[PATCH] [perl #7391] Perl crashes with certain write() formats.

This old bug report demonstrates that Perl uses too small a buffer to
compile fomats. In fact the buffer will overrun with as simple a format
as '@@@@@@' or '^^^^'.

This patch makes the buffer sizing more adaptive.

(Note the overly-optimistic comment after the orignal New() :-)

Dave M.

-- 
"You're so sadly neglected, and often ignored.
A poor second to Belgium, When going abroad."
Monty Python - "Finland"


--- pp_ctl.c-	Sat May 10 01:04:44 2003
+++ pp_ctl.c	Sat May 10 01:42:41 2003
@@ -3573,11 +3573,20 @@ S_doparseform(pTHX_ SV *sv)
     U16 *linepc = 0;
     register I32 arg;
     bool ischop;
+    int maxops = 2; /* FF_LINEMARK + FF_END) */
 
     if (len == 0)
 	Perl_croak(aTHX_ "Null picture in formline");
 
-    New(804, fops, (send - s)*3+10, U16);    /* Almost certainly too long... */
+    /* estimate the buffer size needed */
+    for (base = s; s <= send; s++) {
+	if (*s == '\n' || *s == '@' || *s == '^')
+	    maxops += 10;
+    }
+    s = base;
+    base = Nullch;
+
+    New(804, fops, maxops, U16);
     fpc = fops;
 
     if (s < send) {
@@ -3740,6 +3749,7 @@ S_doparseform(pTHX_ SV *sv)
     }
     *fpc++ = FF_END;
 
+    assert (fpc <= fops + maxops); /* ensure our buffer estimate was valid */
     arg = fpc - fops;
     { /* need to jump to the next word */
         int z;

• [PATCH] [perl #7391] Perl crashes with certain write() formats. by Dave Mitchell
• Re: [PATCH] [perl #7391] Perl crashes with certain write() formats. by Rafael Garcia-Suarez
• Re: [PATCH] [perl #7391] Perl crashes with certain write() formats. by H.Merijn Brand