RT#130624: heap-use-after-free in 4-arg substr

1 files changed, 3 insertions, 1 deletions

diff --git a/pp.c b/pp.c
index 62316fc8b4..a640995e31 100644
--- a/pp.c
+++ b/pp.c
@@ -3396,8 +3396,10 @@ PP(pp_substr)
 	tmps = SvPV_force_nomg(sv, curlen);
 	if (DO_UTF8(repl_sv) && repl_len) {
 	    if (!DO_UTF8(sv)) {
+                /* Upgrade the dest, and recalculate tmps in case the buffer
+                 * got reallocated; curlen may also have been changed */
 		sv_utf8_upgrade_nomg(sv);
-		curlen = SvCUR(sv);
+		tmps = SvPV_nomg(sv, curlen);
 	    }
 	}
 	else if (DO_UTF8(sv))