In Perl_lex_start(), don't read the byte before SvPVX().

If len is 0, we shouldn't be reading from len - 1, as it's one before the
start of the buffer, and hence an out of bounds read.

Fixes a bug inadvertently added by commit 0abcdfa4c5da571f, restoring the
previous behaviour for the len == 0 case.

diff --git a/toke.c b/toke.c
index aec7101..33d7b86 100644 (file)
--- a/toke.c
+++ b/toke.c
@@ -728,7 +728,7 @@ Perl_lex_start(pTHX_ SV *line, PerlIO *rsfp, U32 flags)
        parser->linestr = flags & LEX_START_COPIED
                            ? SvREFCNT_inc_simple_NN(line)
                            : newSVpvn_flags(s, len, SvUTF8(line));
-       if (s[len-1] != ';')
+       if (!len || s[len-1] != ';')
            sv_catpvs(parser->linestr, "\n;");
     } else {
        parser->linestr = newSVpvs("\n;");