diff options
author | Father Chrysostomos <sprout@cpan.org> | 2013-08-24 22:51:40 -0700 |
---|---|---|
committer | Father Chrysostomos <sprout@cpan.org> | 2013-08-25 06:39:28 -0700 |
commit | 9a543cee73966ca61d6dc71cc7322f271f5b6b8b (patch) | |
tree | e09025b977dea713c2a927aa4fbed5c101e5e1c9 /perl.c | |
parent | fc16c3924bd6aa054f21ad5445fecf9b7f39dc36 (diff) | |
download | perl-9a543cee73966ca61d6dc71cc7322f271f5b6b8b.tar.gz |
Croak when range tries to extend stack too far
This fixes the rest of ticket #119161.
The range operator uses IVs internally to hold the current value for
integer ranges. It already checks that the arguments are within the
IV range and croaks otherwise. However, on 32-bit platforms with
64-bit integers, the different between the range’s endpoints can
exceed the maximum allowed memory allocation. This resulted in a
crash for 1..2**31, because EXTEND was passed a value which, when
cast to SSize_t, became -1, resulting in no reallocation. Then
pp_flop proceeded to write past the end of the stack.
No tests are included in this commit, as 1..2**31 could give three
different results depending on the platform.
Diffstat (limited to 'perl.c')
0 files changed, 0 insertions, 0 deletions