This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
[perl #76540] "print CONSTANT," gives double-free
authorDavid Mitchell <davem@iabyn.com>
Sat, 24 Jul 2010 14:41:19 +0000 (15:41 +0100)
committerDavid Mitchell <davem@iabyn.com>
Sat, 24 Jul 2010 14:47:57 +0000 (15:47 +0100)
commite5c69c9b913b1a7f8a83beabb60e96958df29689
tree4c740a408c1a98fefc38dbea873052d12258deea
parent87f4ab41b64991a57643a80d84f9ca824fbdb9a4
[perl #76540] "print CONSTANT," gives double-free

gv_init() has name and len args, but newCONSTSUB() (which it calls)
doesn't have a len arg, so any trailing garbage in name gets used by
newCONSTSUB.

In the test case, this means that we end up attaching the const CV
to both the "FOO" and qq{FOO, "\\n";\n} GVs. So it gets freed twice.
dist/constant/t/constant.t
gv.c