Fix bug #15161 by increasing the refcount on the RE and making

sure to restore it correctly. Deals with both s//e and s///g.

p4raw-id: //depot/perl@19342

1 files changed, 12 insertions, 1 deletions

diff --git a/pp_ctl.c b/pp_ctl.c
index ac05b2f5fe..91fc2caa00 100644
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -98,7 +98,7 @@ PP(pp_regcomp)
 	    memNE(PM_GETRE(pm)->precomp, t, len))
 	{
 	    if (PM_GETRE(pm)) {
-		ReREFCNT_dec(PM_GETRE(pm));
+	        ReREFCNT_dec(PM_GETRE(pm));
 		PM_SETRE(pm, Null(REGEXP*));	/* crucial if regcomp aborts */
 	    }
 	    if (PL_op->op_flags & OPf_SPECIAL)
@@ -159,6 +159,15 @@ PP(pp_substcont)
     register REGEXP *rx = cx->sb_rx;
     SV *nsv = Nullsv;
 
+    { 
+      REGEXP *old = PM_GETRE(pm);
+      if(old != rx) {
+	if(old) 
+	  ReREFCNT_dec(old);
+	PM_SETRE(pm,rx);
+      }
+    }
+
     rxres_restore(&cx->sb_rxres, rx);
     RX_MATCH_UTF8_set(rx, SvUTF8(cx->sb_targ));
 
@@ -213,6 +222,7 @@ PP(pp_substcont)
 	    SvTAINT(targ);
 
 	    LEAVE_SCOPE(cx->sb_oldsave);
+	    ReREFCNT_dec(rx);
 	    POPSUBST(cx);
 	    RETURNOP(pm->op_next);
 	}
@@ -248,6 +258,7 @@ PP(pp_substcont)
 	    sv_pos_b2u(sv, &i);
 	mg->mg_len = i;
     }
+    ReREFCNT_inc(rx);
     cx->sb_rxtainted |= RX_MATCH_TAINTED(rx);
     rxres_save(&cx->sb_rxres, rx);
     RETURNOP(pm->op_pmreplstart);