avoid double-freeing regex code blocks

RT #130650 heap-use-after-free in S_free_codeblocks

When compiling qr/(?{...})/, a reg_code_blocks structure is allocated
and various SVs are attached to it. Initially this is set to be freed
via a destructor on the savestack, in case of early dying. Later the
structure is attached to the compiling regex, and a boolean flag in the
structure, 'attached', is set to true to show that the destructor no
longer needs to free the struct.

However, it is possible to get three orders of destruction:

1) allocate, push destructor, die early
2) allocate, push destructor, attach to regex, die
2) allocate, push destructor, attach to regex, succeed

In 2, the regex is freed (via the savestack) before the destructor is
called. In 3, the destructor is called, then later the regex is freed.

It turns out perl can't currently handle case 2:

    qr'(?{})\6'

Fix this by turning the 'attached' boolean field into an integer refcount,
then keep a count of whether the struct is referenced from the savestack
and/or the regex. Since it normally has a value of 1 or 2, it's similar
to a boolean flag, but crucially it no longer just indicates that the
regex has a pointer to it ('attached'), but that at least one of the
savestack and regex have a pointer to it. So order of freeing no longer
matters.

I also updated S_free_codeblocks() so that it nulls out SV pointers in
the reg_code_blocks struct before freeing them. This is is generally good
practice to avoid double frees, although is probably not needed at the
moment.

1 files changed, 10 insertions, 1 deletions

diff --git a/t/re/pat_re_eval.t b/t/re/pat_re_eval.t
index a51d1d3e03..4df88aff57 100644
--- a/t/re/pat_re_eval.t
+++ b/t/re/pat_re_eval.t
@@ -22,7 +22,7 @@ BEGIN {
 }
 
 
-plan tests => 528;  # Update this when adding/deleting tests.
+plan tests => 529;  # Update this when adding/deleting tests.
 
 run_tests() unless caller;
 
@@ -1244,6 +1244,15 @@ sub run_tests {
         pass "RT #129140";
     }
 
+    # RT #130650 code blocks could get double-freed during a pattern
+    # compilation croak
+
+    {
+        # this used to panic or give ASAN errors
+        eval 'qr/(?{})\6/';
+        like $@, qr/Reference to nonexistent group/, "RT #130650";
+    }
+
 
 } # End of sub run_tests