change #22071 (taint bug in $^0) introduced a potential double

free(), because PL_osname may get freed but not nulled if a taint
test fails in between. Mea cupla and all that...
p4raw-link: @22071 on //depot/perl: 3511154c18a0900e8873e8e72a4b74931525e718

p4raw-id: //depot/perl@22181

diff --git a/mg.c b/mg.c
index f79210e..9f3075d 100644 (file)
--- a/mg.c
+++ b/mg.c
@@ -2091,14 +2091,14 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
        break;
     case '\017':       /* ^O */
        if (*(mg->mg_ptr+1) == '\0') {
-           if (PL_osname)
+           if (PL_osname) {
                Safefree(PL_osname);
+               PL_osname = Nullch;
+           }
            if (SvOK(sv)) {
                TAINT_PROPER("assigning to $^O");
                PL_osname = savepv(SvPV(sv,len));
            }
-           else
-               PL_osname = Nullch;
        }
        else if (strEQ(mg->mg_ptr, "\017PEN")) {
            if (!PL_compiling.cop_io)