When %ENV has been turned into a non-magical hash after a

glob assignment, TAINT_ENV() may dump core because it
assumes $ENV{PATH} is magical. Fix this ; add a test to
verify that the PATH is still checked for taintedness.

p4raw-id: //depot/perl@21542

1 files changed, 8 insertions, 3 deletions

diff --git a/taint.c b/taint.c
index 7d4eb41ff2..c591e3f186 100644
--- a/taint.c
+++ b/taint.c
@@ -80,7 +80,8 @@ Perl_taint_env(pTHX)
 	NULL
     };
 
-    if (!PL_envgv)
+    /* Don't bother if there's no %ENV hash */
+    if (!PL_envgv || !GvHV(PL_envgv))
 	return;
 
 #ifdef VMS
@@ -98,7 +99,9 @@ Perl_taint_env(pTHX)
 	    TAINT;
 	    taint_proper("Insecure %s%s", "$ENV{DCL$PATH}");
 	}
-	if ((mg = mg_find(*svp, PERL_MAGIC_envelem)) && MgTAINTEDDIR(mg)) {
+	if (SvMAGICAL(*svp)
+		&& (mg = mg_find(*svp, PERL_MAGIC_envelem))
+		&& MgTAINTEDDIR(mg)) {
 	    TAINT;
 	    taint_proper("Insecure directory in %s%s", "$ENV{DCL$PATH}");
 	}
@@ -113,7 +116,9 @@ Perl_taint_env(pTHX)
 	    TAINT;
 	    taint_proper("Insecure %s%s", "$ENV{PATH}");
 	}
-	if ((mg = mg_find(*svp, PERL_MAGIC_envelem)) && MgTAINTEDDIR(mg)) {
+	if (SvMAGICAL(*svp)
+		&& (mg = mg_find(*svp, PERL_MAGIC_envelem))
+		&& MgTAINTEDDIR(mg)) {
 	    TAINT;
 	    taint_proper("Insecure directory in %s%s", "$ENV{PATH}");
 	}