mg.c: Fix misuse of AvARRAY in defelem_target

defelem magic does not usually apply to tied arrays, but an array can
be tied after a defelem has been created and points to it.  The code
for handling deferred elements was never updated for tied arrays when
those were added, so it still does AvFILL and AvARRAY.

AvFILL works on tied arrays, and calls FETCHSIZE.  But AvARRAY
accesses the AV’s internal structure.  So AvFILL might suggest that
the index is within the array, whereas it is actually past the end
of AvARRAY.

By tying the array after a deferred element with a high index has been
created and then extending the tied array (so AvFILL returns a big
number), we can make AvARRAY[big number] crash.

This script:

use Tie::Array;
sub {
  tie @a, "Tie::StdArray";
  $#a = 20000;
  warn pre;
  "$_[0]";
  warn post
}->($a[10000]);

gives this output:

pre at -e line 5.
Segmentation fault: 11

For tied arrays, we need to use av_fetch, rather than AvARRAY.

1 files changed, 7 insertions, 0 deletions

diff --git a/mg.c b/mg.c
index 83aafa4016..e8d22a33a9 100644
--- a/mg.c
+++ b/mg.c
@@ -2299,7 +2299,14 @@ Perl_defelem_target(pTHX_ SV *sv, MAGIC *mg)
 	else if (LvSTARGOFF(sv) >= 0) {
 	    AV *const av = MUTABLE_AV(LvTARG(sv));
 	    if (LvSTARGOFF(sv) <= AvFILL(av))
+	    {
+	      if (SvRMAGICAL(av)) {
+		SV * const * const svp = av_fetch(av, LvSTARGOFF(sv), 0);
+		targ = svp ? *svp : NULL;
+	      }
+	      else
 		targ = AvARRAY(av)[LvSTARGOFF(sv)];
+	    }
 	}
 	if (targ && (targ != &PL_sv_undef)) {
 	    /* somebody else defined it for us */