[perl #70614] Seg. fault with eval/use/UNITCHECK/DESTROY/eval combination

This case can be reduced to:
eval "UNITCHECK{ eval 0 }"

(eval 0 triggers the bug more reliably than eval ''.)

The inner eval clobbers PL_eval_start, so when the UNITCHECK finishes,
the outer eval tries to call the inner eval’s code, which has been
freed already.

This commit saves PL_eval_start and restores it after UNITCHECK.

1 files changed, 4 insertions, 1 deletions

diff --git a/pp_ctl.c b/pp_ctl.c
index 0a9dcfedd9..601a25c5ce 100644
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -3255,8 +3255,11 @@ S_doeval(pTHX_ int gimme, OP** startop, CV* outside, U32 seq)
 	}
     }
 
-    if (PL_unitcheckav)
+    if (PL_unitcheckav) {
+	OP *es = PL_eval_start;
 	call_list(PL_scopestack_ix, PL_unitcheckav);
+	PL_eval_start = es;
+    }
 
     /* compiled okay, so do it */