diff options
| author | Nicholas Clark <nick@ccl4.org> | 2010-06-12 20:43:37 +0100 |
|---|---|---|
| committer | Nicholas Clark <nick@ccl4.org> | 2010-06-12 20:43:37 +0100 |
| commit | ac3697cd90b00fae88e4f19931af920bc552e2b8 (patch) | |
| tree | 869f1a9ead069290e6fe0c5eb90a989bcfe7e7ba /pp_sys.c | |
| parent | 0f7807cda10b798e3d16820699b3a52f13a8de16 (diff) | |
| download | perl-ac3697cd90b00fae88e4f19931af920bc552e2b8.tar.gz | |
Fix edge cases in pp_getc and pp_tell where the stack extent was not checked.
Both conditionally POP a GV from the stack, but always PUSH a return value to
it. For the case where they did not POP the GV, they made no check that the
stack had space for the PUSH. This bug has been present since perl 5.000.
Diffstat (limited to 'pp_sys.c')
| -rw-r--r-- | pp_sys.c | 5 |
1 files changed, 5 insertions, 0 deletions
@@ -1194,6 +1194,9 @@ PP(pp_getc) IO *io = NULL; GV * const gv = (MAXARG==0) ? PL_stdingv : MUTABLE_GV(POPs); + if (MAXARG == 0) + EXTEND(SP, 1); + if (gv && (io = GvIO(gv))) { MAGIC * const mg = SvTIED_mg((const SV *)io, PERL_MAGIC_tiedscalar); if (mg) { @@ -2067,6 +2070,8 @@ PP(pp_tell) if (MAXARG != 0) PL_last_in_gv = MUTABLE_GV(POPs); + else + EXTEND(SP, 1); gv = PL_last_in_gv; if (gv && (io = GvIO(gv))) { |