avoid uninit read in re_op_compile()

Some code in this function examines the first two nodes in the regex to
set suitable flags etc. Part of the code accesses the second node
by using regnext(first), other parts by NEXTOPER(first). The second method
only works when the node is the same size as a basic node. I *think*
that the code only makes use of this second value in situations where
the node *is* basic, but nevertheless, it makes valgrind unhappy when
the first node is an EXACT node, and reading the second node's
supposed type field is actually reading the padding bytes at the end of
the EXACT string, which are uninitialised.

So just use regnext() only.

Something as simple as /x/ on non-debugging builds was enough to make
valgrind complain. (On debugging builds, the program buffer is initially
zero-filled.)

1 files changed, 3 insertions, 3 deletions

diff --git a/regcomp.c b/regcomp.c
index f8f6a6697a..712c8ed7d9 100644
--- a/regcomp.c
+++ b/regcomp.c
@@ -7320,7 +7320,7 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count,
          * flags appropriately - Yves */
         regnode *first = ri->program + 1;
         U8 fop = OP(first);
-        regnode *next = NEXTOPER(first);
+        regnode *next = regnext(first);
         U8 nop = OP(next);
 
         if (PL_regkind[fop] == NOTHING && nop == END)
@@ -7334,13 +7334,13 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count,
             r->extflags |= RXf_START_ONLY;
         else if (fop == PLUS
                  && PL_regkind[nop] == POSIXD && FLAGS(next) == _CC_SPACE
-                 && OP(regnext(first)) == END)
+                 && nop == END)
             r->extflags |= RXf_WHITE;
         else if ( r->extflags & RXf_SPLIT
                   && (fop == EXACT || fop == EXACTL)
                   && STR_LEN(first) == 1
                   && *(STRING(first)) == ' '
-                  && OP(regnext(first)) == END )
+                  && nop == END )
             r->extflags |= (RXf_SKIPWHITE|RXf_WHITE);
 
     }