SEGV in readline with $/ set to a reference, discovered by theorbtwo.

The bug turns out to have been introduced in 2003, with change 18580.

p4raw-id: //depot/perl@34371

diff --git a/sv.c b/sv.c
index 6089a00..e39a2c9 100644 (file)
--- a/sv.c
+++ b/sv.c
@@ -6704,7 +6704,7 @@ Perl_sv_gets(pTHX_ register SV *const sv, register PerlIO *const fp, I32 append)
 #endif
       if (bytesread < 0)
          bytesread = 0;
-      SvCUR_set(sv, bytesread += append);
+      SvCUR_set(sv, bytesread + append);
       buffer[bytesread] = '\0';
       goto return_string_or_null;
     }