Do not crash if passed garbage like array.

Somehow we lost the test that caught getting passed an arrayref
instead of a simple scalar.  Also integrate fix from perl rt#120872.

1 files changed, 9 insertions, 3 deletions

diff --git a/vutil.c b/vutil.c
index 8eafd75d37..06680dd6fb 100644
--- a/vutil.c
+++ b/vutil.c
@@ -572,8 +572,9 @@ Perl_upg_version(pTHX_ SV *ver, bool qv)
 	}
 #endif
 	if (sv) {
-	    Perl_sv_setpvf(aTHX_ sv, "%.9"NVff, SvNVX(ver));
-	    buf = SvPV(sv, len);
+	    Perl_sv_catpvf(aTHX_ sv, "%.9"NVff, SvNVX(ver));
+	    len = SvCUR(sv);
+	    buf = SvPVX(sv);
 	}
 	else {
 	    len = my_snprintf(tbuf, sizeof(tbuf), "%.9"NVff, SvNVX(ver));
@@ -609,7 +610,7 @@ Perl_upg_version(pTHX_ SV *ver, bool qv)
     else if ( SvUOK(ver) || SvIOK(ver) ) {
 	version = savesvpv(ver);
     }
-    else /* must be a string or something like a string */
+    else if ( SvPOK(ver) )/* must be a string or something like a string */
     {
 	STRLEN len;
 	version = savepvn(SvPV(ver,len), SvCUR(ver));
@@ -650,6 +651,11 @@ Perl_upg_version(pTHX_ SV *ver, bool qv)
 #  endif
 #endif
     }
+    else
+    {
+	/* no idea what this is */
+	Perl_croak(aTHX_ "Invalid version format (non-numeric data)");
+    }
 
     s = SCAN_VERSION(version, ver, qv);
     if ( *s != '\0' )