1 files changed, 52 insertions, 27 deletions

diff --git a/pp.c b/pp.c
index a0b337a6e8..8a31fff881 100644
--- a/pp.c
+++ b/pp.c
@@ -1630,34 +1630,56 @@ PP(pp_substr)
     STRLEN curlen;
     I32 pos;
     I32 rem;
+    I32 fail;
     I32 lvalue = op->op_flags & OPf_MOD;
     char *tmps;
     I32 arybase = curcop->cop_arybase;
 
     if (MAXARG > 2)
 	len = POPi;
-    pos = POPi - arybase;
+    pos = POPi;
     sv = POPs;
     tmps = SvPV(sv, curlen);
-    if (pos < 0)
-	pos += curlen + arybase;
-    if (pos < 0 || pos > curlen) {
-	if (dowarn || lvalue)
+    if (pos >= arybase) {
+	pos -= arybase;
+	rem = curlen-pos;
+	fail = rem;
+        if (MAXARG > 2) {
+            if (len < 0) {
+	        rem += len;
+                if (rem < 0)
+                    rem = 0;
+            }
+            else if (rem > len)
+                     rem = len;
+        }
+    }
+    else {
+        pos += curlen;
+        if (MAXARG < 3)
+            rem = curlen;
+        else if (len >= 0) {
+            rem = pos+len;
+            if (rem > (I32)curlen)
+                rem = curlen;
+        }
+        else {
+            rem = curlen+len;
+            if (rem < pos)
+                rem = pos;
+        }
+        if (pos < 0)
+            pos = 0;
+        fail = rem;
+        rem -= pos;
+    }
+    if (fail < 0) {
+	if (dowarn || lvalue) 
 	    warn("substr outside of string");
 	RETPUSHUNDEF;
     }
     else {
-	if (MAXARG < 3)
-	    len = curlen;
-	else if (len < 0) {
-	    len += curlen - pos;
-	    if (len < 0)
-		len = 0;
-	}
 	tmps += pos;
-	rem = curlen - pos;	/* rem=how many bytes left*/
-	if (rem > len)
-	    rem = len;
 	sv_setpvn(TARG, tmps, rem);
 	if (lvalue) {			/* it's an lvalue! */
 	    if (!SvGMAGICAL(sv)) {
@@ -2328,11 +2350,13 @@ PP(pp_splice)
     SP++;
 
     if (++MARK < SP) {
-	offset = SvIVx(*MARK);
+	offset = i = SvIVx(*MARK);
 	if (offset < 0)
 	    offset += AvFILL(ary) + 1;
 	else
 	    offset -= curcop->cop_arybase;
+	if (offset < 0)
+	    DIE(no_aelem, i);
 	if (++MARK < SP) {
 	    length = SvIVx(*MARK++);
 	    if (length < 0)
@@ -2345,12 +2369,6 @@ PP(pp_splice)
 	offset = 0;
 	length = AvMAX(ary) + 1;
     }
-    if (offset < 0) {
-	length += offset;
-	offset = 0;
-	if (length < 0)
-	    length = 0;
-    }
     if (offset > AvFILL(ary) + 1)
 	offset = AvFILL(ary) + 1;
     after = AvFILL(ary) + 1 - (offset + length);
@@ -3847,12 +3865,19 @@ PP(pp_pack)
 	    while (len-- > 0) {
 		fromstr = NEXTFROM;
 		if (fromstr == &sv_undef)
-		  aptr = NULL;
+		    aptr = NULL;
 		else {
-		  if (SvREADONLY(fromstr) && curcop != &compiling) {
-		    fromstr = sv_mortalcopy(fromstr);
-		  }
-		  aptr = SvPV_force(fromstr, na);
+		    /* XXX better yet, could spirit away the string to
+		     * a safe spot and hang on to it until the result
+		     * of pack() (and all copies of the result) are
+		     * gone.
+		     */
+		    if (dowarn && (SvTEMP(fromstr) || SvPADTMP(fromstr)))
+			warn("Attempt to pack pointer to temporary value");
+		    if (SvPOK(fromstr) || SvNIOK(fromstr))
+			aptr = SvPV(fromstr,na);
+		    else
+			aptr = SvPV_force(fromstr,na);
 		}
 		sv_catpvn(cat, (char*)&aptr, sizeof(char*));
 	    }