From 5f41fa466a67b5535aa8bcf4b814f242545ac7bd Mon Sep 17 00:00:00 2001

From: Karl Williamson <khw@cpan.org>

Date: Sat, 27 Feb 2021 11:43:41 -0700

Subject: [PATCH] regcomp.c: Remove memory leak

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

This fixes GH #18604.  There was a path through the code where a

particular SV did not get its reference count decremented.

I did an audit of the function and came up with several other

possiblities that are included in this commit.

Further, there would be leaks for some instances of finding syntax

errors in the input pattern, or when warnings are fatalized.  Those

would require mortalizing some SVs, but that is beyond the scope of this

commit.

Signed-off-by: Petr Písař <ppisar@redhat.com>

---

 regcomp.c     | 7 +++++++

 t/op/svleak.t | 3 ++-

 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/regcomp.c b/regcomp.c

index e44c7a37e5..f5e5f581dc 100644

--- a/regcomp.c

+++ b/regcomp.c

@@ -18765,6 +18765,12 @@ S_regclass(pTHX_ RExC_state_t *pRExC_state, I32 *flagp, U32 depth,

 	RExC_end = save_end;

 	RExC_in_multi_char_class = 0;

         SvREFCNT_dec_NN(multi_char_matches);

+        SvREFCNT_dec(properties);

+        SvREFCNT_dec(cp_list);

+        SvREFCNT_dec(simple_posixes);

+        SvREFCNT_dec(posixes);

+        SvREFCNT_dec(nposixes);

+        SvREFCNT_dec(cp_foldable_list);

         return ret;

     }

@@ -20122,6 +20128,7 @@ S_regclass(pTHX_ RExC_state_t *pRExC_state, I32 *flagp, U32 depth,

                                            RExC_parse - orig_parse);;

     SvREFCNT_dec(cp_list);;

     SvREFCNT_dec(only_utf8_locale_list);

+    SvREFCNT_dec(upper_latin1_only_utf8_matches);

     return ret;

 }

diff --git a/t/op/svleak.t b/t/op/svleak.t

index 6acc298c3d..3df4838be8 100644

--- a/t/op/svleak.t

+++ b/t/op/svleak.t

@@ -15,7 +15,7 @@ BEGIN {

 use Config;

-plan tests => 150;

+plan tests => 151;

 # run some code N times. If the number of SVs at the end of loop N is

 # greater than (N-1)*delta at the end of loop 1, we've got a leak

@@ -278,6 +278,7 @@ eleak(2,0,'/[[:ascii:]]/');

 eleak(2,0,'/[[.zog.]]/');

 eleak(2,0,'/[.zog.]/');

 eleak(2,0,'/|\W/', '/|\W/ [perl #123198]');

+eleak(2,0,'/a\sb/', '/a\sb/ [GH #18604]');

 eleak(2,0,'no warnings; /(?[])/');

 eleak(2,0,'no warnings; /(?[[a]+[b]])/');

 eleak(2,0,'no warnings; /(?[[a]-[b]])/');

-- 

2.26.2