avoid reading out-of-bounds memory when matching against reference

p4raw-id: //depot/perl@5167

diff --git a/regexec.c b/regexec.c
index f9f2cc0..d2ebc44 100644 (file)
--- a/regexec.c
+++ b/regexec.c
@@ -688,7 +688,7 @@ Perl_re_intuit_start(pTHX_ regexp *prog, SV *sv, char *strpos,
                ? s + (prog->minlen? cl_l : 0)
                : (prog->float_substr ? check_at - start_shift + cl_l
                                      : strend) ;
-       char *startpos = sv ? strend - SvCUR(sv) : s;
+       char *startpos = sv && SvPOK(sv) ? strend - SvCUR(sv) : s;
 
        t = s;
        if (prog->reganch & ROPT_UTF8) {