From daoswald@adelphia.net

The following code will result in @​- becoming an arbitrarily large
array, each element being undef.

use strict;
use warnings;

my $string = "abc";

while( $string =~ /b/g ) {
  print $#-, "\n";
}

And the output...

22350300

This is under ActivePerl 5.8.6 on Win32. The problem has been
replicated on other builds as well, and on other operating systems too.
  For a brief history of the bug's discovery please visit​:

http​://www.perlmonks.org/?node_id=461653

As others in that thread have pointed out, the number "22350300" is
actually rather arbitrary.

If this bug turns up in the context of​:

print "@​-\n";

instead of

print "$#-\n";

...the result will lead to a script grinding to a halt, or worse,
consuming available memory trying to interpolate a multi-million-element
array into a double-quoted string.

Dave

daoswald@adelphia.net - Status changed from 'new' to 'open'

daoswald@adelphia.net - Status changed from 'open' to 'new'

From daoswald@adelphia.net

Update​: Perl 5.8.7 exhibits the same errant behavior.

@demerphq - Status changed from 'new' to 'open'

From @demerphq

I believe this bug is fixed in the development version of perl, however
I couldn't see a test for the behaviour.

Attached is a test patch, and on the assumption it will be applied, I
have closed this ticket.

Thanks for the report.
Yves

From @demerphq

---------[STARTPATCH]---------

 
d:\dev\util\diffnew.pl -u -W 29177/t/op/pat.t 29177_/t/op/pat.t 
 
--- 29177/t/op/pat.t	Mon Oct 16 13:57:08 2006
+++ 29177_/t/op/pat.t	Wed Nov  1 11:22:38 2006
@@ -3839,6 +3839,17 @@
     ok(eval("qq/$targ/ =~ /$reg/"), "\\c\\ in pattern");
 }
 
+{
+    my $str='abc'; 
+    my $count=0;
+    my $mval=0;
+    my $pval=0;
+    while ($str=~/b/g) { $mval=$#-; $pval=$#+; $count++ }
+    iseq($mval,0,"\@- should be empty [RT#36046]");
+    iseq($pval,0,"\@+ should be empty [RT#36046]");
+    iseq($count,1,"should have matched once only [RT#36046]");
+}
+
 # Keep the following tests last -- they may crash perl
 
 ok(("a" x (2**15 - 10)) =~ /^()(a|bb)*$/, "Recursive stack cracker: #24274")
@@ -3849,5 +3860,5 @@
     or print "# Unexpected outcome: should pass or crash perl\n";
 
 # Don't forget to update this!
-BEGIN{print "1..1284\n"};
+BEGIN{print "1..1287\n"};
 
 
d:\dev\util\diffnew.pl -u -W 29177/win32/Makefile 29177_/win32/Makefile 
 


---------[ENDPATCH]---------

@demerphq - Status changed from 'open' to 'resolved'

From @rgarcia

On 01/11/06, yves orton via RT <perlbug-followup@​perl.org> wrote​:

I believe this bug is fixed in the development version of perl, however
I couldn't see a test for the behaviour.

Attached is a test patch, and on the assumption it will be applied, I
have closed this ticket.

Thanks, applied.