diff options
| author | Father Chrysostomos <sprout@cpan.org> | 2013-10-27 16:44:50 -0700 |
|---|---|---|
| committer | Father Chrysostomos <sprout@cpan.org> | 2013-10-28 16:15:09 -0700 |
| commit | 475b1e904edd8a988cfa0eaa8a1d302d545c54ac (patch) | |
| tree | 61e917078baaed15ff599676640eb17417df0862 /perl.c | |
| parent | 2be08ad105a2a12613bb690aae26e2a9d3b225f2 (diff) | |
| download | perl-475b1e904edd8a988cfa0eaa8a1d302d545c54ac.tar.gz | |
[perl #54044] Make PL_replgv refcounted
Otherwise one can free it and make perl crash:
$ perl -e 'delete $::{"\cR"}; //'
Segmentation fault: 11
It crashes because PL_replgv now points to a freed SV which has no GV
slots, so GvSV on it fails.
Diffstat (limited to 'perl.c')
| -rw-r--r-- | perl.c | 4 |
1 files changed, 3 insertions, 1 deletions
@@ -956,7 +956,6 @@ perl_destruct(pTHXx) PL_stdingv = NULL; PL_stderrgv = NULL; PL_last_in_gv = NULL; - PL_replgv = NULL; PL_DBsingle = NULL; PL_DBtrace = NULL; PL_DBsignal = NULL; @@ -966,11 +965,13 @@ perl_destruct(pTHXx) SvREFCNT_dec(PL_envgv); SvREFCNT_dec(PL_argvgv); + SvREFCNT_dec(PL_replgv); SvREFCNT_dec(PL_DBgv); SvREFCNT_dec(PL_DBline); SvREFCNT_dec(PL_DBsub); PL_envgv = NULL; PL_argvgv = NULL; + PL_replgv = NULL; PL_DBgv = NULL; PL_DBline = NULL; PL_DBsub = NULL; @@ -3724,6 +3725,7 @@ S_init_main_stash(pTHX) SvREFCNT_inc_simple_void(PL_errgv); GvMULTI_on(PL_errgv); PL_replgv = gv_fetchpvs("\022", GV_ADD|GV_NOTQUAL, SVt_PV); /* ^R */ + SvREFCNT_inc_simple_void(PL_replgv); GvMULTI_on(PL_replgv); (void)Perl_form(aTHX_ "%240s",""); /* Preallocate temp - for immediate signals. */ #ifdef PERL_DONT_CREATE_GVSV |