[perl #103260] Fix s/// with long strings

This is also the subject of perl #123071.

The iteration count was stored in an I32 and was overflowing.  If the
maximum number of iterations possible overflowed, then it would become
negative, and the substitution would fail immediately with ‘Substitu-
tion loop’.

I tried fixing this without increasing the size of the context
stack entries on 64-bit builds (by skipping the loop check for long
strings), but was unable to, because we have to return the number of
iterations, which was also stored as I32.  If we change just that one
to SSize_t, we get an I32-sized alignment hole, so we might as well
make maxiters a SSize_t as well, fixing the bug that way (the more
straightforward way).

1 files changed, 4 insertions, 4 deletions

diff --git a/pp_hot.c b/pp_hot.c
index a39fa1090b..dddfe69b0f 100644
--- a/pp_hot.c
+++ b/pp_hot.c
@@ -2514,8 +2514,8 @@ PP(pp_subst)
     char *strend;
     const char *c;
     STRLEN clen;
-    I32 iters = 0;
-    I32 maxiters;
+    SSize_t iters = 0;
+    SSize_t maxiters;
     bool once;
     U8 rxtainted = 0; /* holds various SUBST_TAINT_* flag bits.
 			See "how taint works" above */
@@ -2739,7 +2739,7 @@ PP(pp_subst)
 		Move(s, d, i+1, char);		/* include the NUL */
 	    }
 	    SPAGAIN;
-	    mPUSHi((I32)iters);
+	    mPUSHi(iters);
 	}
     }
     else {
@@ -2851,7 +2851,7 @@ PP(pp_subst)
 	    SvPV_set(dstr, NULL);
 
 	    SPAGAIN;
-	    mPUSHi((I32)iters);
+	    mPUSHi(iters);
 	}
     }