From 63aab7ecaa6e826f845c405894bd8c4b6f601b39 Mon Sep 17 00:00:00 2001

From: Father Chrysostomos <sprout@cpan.org>

Date: Sun, 3 Jul 2016 22:23:34 -0700

Subject: [PATCH] [perl #128532] Crash vivifying stub in deleted pkg

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

v5.17.0-515-g186a5ba, which added newSTUB, did not take into account

that a GV may have a null GvSTASH pointer, if its stash has been

freed, so this crashes:

delete $My::{"Foo::"}; \&My::Foo::foo

Signed-off-by: Petr Písař <ppisar@redhat.com>

---

 op.c       | 2 +-

 t/op/ref.t | 6 +++++-

 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/op.c b/op.c

index 46e76ac..4735d1b 100644

--- a/op.c

+++ b/op.c

@@ -9081,7 +9081,7 @@ Perl_newSTUB(pTHX_ GV *gv, bool fake)

     assert(!GvCVu(gv));

     GvCV_set(gv, cv);

     GvCVGEN(gv) = 0;

-    if (!fake && HvENAME_HEK(GvSTASH(gv)))

+    if (!fake && GvSTASH(gv) && HvENAME_HEK(GvSTASH(gv)))

 	gv_method_changed(gv);

     if (SvFAKE(gv)) {

 	cvgv = gv_fetchsv((SV *)gv, GV_ADDMULTI, SVt_PVCV);

diff --git a/t/op/ref.t b/t/op/ref.t

index 19a44bb..84d9217 100644

--- a/t/op/ref.t

+++ b/t/op/ref.t

@@ -8,7 +8,7 @@ BEGIN {

 use strict qw(refs subs);

-plan(235);

+plan(236);

 # Test this first before we extend the stack with other operations.

 # This caused an asan failure due to a bad write past the end of the stack.

@@ -124,6 +124,10 @@ is (join(':',@{$spring2{"foo"}}), "1:2:3:4");

     is ($called, 1);

 }

 is ref eval {\&{""}}, "CODE", 'reference to &{""} [perl #94476]';

+delete $My::{"Foo::"}; 

+is ref \&My::Foo::foo, "CODE",

+  'creating stub with \&deleted_stash::foo [perl #128532]';

+

 # Test references to return values of operators (TARGs/PADTMPs)

 {

-- 

2.5.5