study uses I32 internally for offsets, so should be skipped for long strings.

It already skips for anything that isn't a plain byte string with non-zero
length. Otherwise it risks becoming confused for strings longer than 2**31.

1 files changed, 2 insertions, 2 deletions

diff --git a/pp.c b/pp.c
index 0069fbabcf..3cfbe1aa2e 100644
--- a/pp.c
+++ b/pp.c
@@ -712,8 +712,7 @@ PP(pp_study)
 	    RETPUSHYES;
     }
     s = (unsigned char*)(SvPV(sv, len));
-    pos = len;
-    if (pos <= 0 || !SvPOK(sv) || SvUTF8(sv)) {
+    if (len == 0 || len > I32_MAX || !SvPOK(sv) || SvUTF8(sv)) {
 	/* No point in studying a zero length string, and not safe to study
 	   anything that doesn't appear to be a simple scalar (and hence might
 	   change between now and when the regexp engine runs without our set
@@ -721,6 +720,7 @@ PP(pp_study)
 	   stringification.  */
 	RETPUSHNO;
     }
+    pos = len;
 
     if (PL_lastscream) {
 	SvSCREAM_off(PL_lastscream);