From: Dave Mitchell <davem@fdisolutions.com>
Date: Sat, 10 May 2003 01:45:23 +0000 (+0100)
Subject: [perl #7391] Perl crashes with certain write() formats.
X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=commitdiff_plain;h=815f25c6e302f84ecce02c74fa717a19d787f662;p=p5sagit%2Fp5-mst-13.2.git

[perl #7391] Perl crashes with certain write() formats.
Message-ID: <20030510004523.GC20871@fdgroup.com>

p4raw-id: //depot/perl@19496
---

diff --git a/pp_ctl.c b/pp_ctl.c
index 91fc2ca..8665678 100644
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -3573,11 +3573,20 @@ S_doparseform(pTHX_ SV *sv)
     U16 *linepc = 0;
     register I32 arg;
     bool ischop;
+    int maxops = 2; /* FF_LINEMARK + FF_END) */
 
     if (len == 0)
 	Perl_croak(aTHX_ "Null picture in formline");
 
-    New(804, fops, (send - s)*3+10, U16);    /* Almost certainly too long... */
+    /* estimate the buffer size needed */
+    for (base = s; s <= send; s++) {
+	if (*s == '\n' || *s == '@' || *s == '^')
+	    maxops += 10;
+    }
+    s = base;
+    base = Nullch;
+
+    New(804, fops, maxops, U16);
     fpc = fops;
 
     if (s < send) {
@@ -3740,6 +3749,7 @@ S_doparseform(pTHX_ SV *sv)
     }
     *fpc++ = FF_END;
 
+    assert (fpc <= fops + maxops); /* ensure our buffer estimate was valid */
     arg = fpc - fops;
     { /* need to jump to the next word */
         int z;