diff options
author | Dave Mitchell <davem@fdisolutions.com> | 2008-05-27 00:12:52 +0000 |
---|---|---|
committer | Dave Mitchell <davem@fdisolutions.com> | 2008-05-27 00:12:52 +0000 |
commit | 62b40d2474e7487e6909e1872b6bccdf812c6818 (patch) | |
tree | f7c2a7ef2876e1b3c783a54b6a39d1a548454f50 /pp_sort.c | |
parent | d49025b75d9b5002071bd1a4210654dab5663ef0 (diff) | |
download | perl-62b40d2474e7487e6909e1872b6bccdf812c6818.tar.gz |
[perl #54758] Perl 5.10 memory corruption
When @a = sort @a is pessimised if @a has magic,
growing the stack requires various pointers to be reset in case
the stack gets reallocated.
p4raw-id: //depot/perl@33937
Diffstat (limited to 'pp_sort.c')
-rw-r--r-- | pp_sort.c | 5 |
1 files changed, 3 insertions, 2 deletions
@@ -1557,11 +1557,12 @@ PP(pp_sort) max = AvFILL(av) + 1; if (SvMAGICAL(av)) { MEXTEND(SP, max); - p2 = SP; for (i=0; i < max; i++) { SV **svp = av_fetch(av, i, FALSE); *SP++ = (svp) ? *svp : NULL; } + SP--; + p1 = p2 = SP - (max-1); } else { if (SvREADONLY(av)) @@ -1717,7 +1718,7 @@ PP(pp_sort) SvREADONLY_off(av); else if (av && !sorting_av) { /* simulate pp_aassign of tied AV */ - SV** const base = ORIGMARK+1; + SV** const base = MARK+1; for (i=0; i < max; i++) { base[i] = newSVsv(base[i]); } |