regcomp_invlist.c -> S_invlist_trim -> SvPV_renew bug demo

Author: bulk88

regcomp_invlist.c

@@ -247,13 +247,13 @@ S_invlist_trim(SV* invlist)
 
     /* But don't free up the space needed for the 0 UV that is always at the
      * beginning of the list, nor the trailing NUL */
-    const UV min_size = TO_INTERNAL_SIZE(1) + 1;
+    const UV min_size = TO_INTERNAL_SIZE(1) + 1; /* XXX 64bit UVs malloc()s on 32b CPU ? */
 
     PERL_ARGS_ASSERT_INVLIST_TRIM;
 
     assert(is_invlist(invlist));
 
-    SvPV_renew(invlist, MAX(min_size, SvCUR(invlist) + 1));
+    SvPV_renew(invlist, MAX(min_size, SvCUR(invlist) + 1)); /* XXX bug ??? */
 }
 
 PERL_STATIC_INLINE void

sv.h

@@ -1570,8 +1570,9 @@ why not just use C<SvGROW> if you're not sure about the provenance?
 
 =cut
 */
-#define SvPV_renew(sv,n) \
-        STMT_START { SvLEN_set(sv, n); \
+#define SvPV_renew(sv,n) STMT_START { \
+                assert(SvLEN(sv) > n && n > 0);\
+                SvLEN_set(sv, n); \
                 SvPV_set((sv), (MEM_WRAP_CHECK_(n,char)			\
                                 (char*)saferealloc((Malloc_t)SvPVX(sv), \
                                                    (MEM_SIZE)((n)))));  \

toke.c

@@ -11873,7 +11873,7 @@ Perl_scan_str(pTHX_ char *start, int keep_bracketed_quoted, int keep_delims, int
 
     /* if we allocated too much space, give some back */
     if (SvCUR(sv) + 5 < SvLEN(sv)) {
-        SvLEN_set(sv, SvCUR(sv) + 1);
+        /* XXX SvLEN_set(sv, SvCUR(sv) + 1); */
         SvPV_shrink_to_cur(sv);
     }