[perl #113060] Save cop_stashlen threaded even with shared cop pv

Perl_sv_compile_2op_is_broken() does at line 3354 a LEAVE_with_name("eval"),
a SSPOPSTR via SAVEt_SHARED_PVREF for the localized cop_stashpv, but
not for the cop_stashlen.
The cop in question is PL_compiling, which was "AutoSplit" before with
len=9 and restores it back to "main" but keeps len 9. Thus leading to a
heap-overflow in gv_stashpvn.

diff --git a/scope.h b/scope.h
index aa04a79..38da244 100644 (file)
--- a/scope.h
+++ b/scope.h
@@ -237,7 +237,8 @@ scope has the given name. Name must be a literal string.
 #ifdef USE_ITHREADS
 #  define SAVECOPSTASH(c)      (SAVEPPTR(CopSTASHPV(c)), \
                                 SAVEI32(CopSTASH_len(c)))
 #ifdef USE_ITHREADS
 #  define SAVECOPSTASH(c)      (SAVEPPTR(CopSTASHPV(c)), \
                                 SAVEI32(CopSTASH_len(c)))

-#  define SAVECOPSTASH_FREE(c) SAVESHAREDPV(CopSTASHPV(c))
+#  define SAVECOPSTASH_FREE(c) (SAVESHAREDPV(CopSTASHPV(c)), \
+                                SAVEI32(CopSTASH_len(c)))

 #  define SAVECOPFILE(c)       SAVEPPTR(CopFILE(c))
 #  define SAVECOPFILE_FREE(c)  SAVESHAREDPV(CopFILE(c))
 #else
 #  define SAVECOPFILE(c)       SAVEPPTR(CopFILE(c))
 #  define SAVECOPFILE_FREE(c)  SAVESHAREDPV(CopFILE(c))
 #else