This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
don't segfault given string repeat count larger than 2^31
authorJim Meyering <jim@meyering.net>
Sun, 23 Oct 2011 23:04:11 +0000 (16:04 -0700)
committerFather Chrysostomos <sprout@cpan.org>
Sun, 23 Oct 2011 23:47:53 +0000 (16:47 -0700)
commit26e1303d691c34af15e9332d5ba72c53be9a4263
treef9b7b6f5126aafffea8ce96c17cf5f7ac3938d6b
parentdd8fc02804485f0ffdfd876c119b4f9500c7be86
don't segfault given string repeat count larger than 2^31

E.g., this overflows INT_MAX and overruns heap memory:

    $ perl -le 'print "v"x(2**31+1)'
    [Exit 139 (SEGV)]

(Perl_repeatcpy): Use the same type for "count" as our sole
callers in pp.c: IV (long), not I32 (int).  Otherwise, passing
the wider value to a narrower "I32 count"
embed.fnc
proto.h
util.c