Fix a crash with a tainted formline() picture

A private (tainted) string did not get its share of space
in the destination string, causing a buffer overflow later.

Originally reported by Roland Kuhn as http://bugs.debian.org/575318

1 files changed, 1 insertions, 1 deletions

diff --git a/pp_ctl.c b/pp_ctl.c
index 2d4d6ddd18..4c3ffafb7e 100644
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -504,7 +504,7 @@ PP(pp_formline)
     NV value;
     bool gotsome = FALSE;
     STRLEN len;
-    const STRLEN fudge = SvPOK(tmpForm)
+    const STRLEN fudge = SvPOKp(tmpForm)
 			? (SvCUR(tmpForm) * (IN_BYTES ? 1 : 3) + 1) : 0;
     bool item_is_utf8 = FALSE;
     bool targ_is_utf8 = FALSE;