zsh crash, unable to log in

zsh crash, unable to log in

[Dominik Vogt]

Yesterday, I encountered a pretty severe problem with the history
file that prevented me from logging in (I have zsh as my login
shell).  I used the zsh version shipping with SuSE 7.2:

   $ zsh --version
   zsh 4.0.1pre3 (i386-suse-linux)

What happened is this:  After a hard reboot, i.e. switching off
the machine, my ~/.zsh_history file was corrupt.  It only
contained 38k of binary trash.  Now, every time when I tried to
log in I just got the message

  $ zsh
  zsh: fatal error: out of memory

If this happens for the root user, the system is out of business.
I can reproduce the problem at will by copying a random executable
file over my .zsh_history:

  $ cp /bin/ls ~/.zsh_history
  $ zsh
  zsh: fatal error: out of memory

  $ rm ~/.zsh_history
  $ zsh
  (works fine)

Bye

Dominik ^_^  ^_^

P.S.: Please CC me, I'm not on the list.

-- 
Dominik Vogt, email: d.vogt@lifebits.de
LifeBits Aktiengesellschaft, Albrechtstr. 9, D-72072 Tuebingen
fon: ++49 (0) 7071/7965-0, fax: ++49 (0) 7071/7965-20

RE: zsh crash, unable to log in

[Borsenkow Andrej]

>    $ zsh --version
>    zsh 4.0.1pre3 (i386-suse-linux)
> 
> What happened is this:  After a hard reboot, i.e. switching off
> the machine, my ~/.zsh_history file was corrupt.  It only
> contained 38k of binary trash.  Now, every time when I tried to
> log in I just got the message
> 
>   $ zsh
>   zsh: fatal error: out of memory
> 

this is a bug (BTW I missed if there was any patch for it?) but ...

> If this happens for the root user, the system is out of business.

... root user should use the simplest shell possible. Besides, zsh
relies to some extent on /usr being mounted (at least in default
installation).


-andrej

PATCH: Re: zsh crash, unable to log in

[Bart Schaefer]

Dominik Vogt wrote:
} After a hard reboot, i.e. switching off
} the machine, my ~/.zsh_history file was corrupt.  It only
} contained 38k of binary trash.

Monty Scroggins wrote:
} each line starts with one or more <nul> characters followed
} by the command strings.

The problem is readhistfile() uses a nested loop on fgets()/strlen()
to read full lines from the file.  After any '\0' byte is encountered,
the result of strlen() becomes wrong, and the inner loop soon begins
reading the file only one byte at a time, but doubling the size of the
buffer after each read.  So even a relatively small file with a nul
byte anywhere other than the first character can cause zsh to consume
all available memory.

Here's a patch that replaces the loops with a recursive descent.  It
reports an error if a nul byte is encountered; otherwise it should
behave just like the old code; possible discrepancies are on files
that don't have a trailing newline or that end in backslash-newline.

Index: Src/hist.c
===================================================================
RCS file: /extra/cvsroot/zsh/zsh-4.0/Src/hist.c,v
retrieving revision 1.9
diff -c -r1.9 hist.c
--- Src/hist.c	2001/09/15 19:16:26	1.9
+++ Src/hist.c	2001/09/20 16:26:23
@@ -1766,6 +1766,33 @@
 
 static int histfile_linect;
 
+static int readhistline(int start, char **bufp, int *bufsiz, FILE *in)
+{
+    char *buf = *bufp;
+    if (fgets(buf + start, *bufsiz - start, in)) {
+	int l = strlen(buf);
+
+	if (start >= l)
+	    return -1;
+
+	if (l) {
+	    if (buf[l - 1] != '\n' && !feof(in)) {
+		*bufp = zrealloc(buf, 2 * (*bufsiz));
+		*bufsiz = 2 * (*bufsiz);
+		return readhistline(l, bufp, bufsiz, in);
+	    }
+	    buf[l - 1] = '\0';
+	    if (l > 1 && buf[l - 2] == '\\') {
+		buf[--l - 1] = '\n';
+		if (!feof(in))
+		    return readhistline(l, bufp, bufsiz, in);
+	    }
+	}
+	return l;
+    } else
+	return 0;
+}
+
 /**/
 void
 readhistfile(char *fn, int err, int readflags)
@@ -1778,7 +1805,7 @@
     short *wordlist;
     struct stat sb;
     int nwordpos, nwordlist, bufsiz;
-    int searching, newflags;
+    int searching, newflags, l;
 
     if (!fn && !(fn = getsparam("HISTFILE")))
 	return;
@@ -1816,30 +1843,13 @@
 	if (readflags & HFILE_SKIPOLD
 	 || (hist_ignore_all_dups && newflags & hist_skip_flags))
 	    newflags |= HIST_MAKEUNIQUE;
-	while (fpos = ftell(in), fgets(buf, bufsiz, in)) {
-	    int l = strlen(buf);
-	    char *pt;
-
-	    while (l) {
-		while (buf[l - 1] != '\n') {
-		    buf = zrealloc(buf, 2 * bufsiz);
-		    bufsiz = 2 * bufsiz;
-		    if (!fgets(buf + l, bufsiz - l, in)) {
-			l++;
-			break;
-		    }
-		    l += strlen(buf+l);
-		}
-		buf[l - 1] = '\0';
-		if (l > 1 && buf[l - 2] == '\\') {
-		    buf[--l - 1] = '\n';
-		    fgets(buf + l, bufsiz - l, in);
-		    l += strlen(buf+l);
-		} else
-		    break;
-	    }
+	while (fpos = ftell(in), (l = readhistline(0, &buf, &bufsiz, in))) {
+	    char *pt = buf;
 
-	    pt = buf;
+	    if (l < 0) {
+		zerr("corrupt history file %s", fn, 0);
+		break;
+	    }
 	    if (*pt == ':') {
 		pt++;
 		stim = zstrtol(pt, NULL, 0);
@@ -1933,7 +1943,7 @@
 
 	fclose(in);
     } else if (err)
-	zerr("can't read history file", fn, 0);
+	zerr("can't read history file %s", fn, 0);
 
     unlockhistfile(fn);
 }


-- 
Bart Schaefer                                 Brass Lantern Enterprises
http://www.well.com/user/barts              http://www.brasslantern.com

Zsh: http://www.zsh.org | PHPerl Project: http://phperl.sourceforge.net