Fix memory miswrite when passing data arguments to cast()

[perl/modules/Variable-Magic.git] / Magic.xs

diff --git a/Magic.xs b/Magic.xs
index 35bc61c67b0df670439e2ee4bd4950624715c6b4..537f1e2e24dd19cc5731f4301bff1e9a76c12cd2 100644 (file)
--- a/Magic.xs
+++ b/Magic.xs
@@ -536,6 +536,8 @@ STATIC const SV *vmg_wizard_validate(pTHX_ const SV *wiz) {
  }
 
  croak(vmg_invalid_wiz);
+ /* Not reached */
+ return NULL;
 }
 
 #define vmg_wizard_id(W)         SvIVX((const SV *) (W))
@@ -609,10 +611,10 @@ STATIC const MAGIC *vmg_find(const SV *sv, const SV *wiz) {
 
 /* ... Construct private data .............................................. */
 
-STATIC SV *vmg_data_new(pTHX_ SV *ctor, SV *sv, AV *args) {
-#define vmg_data_new(C, S, A) vmg_data_new(aTHX_ (C), (S), (A))
+STATIC SV *vmg_data_new(pTHX_ SV *ctor, SV *sv, SV **args, I32 items) {
+#define vmg_data_new(C, S, A, I) vmg_data_new(aTHX_ (C), (S), (A), (I))
+ I32 i;
  SV *nsv;
- I32 i, alen = (args == NULL) ? 0 : av_len(args);
 
  dSP;
 
@@ -620,10 +622,10 @@ STATIC SV *vmg_data_new(pTHX_ SV *ctor, SV *sv, AV *args) {
  SAVETMPS;
 
  PUSHMARK(SP);
- EXTEND(SP, alen + 1);
+ EXTEND(SP, items + 1);
  PUSHs(sv_2mortal(newRV_inc(sv)));
- for (i = 0; i < alen; ++i)
-  PUSHs(*av_fetch(args, i, 0));
+ for (i = 0; i < items; ++i)
+  PUSHs(args[i]);
  PUTBACK;
 
  call_sv(ctor, G_SCALAR);
@@ -666,8 +668,8 @@ STATIC void vmg_uvar_del(SV *sv, MAGIC *prevmagic, MAGIC *mg, MAGIC *moremagic)
 }
 #endif /* VMG_UVAR */
 
-STATIC UV vmg_cast(pTHX_ SV *sv, const SV *wiz, AV *args) {
-#define vmg_cast(S, W, A) vmg_cast(aTHX_ (S), (W), (A))
+STATIC UV vmg_cast(pTHX_ SV *sv, const SV *wiz, SV **args, I32 items) {
+#define vmg_cast(S, W, A, I) vmg_cast(aTHX_ (S), (W), (A), (I))
  MAGIC       *mg, *moremagic = NULL;
  SV          *data;
  const MGWIZ *w;
@@ -679,8 +681,9 @@ STATIC UV vmg_cast(pTHX_ SV *sv, const SV *wiz, AV *args) {
  w = vmg_wizard_mgwiz(wiz);
  oldgmg = SvGMAGICAL(sv);
 
- data = (w->cb_data) ? vmg_data_new(w->cb_data, sv, args) : NULL;
+ data = (w->cb_data) ? vmg_data_new(w->cb_data, sv, args, items) : NULL;
  mg = sv_magicext(sv, data, PERL_MAGIC_ext, w->vtbl, (const char *) wiz, HEf_SVKEY);
+ SvREFCNT_dec(data);
  mg->mg_private = SIG_WIZ;
 #if MGf_COPY
  if (w->cb_copy)
@@ -870,7 +873,7 @@ STATIC void vmg_op_info_init(pTHX_ unsigned int opinfo) {
    if (!MY_CXT.b__op_stashes[0]) {
     opclass c;
     require_pv("B.pm");
-    for (c = 0; c < OPc_MAX; ++c)
+    for (c = OPc_NULL; c < OPc_MAX; ++c)
      MY_CXT.b__op_stashes[c] = gv_stashpv(vmg_opclassnames[c], 1);
    }
    break;
@@ -1315,7 +1318,7 @@ PPCODE:
   ud.owner   = MY_CXT.owner;
   ptable_walk(MY_CXT.wizards, vmg_ptable_clone, &ud);
 
-  for (c = 0; c < OPc_MAX; ++c) {
+  for (c = OPc_NULL; c < OPc_MAX; ++c) {
    if (MY_CXT.b__op_stashes[c])
     had_b__op_stash |= (((U32) 1) << c);
   }
@@ -1324,7 +1327,7 @@ PPCODE:
   MY_CXT_CLONE;
   MY_CXT.wizards = t;
   MY_CXT.owner   = aTHX;
-  for (c = 0; c < OPc_MAX; ++c) {
+  for (c = OPc_NULL; c < OPc_MAX; ++c) {
    MY_CXT.b__op_stashes[c] = (had_b__op_stash & (((U32) 1) << c))
                               ? gv_stashpv(vmg_opclassnames[c], 1) : NULL;
   }
@@ -1409,22 +1412,14 @@ OUTPUT:
 SV *cast(SV *sv, SV *wiz, ...)
 PROTOTYPE: \[$@%&*]$@
 PREINIT:
- AV *args = NULL;
- SV *ret;
+ SV **args = NULL;
+ I32 i = 0;
 CODE:
  if (items > 2) {
-  I32 i;
-  args = newAV();
-  av_fill(args, items - 2);
-  for (i = 2; i < items; ++i) {
-   SV *arg = ST(i);
-   SvREFCNT_inc(arg);
-   if (av_store(args, i - 2, arg) == NULL) croak(vmg_argstorefailed);
-  }
+  i = items - 2;
+  args = &ST(2);
  }
- ret = newSVuv(vmg_cast(SvRV(sv), vmg_wizard_validate(wiz), args));
- SvREFCNT_dec(args);
- RETVAL = ret;
+ RETVAL = newSVuv(vmg_cast(SvRV(sv), vmg_wizard_validate(wiz), args, i));
 OUTPUT:
  RETVAL