diff options
author | David Mitchell <davem@iabyn.com> | 2019-04-03 11:06:22 +0100 |
---|---|---|
committer | David Mitchell <davem@iabyn.com> | 2019-04-03 11:06:22 +0100 |
commit | 06cbc317229e882f379e75eb3adf7cf9c071febd (patch) | |
tree | 0802f0af41f9017e3cc79dac06a8458767792f58 /gv.c | |
parent | 930ded6545f2602708b01c3a2fdfe43bcaf771a6 (diff) | |
download | perl-06cbc317229e882f379e75eb3adf7cf9c071febd.tar.gz |
Fix recent double free in S_parse_gv_stash_name()
RT #133977
My recent commit v5.29.9-29-g657ed7c1c1 moved all buffer freeing to
the end of the function, but missed removing one of the existing frees.
The problem was spotted by James E Keenan and diagnosed by Tony Cook; I just
added a test.
A simple reproducer is
my $def = defined *{"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'x"};
Diffstat (limited to 'gv.c')
-rw-r--r-- | gv.c | 1 |
1 files changed, 0 insertions, 1 deletions
@@ -1665,7 +1665,6 @@ S_parse_gv_stash_name(pTHX_ HV **stash, GV **gv, const char **name, gvp = (GV**)hv_fetch(*stash, key, is_utf8 ? -((I32)*len) : (I32)*len, add); *gv = gvp ? *gvp : NULL; if (!*gv || *gv == (const GV *)&PL_sv_undef) { - Safefree(tmpfullbuf); /* free our tmpfullbuf if it was used */ goto notok; } /* here we know that *gv && *gv != &PL_sv_undef */ |