From: Dave Mitchell <davem@fdisolutions.com>
Date: Tue, 27 May 2008 00:12:52 +0000 (+0000)
Subject: [perl #54758] Perl 5.10 memory corruption
X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=commitdiff_plain;h=62b40d2474e7487e6909e1872b6bccdf812c6818;p=p5sagit%2Fp5-mst-13.2.git

[perl #54758] Perl 5.10 memory corruption
When @a = sort @a is pessimised if @a has magic,
growing the stack requires various pointers to be reset in case
the stack gets reallocated.

p4raw-id: //depot/perl@33937
---

diff --git a/pp_sort.c b/pp_sort.c
index 9fe0dad..edfdadf 100644
--- a/pp_sort.c
+++ b/pp_sort.c
@@ -1557,11 +1557,12 @@ PP(pp_sort)
 	max = AvFILL(av) + 1;
 	if (SvMAGICAL(av)) {
 	    MEXTEND(SP, max);
-	    p2 = SP;
 	    for (i=0; i < max; i++) {
 		SV **svp = av_fetch(av, i, FALSE);
 		*SP++ = (svp) ? *svp : NULL;
 	    }
+	    SP--;
+	    p1 = p2 = SP - (max-1);
 	}
 	else {
 	    if (SvREADONLY(av))
@@ -1717,7 +1718,7 @@ PP(pp_sort)
 	SvREADONLY_off(av);
     else if (av && !sorting_av) {
 	/* simulate pp_aassign of tied AV */
-	SV** const base = ORIGMARK+1;
+	SV** const base = MARK+1;
 	for (i=0; i < max; i++) {
 	    base[i] = newSVsv(base[i]);
 	}