regexec.c: Safer stack handling for re-evals
authorFather Chrysostomos <sprout@cpan.org>
Tue, 13 Nov 2012 17:10:09 +0000 (09:10 -0800)
committerFather Chrysostomos <sprout@cpan.org>
Tue, 13 Nov 2012 22:54:21 +0000 (14:54 -0800)
I don’t believe there is an actual bug here (only a theoretical one), but comparing pointers into an array that has been reallocated meanwhile is not a good idea.

regexec.c

index ecf8f87..4940641 100644 (file)
--- a/regexec.c
+++ b/regexec.c
@@ -4732,7 +4732,7 @@ S_regmatch(pTHX_ regmatch_info *reginfo, char *startpos, regnode *prog)
                /* execute the code in the {...} */
 
                dSP;
-               SV ** before;
+               PADOFFSET before;
                OP * const oop = PL_op;
                COP * const ocurcop = PL_curcop;
                OP *nop;
@@ -4851,11 +4851,11 @@ S_regmatch(pTHX_ regmatch_info *reginfo, char *startpos, regnode *prog)
                /* we don't use MULTICALL here as we want to call the
                 * first op of the block of interest, rather than the
                 * first op of the sub */
-               before = SP;
+               before = SP-PL_stack_base;
                PL_op = nop;
                CALLRUNOPS(aTHX);                       /* Scalar context. */
                SPAGAIN;
-               if (SP == before)
+               if (SP-PL_stack_base == before)
                    ret = &PL_sv_undef;   /* protect against empty (?{}) blocks. */
                else {
                    ret = POPs;