From: Dave Mitchell <davem@fdisolutions.com>
Date: Mon, 19 Jan 2004 23:41:37 +0000 (+0000)
Subject: change #22071 (taint bug in $^0) introduced a potential double
X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=commitdiff_plain;h=1bf2966364b6356e9050b17d8920dd4a8ce27d97;p=p5sagit%2Fp5-mst-13.2.git

change #22071 (taint bug in $^0) introduced a potential double
free(), because PL_osname may get freed but not nulled if a taint
test fails in between. Mea cupla and all that...
p4raw-link: @22071 on //depot/perl: 3511154c18a0900e8873e8e72a4b74931525e718

p4raw-id: //depot/perl@22181
---

diff --git a/mg.c b/mg.c
index f79210e..9f3075d 100644
--- a/mg.c
+++ b/mg.c
@@ -2091,14 +2091,14 @@ Perl_magic_set(pTHX_ SV *sv, MAGIC *mg)
 	break;
     case '\017':	/* ^O */
 	if (*(mg->mg_ptr+1) == '\0') {
-	    if (PL_osname)
+	    if (PL_osname) {
 		Safefree(PL_osname);
+		PL_osname = Nullch;
+	    }
 	    if (SvOK(sv)) {
 		TAINT_PROPER("assigning to $^O");
 		PL_osname = savepv(SvPV(sv,len));
 	    }
-	    else
-		PL_osname = Nullch;
 	}
 	else if (strEQ(mg->mg_ptr, "\017PEN")) {
 	    if (!PL_compiling.cop_io)