diff options
author | Tony Cook <tony@develop-help.com> | 2015-12-17 15:14:58 +1100 |
---|---|---|
committer | Tony Cook <tony@develop-help.com> | 2015-12-17 15:14:58 +1100 |
commit | dc9ef9989ca4dc4207da49f653e8789816f50a11 (patch) | |
tree | 32e8142288dc631bca78af658bf53102d88ab256 /pp_sort.c | |
parent | 68bcb860c817a4691f45504f9563923c5ab2f6da (diff) | |
download | perl-dc9ef9989ca4dc4207da49f653e8789816f50a11.tar.gz |
[perl #124097] don't let the GPs be removed out from under pp_sort
pp_sort() saves the SV pointers for *a and *b, if the sort block
cleared *a or *b the GP, which the pointer is stored would be freed
and the save stack processing would try to write to freed memory.
Make sure the GP lasts at least long enough for the SV slots to be
restored. This doesn't attempt to restore *a or *b, the user chose
to clear them.
Diffstat (limited to 'pp_sort.c')
-rw-r--r-- | pp_sort.c | 7 |
1 files changed, 7 insertions, 0 deletions
@@ -1657,6 +1657,13 @@ PP(pp_sort) PL_secondgv = MUTABLE_GV(SvREFCNT_inc( gv_fetchpvs("b", GV_ADD|GV_NOTQUAL, SVt_PV) )); + /* make sure the GP isn't removed out from under us for + * the SAVESPTR() */ + save_gp(PL_firstgv, 0); + save_gp(PL_secondgv, 0); + /* we don't want modifications localized */ + GvINTRO_off(PL_firstgv); + GvINTRO_off(PL_secondgv); SAVESPTR(GvSV(PL_firstgv)); SAVESPTR(GvSV(PL_secondgv)); } |