-Dmad: double free or corruption

> If your perl has -Dmad, the following program crashes:
>
> $ bleadperl -we '$x="x" x 257; eval "for $x"'
> *** glibc detected *** bleadperl: double free or corruption (!prev): 0x0000000001dca670 ***

Change 6136c704 changed S_scan_ident from:

   e = d + destlen - 3;

to:

   register char * const e = d + destlen + 3;

where e is used to mark the end of the buffer, this meant that the
various buffer end checks allowed the various buffers supplied
S_scan_ident to overflow.

Attached is a fix, various tests with fencepost checks on different
identifier lengths, and the specific case mentioned in the ticket.

Tony

Signed-off-by: H.Merijn Brand <h.m.brand@xs4all.nl>

1 files changed, 1 insertions, 1 deletions

diff --git a/toke.c b/toke.c
index 784ed7a159..d498a34b60 100644
--- a/toke.c
+++ b/toke.c
@@ -11366,7 +11366,7 @@ S_scan_ident(pTHX_ register char *s, register const char *send, char *dest, STRL
     char *bracket = NULL;
     char funny = *s++;
     register char *d = dest;
-    register char * const e = d + destlen + 3;    /* two-character token, ending NUL */
+    register char * const e = d + destlen - 3;    /* two-character token, ending NUL */
 
     PERL_ARGS_ASSERT_SCAN_IDENT;