fix tainting of s/// with overloaded replacement

The substitution code was trying to track the taintedness of the
replacement string itself, but it didn't account for the replacement
being an untainted object with overloading that returns a tainted
stringification.  It looked at the taintedness of the object value, not
realising that taint could arise during the string concatenation per se.
Change the taint checks to look at the actual TAINT_get flag after string
concatenation.  This may falsely ascribe to the replacement taint that
actually came from somewhere else, but the end result is the same anyway:
there's no visible behaviour that distinguishes taint specifically from
the replacement.  Also remove a related taint check that seems to be
not needed at all.  Fixes [perl #115266].

1 files changed, 1 insertions, 3 deletions

diff --git a/pp_hot.c b/pp_hot.c
index 4f1047d300..61f742f298 100644
--- a/pp_hot.c
+++ b/pp_hot.c
@@ -4260,7 +4260,7 @@ PP(pp_subst)
 	    doutf8 = DO_UTF8(dstr);
 	}
 
-	if (SvTAINTED(dstr))
+	if (UNLIKELY(TAINT_get))
 	    rxtainted |= SUBST_TAINT_REPL;
     }
     else {
@@ -4435,8 +4435,6 @@ PP(pp_subst)
 	    }
 	    else {
 		sv_catsv(dstr, repl);
-		if (UNLIKELY(SvTAINTED(repl)))
-		    rxtainted |= SUBST_TAINT_REPL;
 	    }
 	    if (once)
 		break;