PATCH: [perl #126180] /(?[\ &!])/ segfaults

diff --git a/pod/perldelta.pod b/pod/perldelta.pod
index 12cf544..e0241a8 100644 (file)
--- a/pod/perldelta.pod
+++ b/pod/perldelta.pod
@@ -394,6 +394,13 @@ There were places in regular expression patterns where comments
 (C<(?#...)>) weren't allowed, but should have been.  This is now fixed.
 [perl #116639]
 
+=item *
+
+A regression from perl v5.20 has been fixed, in which some syntax errors
+in L<C<(?[...])>|perlrecharclass/Extended Bracketed Character Classes>
+constructs within regular expression patterns could cause a segfault
+instead of a proper error message.  [perl #126180]
+
 =back
 
 =head1 Known Problems

diff --git a/regcomp.c b/regcomp.c
index 0612352..e8e389a 100644 (file)
--- a/regcomp.c
+++ b/regcomp.c
@@ -13884,10 +13884,16 @@ redo_curchar:
                 /* Here, the new operator has equal or lower precedence than
                  * what's already there.  This means the operation already
                  * there should be performed now, before the new one. */
+
                 rhs = av_pop(stack);
-                lhs = av_pop(stack);
+                if (! IS_OPERAND(rhs)) {
 
-                assert(IS_OPERAND(rhs));
+                    /* This can happen when a ! is not followed by an operand,
+                     * like in /(?[\t &!])/ */
+                    goto bad_syntax;
+                }
+
+                lhs = av_pop(stack);
                 assert(IS_OPERAND(lhs));
 
                 switch (stacked_operator) {
@@ -14011,6 +14017,7 @@ redo_curchar:
         || SvTYPE(final) != SVt_INVLIST
         || av_tindex(stack) >= 0)  /* More left on stack */
     {
+      bad_syntax:
         SvREFCNT_dec(final);
         vFAIL("Incomplete expression within '(?[ ])'");
     }

diff --git a/t/re/reg_mesg.t b/t/re/reg_mesg.t
index 9a0424b..94a8903 100644 (file)
--- a/t/re/reg_mesg.t
+++ b/t/re/reg_mesg.t
@@ -258,6 +258,7 @@ my @death =
  'm/\cß/' => "Character following \"\\c\" must be printable ASCII",
  '/((?# This is a comment in the middle of a token)?:foo)/' => 'In \'(?...)\', the \'(\' and \'?\' must be adjacent {#} m/((?# This is a comment in the middle of a token)?{#}:foo)/',
  '/((?# This is a comment in the middle of a token)*FAIL)/' => 'In \'(*VERB...)\', the \'(\' and \'*\' must be adjacent {#} m/((?# This is a comment in the middle of a token)*{#}FAIL)/',
+ '/(?[\ &!])/' => 'Incomplete expression within \'(?[ ])\' {#} m/(?[\ &!{#}])/',    # [perl #126180]
 );
 
 # These are messages that are warnings when not strict; death under 'use re