develooper Front page | perl.perl5.porters | Postings from September 2012

[perl #92264] Freeing $a or $b during sort causes a double free

Thread Previous
Father Chrysostomos via RT
September 24, 2012 12:39
[perl #92264] Freeing $a or $b during sort causes a double free
Message ID:
On Sat Jan 14 22:53:05 2012, sprout wrote:
> On Sun Jun 05 15:51:34 2011, sprout wrote:
> > $ perl5.14.0 -e '@_ = sort { *a = \1 } 1, 2'
> > Attempt to free unreferenced scalar: SV 0x826480, Perl interpreter:
> > 0x800000.
> > 
> > I think pp_sort is misusing SAVESPTR.
> Attached is a test case.  I don’t know how to fix this efficiently. 
> Currently GvSV(*a) and GvSV(*b) are not reference-counted during sort. 
> But no other code knows about that.
> Making them reference-counted is the obvious fix, but I presume it was
> not done originally for efficency’s sake.

But incrementing and decrementing a reference count should not be too
slow, and correctness is definitely a good thing.  The attached patch is
the obvious fix, but it changes an existing TODO test into an assertion

So, this being rare enough, it should probably wait until the stack is


Father Chrysostomos

Thread Previous Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at | Group listing | About