Skip to content

Commit 06cbc31

Browse files
committed
Fix recent double free in S_parse_gv_stash_name()
RT #133977 My recent commit v5.29.9-29-g657ed7c1c1 moved all buffer freeing to the end of the function, but missed removing one of the existing frees. The problem was spotted by James E Keenan and diagnosed by Tony Cook; I just added a test. A simple reproducer is my $def = defined *{"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'x"};
1 parent 930ded6 commit 06cbc31

File tree

2 files changed

+1
-2
lines changed

2 files changed

+1
-2
lines changed

gv.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1665,7 +1665,6 @@ S_parse_gv_stash_name(pTHX_ HV **stash, GV **gv, const char **name,
16651665
gvp = (GV**)hv_fetch(*stash, key, is_utf8 ? -((I32)*len) : (I32)*len, add);
16661666
*gv = gvp ? *gvp : NULL;
16671667
if (!*gv || *gv == (const GV *)&PL_sv_undef) {
1668-
Safefree(tmpfullbuf); /* free our tmpfullbuf if it was used */
16691668
goto notok;
16701669
}
16711670
/* here we know that *gv && *gv != &PL_sv_undef */

t/op/stash_parse_gv.t

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ foreach my $t (@tests) {
2323
my ( $sub, $name ) = @$t;
2424

2525
fresh_perl_is(
26-
qq[sub $sub { print qq[ok\n]} &{"$sub"} ],
26+
qq[sub $sub { print qq[ok\n]} &{"$sub"}; my \$d = defined *{"foo$sub"} ],
2727
q[ok],
2828
{ switches => ['-w'] },
2929
$name

0 commit comments

Comments
 (0)