[perl #117941] Handle vivification crashing w/freed stash

open’s handle vivification could crash if the current stash was freed,
so check before passing a freed stash to gv_init.

diff --git a/pp.c b/pp.c
index 3eb3cea..0367023 100644 (file)
--- a/pp.c
+++ b/pp.c
@@ -237,8 +237,10 @@ S_rv2gv(pTHX_ SV *sv, const bool vivify_sv, const bool strict,
                        Perl_croak_no_modify();
                    if (cUNOP->op_targ) {
                        SV * const namesv = PAD_SV(cUNOP->op_targ);
+                       HV *stash = CopSTASH(PL_curcop);
+                       if (SvTYPE(stash) != SVt_PVHV) stash = NULL;
                        gv = MUTABLE_GV(newSV(0));
-                       gv_init_sv(gv, CopSTASH(PL_curcop), namesv, 0);
+                       gv_init_sv(gv, stash, namesv, 0);
                    }
                    else {
                        const char * const name = CopSTASHPV(PL_curcop);

diff --git a/t/io/open.t b/t/io/open.t
index e06fc8e..ef56dda 100644 (file)
--- a/t/io/open.t
+++ b/t/io/open.t
@@ -10,7 +10,7 @@ $|  = 1;
 use warnings;
 use Config;
 
-plan tests => 121;
+plan tests => 122;
 
 my $Perl = which_perl();
 
@@ -386,3 +386,8 @@ SKIP: {
     ok( eval { $fh->autoflush(1); 1 }, '$fh->autoflush(1) lives' );
     ok( $INC{'IO/File.pm'}, "IO::File now loaded" );
 }
+
+sub _117941 { package _117941; open my $a, "TEST" }
+delete $::{"_117941::"};
+_117941();
+pass("no crash when open autovivifies glob in freed package");