This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
[RT #129069] Perl_yylex: Fix two use-after-free bugs
authorDan Collins <dcollinsn@gmail.com>
Wed, 24 Aug 2016 18:19:09 +0000 (14:19 -0400)
committerTony Cook <tony@develop-help.com>
Mon, 29 Aug 2016 06:04:29 +0000 (16:04 +1000)
commit3781748131a087d117c33ad25b5211eb3c33afff
treee96c62438b8af0569083213cd1a3a7c2eee407c4
parent2b6a5bfb1d5528005ca38fa7b8db46b49ae84e80
[RT #129069] Perl_yylex: Fix two use-after-free bugs

Perl_yylex maintains up to two pointers, `s` and `d`, into the parser
buffer at PL_bufptr. It can call skipspace(), which can potentially
grow (and realloc) its argument. This can leave the second pointer
pointing at the old buffer. Under most cases it isn't visible, because
the old buffer isn't reused or zeroed. However, under Valgrind or
libdislocator, this memory management error becomes visible.

This patch saves the location of the second pointer in two locations,
and restores it after the call to skipspace.
t/op/lex.t
toke.c