This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
misaligned buffer with heredoc and /(?{...})/
RT #129199
When an re_eval like /(?{...})/ is tokenised, as well as tokenising the
individual elements of the code, the whole src string is returned as a
constant too, to enable the stringification of the regex to be calculated.
For example,
/abc(?{$x})def/
is tokenised like
MATCH '('
CONST('abc')
DO '{' '$' CONST('x') '}'
','
CONST('(?{$x})')
','
CONST('def'),
')'
If the code within the (?{...}) contains a heredoc (<<) and the PL_linestr
buffer happens to get reallocated, the pointer which points to the start
of the code string will get adjusted using the wrong buffer pointer.
Later when the end of the code is reached and the whole code string '(?{$x})'
is copied to a new SV, garbage may get copied (or it may panic with -ve
length, out of memory etc). Note that this garbage will only used for the
string representation of the regex, e.g.
my $r = qr/abc(?{$x})def/;
print "$r"; # garbage used here
/xyz$r/; # garbage not used here