fix tainting and overload

Sometimes when an overload method returned a tainted value, that
taintedness got lost. This fixes #75716: overload removes tainting.

It also considerably expands the tied series of tests in overload.t.
It now taints the return value, and checks for correct taintedness.
It also tests against two overload packages: the new one only has fallback
methods, which affects the return path for the tainted value.

It now also compares the expected (non-tied, non-overload) expression
value against a overloaded version of that expression in addition to
versions where a tied var returned an overloaded object; e.g. in these
expressions:
    1: 1 + $plain_value
    2: 1 + $overloaded_var
    3: 1 + $tied_scalar_that_returns_overloaded_value
    4: 1 + $tied_array_whose element_0_holds_an_overloaded_value[0]
then the value of expression 1 is compared against each of 2,3,4, whereas
before it was only compared against 3,4.

1 files changed, 2 insertions, 0 deletions

diff --git a/sv.c b/sv.c
index b06c14a98d..c38a318f74 100644
--- a/sv.c
+++ b/sv.c
@@ -2683,6 +2683,7 @@ Perl_sv_2num(pTHX_ register SV *const sv)
 	return sv;
     if (SvAMAGIC(sv)) {
 	SV * const tmpsv = AMG_CALLun(sv,numer);
+	TAINT_IF(tmpsv && SvTAINTED(tmpsv));
 	if (tmpsv && (!SvROK(tmpsv) || (SvRV(tmpsv) != SvRV(sv))))
 	    return sv_2num(tmpsv);
     }
@@ -2804,6 +2805,7 @@ Perl_sv_2pv_flags(pTHX_ register SV *const sv, STRLEN *const lp, const I32 flags
 		if (flags & SV_SKIP_OVERLOAD)
 		    return NULL;
 		tmpstr = AMG_CALLun(sv,string);
+		TAINT_IF(tmpstr && SvTAINTED(tmpstr));
 		if (tmpstr && (!SvROK(tmpstr) || (SvRV(tmpstr) != SvRV(sv)))) {
 		    /* Unwrap this:  */
 		    /* char *pv = lp ? SvPV(tmpstr, *lp) : SvPV_nolen(tmpstr);