[perl #32033] Using foreach on threads::shared array crashes perl

The FETCH code for shared aggregate elements could leak a shared RV
address into a private SV. RVs are now handled specially, in the
same way that they already were for scalar shared magic.

p4raw-id: //depot/perl@23438

diff --git a/ext/threads/shared/shared.xs b/ext/threads/shared/shared.xs
index 72b7285..2d61d24 100644 (file)
--- a/ext/threads/shared/shared.xs
+++ b/ext/threads/shared/shared.xs
@@ -639,8 +639,18 @@ sharedsv_elem_mg_FETCH(pTHX_ SV *sv, MAGIC *mg)
     CALLER_CONTEXT;
     if (svp) {
        /* Exists in the array */
-       target = Perl_sharedsv_associate(aTHX_ &sv, *svp, target);
-       sv_setsv(sv, *svp);
+       if (SvROK(*svp)) {
+           SV *obj = Nullsv;
+           Perl_sharedsv_associate(aTHX_ &obj, SvRV(*svp), NULL);
+           sv_setsv_nomg(sv, &PL_sv_undef);
+           SvRV(sv) = obj;
+           SvROK_on(sv);
+           SvSETMAGIC(sv);
+       }
+       else {
+           target = Perl_sharedsv_associate(aTHX_ &sv, *svp, target);
+           sv_setsv(sv, *svp);
+       }
     }
     else {
        /* Not in the array */