[perl #117941] Blessing into freed current stash

If the current stash has been freed, bless() with one argument will
cause a crash when the object’s ‘stash’ is accessed.  Simply disallow-
ing this is the easiest fix.

1 files changed, 4 insertions, 0 deletions

diff --git a/pp.c b/pp.c
index 0367023506..e63c3422da 100644
--- a/pp.c
+++ b/pp.c
@@ -607,8 +607,12 @@ PP(pp_bless)
     HV *stash;
 
     if (MAXARG == 1)
+    {
       curstash:
 	stash = CopSTASH(PL_curcop);
+	if (SvTYPE(stash) != SVt_PVHV)
+	    Perl_croak(aTHX_ "Attempt to bless into a freed package");
+    }
     else {
 	SV * const ssv = POPs;
 	STRLEN len;