eval $overloaded can crash

Perl_lex_start() assumes that the SV passed to it is a well-behaved
string that it can do PVX() stuff to. If it's actually a ref to an
overloaded object, it can crash and burn. Fixed by creating a stringified
copy of the SV if necessary.

1 files changed, 3 insertions, 2 deletions

diff --git a/toke.c b/toke.c
index ac00450398..5e2dc75acd 100644
--- a/toke.c
+++ b/toke.c
@@ -714,8 +714,9 @@ Perl_lex_start(pTHX_ SV *line, PerlIO *rsfp, bool new_filter)
 
     if (!len) {
 	parser->linestr = newSVpvs("\n;");
-    } else if (SvREADONLY(line) || s[len-1] != ';') {
-	parser->linestr = newSVsv(line);
+    } else if (SvREADONLY(line) || s[len-1] != ';' || !SvPOK(line)) {
+	parser->linestr = newSV_type(SVt_PV);
+	sv_copypv(parser->linestr, line); /* avoid tie/overload weirdness */
 	if (s[len-1] != ';')
 	    sv_catpvs(parser->linestr, "\n;");
     } else {