@iabyn.com>2019-04-03 11:06:22 +0100
commit06cbc317229e882f379e75eb3adf7cf9c071febd (patch)
tree0802f0af41f9017e3cc79dac06a8458767792f58 /gv.c
parent930ded6545f2602708b01c3a2fdfe43bcaf771a6 (diff)
downloadperl-06cbc317229e882f379e75eb3adf7cf9c071febd.tar.gz
Fix recent double free in S_parse_gv_stash_name()
RT #133977 My recent commit v5.29.9-29-g657ed7c1c1 moved all buffer freeing to the end of the function, but missed removing one of the existing frees. The problem was spotted by James E Keenan and diagnosed by Tony Cook; I just added a test. A simple reproducer is my $def = defined *{"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'x"};
Diffstat (limited to 'gv.c')
-rw-r--r--gv.c1
1 files changed, 0 insertions, 1 deletions
diff --git a/gv.c b/gv.c
index 61085f5c53..3b8759e88a 100644
--- a/gv.c
+++ b/gv.c
@@ -1665,7 +1665,6 @@ S_parse_gv_stash_name(pTHX_ HV **stash, GV **gv, const char **name,
gvp = (GV**)hv_fetch(*stash, key, is_utf8 ? -((I32)*len) : (I32)*len, add);
*gv = gvp ? *gvp : NULL;
if (!*gv || *gv == (const GV *)&PL_sv_undef) {
- Safefree(tmpfullbuf); /* free our tmpfullbuf if it was used */
goto notok;
}
/* here we know that *gv && *gv != &PL_sv_undef */