Skip to content

Commit b7b77ff

Browse files
committed
CLEAR_ERRSV: create a new SV if the existing one isGV_with_GP
GH #16885 is a fuzzer-identified assert in Perl_sv_grow. Besides the question of how the program should behave, the actual assertion comes via the `SvPVCLEAR()` statement in `CLEAR_ERRSV`, where `svp` is unexpectedly a PVGV with GV. This commit treats this the same as if `svp` was READONLY - the refcount is decremented and `svp` assigned a brand new SVt_PV.
1 parent e9d9a70 commit b7b77ff

File tree

2 files changed

+4
-2
lines changed

2 files changed

+4
-2
lines changed

perl.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1947,7 +1947,7 @@ any magic.
19471947
SV ** const svp = &GvSV(PL_errgv); \
19481948
if (!*svp) { \
19491949
*svp = newSVpvs(""); \
1950-
} else if (SvREADONLY(*svp)) { \
1950+
} else if (SvREADONLY(*svp) || isGV_with_GP(*svp)) { \
19511951
SvREFCNT_dec_NN(*svp); \
19521952
*svp = newSVpvs(""); \
19531953
} else { \

t/op/eval.t

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ BEGIN {
66
set_up_inc('../lib');
77
}
88

9-
plan(tests => 172);
9+
plan(tests => 173);
1010

1111
eval 'pass();';
1212

@@ -837,3 +837,5 @@ pass("eval in freed package does not crash");
837837
}->();
838838
is($w, 0, "nested eval and closure");
839839
}
840+
841+
fresh_perl_is('for$@(*0){eval}', '', undef, 'GH #16885 - isGV_with_GP(PL_errgv)');

0 commit comments

Comments
 (0)