In pp_require and code refs in @INC, avoid using memory after free().

d8723a6a74b2c12e wasn't perfect, as the char * returned by SvPV*() can be
a temporary, freed at the next FREETMPS. There is a FREETMPS in pp_require,
so move the SvPV*() after it.

diff --git a/pp_ctl.c b/pp_ctl.c
index 28fc6ff..33ed21e 100644 (file)
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -3468,11 +3468,6 @@ PP(pp_require)
                        count = call_sv(loader, G_ARRAY);
                    SPAGAIN;
 
-                   /* Adjust file name if the hook has set an %INC entry */
-                   svp = hv_fetch(GvHVn(PL_incgv), name, len, 0);
-                   if (svp)
-                       tryname = SvPV_nolen_const(*svp);
-
                    if (count > 0) {
                        int i = 0;
                        SV *arg;
@@ -3534,6 +3529,12 @@ PP(pp_require)
                    FREETMPS;
                    LEAVE_with_name("call_INC");
 
+                   /* Adjust file name if the hook has set an %INC entry.
+                      This needs to happen after the FREETMPS above.  */
+                   svp = hv_fetch(GvHVn(PL_incgv), name, len, 0);
+                   if (svp)
+                       tryname = SvPV_nolen_const(*svp);
+
                    if (tryrsfp) {
                        hook_sv = dirsv;
                        break;

diff --git a/t/op/incfilter.t b/t/op/incfilter.t
index f796275..7b09966 100644 (file)
--- a/t/op/incfilter.t
+++ b/t/op/incfilter.t
@@ -19,7 +19,7 @@ use strict;
 use Config;
 use Filter::Util::Call;
 
-plan(tests => 141);
+plan(tests => 143);
 
 unshift @INC, sub {
     no warnings 'uninitialized';
@@ -221,3 +221,15 @@ do [\'pa', \&generator_with_state,
     ["ss('And generators which take state');\n",
      "pass('And return multiple lines');\n",
     ]] or die;
+
+# d8723a6a74b2c12e wasn't perfect, as the char * returned by SvPV*() can be
+# a temporary, freed at the next FREETMPS. And there is a FREETMPS in
+# pp_require
+
+for (0 .. 1) {
+    # Need both alternatives on the regexp, because currently the logic in
+    # pp_require for what is written to %INC is somewhat confused
+    open $fh, "<",
+       \'like(__FILE__, qr/(?:GLOB|CODE)\(0x[0-9a-f]+\)/, "__FILE__ is valid");';
+    do $fh or die;
+}