[perl #54758] Perl 5.10 memory corruption

When @a = sort @a is pessimised if @a has magic,
growing the stack requires various pointers to be reset in case
the stack gets reallocated.

p4raw-id: //depot/perl@33937

diff --git a/pp_sort.c b/pp_sort.c
index 9fe0dad..edfdadf 100644 (file)
--- a/pp_sort.c
+++ b/pp_sort.c
@@ -1557,11 +1557,12 @@ PP(pp_sort)
        max = AvFILL(av) + 1;
        if (SvMAGICAL(av)) {
            MEXTEND(SP, max);
-           p2 = SP;
            for (i=0; i < max; i++) {
                SV **svp = av_fetch(av, i, FALSE);
                *SP++ = (svp) ? *svp : NULL;
            }
+           SP--;
+           p1 = p2 = SP - (max-1);
        }
        else {
            if (SvREADONLY(av))
@@ -1717,7 +1718,7 @@ PP(pp_sort)
        SvREADONLY_off(av);
     else if (av && !sorting_av) {
        /* simulate pp_aassign of tied AV */
-       SV** const base = ORIGMARK+1;
+       SV** const base = MARK+1;
        for (i=0; i < max; i++) {
            base[i] = newSVsv(base[i]);
        }