avoid tainting boolean return value of s///

RT #132385

s/// normally returns an integer count, but sometimes for efficiency it
will return a boolean instead (PL_sv_yes/PL_sv_zero).

In these cases, don't try to taint the return value, since it will die
with 'Modification of a read-only value'.

1 files changed, 2 insertions, 2 deletions

diff --git a/pp_hot.c b/pp_hot.c
index 958aa6e40e..bba90a8d9c 100644
--- a/pp_hot.c
+++ b/pp_hot.c
@@ -4190,8 +4190,8 @@ PP(pp_subst)
 	    (SvTAINTED(TARG) ? SUBST_TAINT_STR : 0)
 	  | (RXp_ISTAINTED(prog) ? SUBST_TAINT_PAT : 0)
 	  | ((pm->op_pmflags & PMf_RETAINT) ? SUBST_TAINT_RETAINT : 0)
-	  | ((once && !(rpm->op_pmflags & PMf_NONDESTRUCT))
-		? SUBST_TAINT_BOOLRET : 0));
+	  | ((  (once && !(rpm->op_pmflags & PMf_NONDESTRUCT))
+             || (PL_op->op_private & OPpTRUEBOOL)) ? SUBST_TAINT_BOOLRET : 0));
 	TAINT_NOT;
     }