regcomp.c: Fix potential scalar leak

The lines in this code were reversed.  We need to check something before
overwriting it, rather than the other way around.  The result would be
that under certain circumstances a SV would not get freed.  Those
circumstances are very limited: the first of the three parameters to
this function is not empty, but the 2nd is, and the output (3rd
parameter) is to overwrite the 2nd.  I found this bug by code reading; I
have searched the code space and there are no current calls to it that
have this parameter configuration, therefore there is no test that can
be added to trigger it.

diff --git a/regcomp.c b/regcomp.c
index 08b9a90..98fa6b9 100644 (file)
--- a/regcomp.c
+++ b/regcomp.c
@@ -7844,11 +7844,11 @@ Perl__invlist_intersection_maybe_complement_2nd(pTHX_ SV* const a, SV* const b,
              * must be every possible code point.  Thus the intersection is
              * simply 'a'. */
             if (*i != a) {
-                *i = invlist_clone(a);
-
                 if (*i == b) {
                     SvREFCNT_dec_NN(b);
                 }
+
+                *i = invlist_clone(a);
             }
             /* else *i is already 'a' */
             return;