From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-users-return-6421-mason-zsh=primenet.com.au@sunsite.dk>
Received: (qmail 26156 invoked from network); 29 Jul 2003 09:51:27 -0000
Received: from sunsite.dk (130.225.247.90)
  by ns1.primenet.com.au with SMTP; 29 Jul 2003 09:51:27 -0000
Received: (qmail 26212 invoked by alias); 29 Jul 2003 09:51:13 -0000
Mailing-List: contact zsh-users-help@sunsite.dk; run by ezmlm
Precedence: bulk
X-No-Archive: yes
X-Seq: 6421
Received: (qmail 26202 invoked from network); 29 Jul 2003 09:51:13 -0000
Received: from localhost (HELO sunsite.dk) (127.0.0.1)
  by localhost with SMTP; 29 Jul 2003 09:51:13 -0000
X-MessageWall-Score: 0 (sunsite.dk)
Received: from [192.54.253.222] by sunsite.dk (MessageWall 1.0.8) with SMTP; 29 Jul 2003 9:51:13 -0000
Received: by binome.blorf.net (Postfix, from userid 1000)
	id 11ABB3113; Tue, 29 Jul 2003 02:51:11 -0700 (PDT)
Date: Tue, 29 Jul 2003 02:51:11 -0700
From: Wayne Davison <wayned@users.sourceforge.net>
To: GoTaR <gotar@poczta.onet.pl>
Cc: zsh-users@sunsite.dk
Subject: Re: 4.1.1: three bugs?
Message-ID: <20030729095111.GB12603@binome.blorf.net>
References: <20030729074554.GA1327@os>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20030729074554.GA1327@os>
User-Agent: Mutt/1.5.4i

On Tue, Jul 29, 2003 at 09:45:54AM +0200, GoTaR wrote:
> ~: zsh
> ~: slfj zxc ewtg lkjlk
>             ^move cursor here and press alt-d

A second (separate) word-delete is needed to get the code to fail, so
I typed ctrl-y, alt-b, alt-d after this.

> ~: slfj zxc  lkjlk
>                   ^move cursor here and press twice alt-y
> ~: slfj zxc  lkjlkzsh: segmentation fault  zsh

Cause: the first alt-y is considered a yank command, even though it
fails.  Thus, the second alt-y can slip by the sanity check at the start
of the yankpop() function, and if "kctbuf" is NULL (as it is if there
was no ctrl-y ever performed), zsh crashes.

The following patch fixes this:

--- Src/Zle/zle_misc.c	27 Feb 2003 11:32:53 -0000	1.8
+++ Src/Zle/zle_misc.c	29 Jul 2003 09:36:12 -0000
@@ -372,8 +372,10 @@
     int cc, kctstart = kct;
     Cutbuffer buf;
 
-    if (!(lastcmd & ZLE_YANK) || !kring)
+    if (!(lastcmd & ZLE_YANK) || !kring || !kctbuf) {
+	kctbuf = NULL;
 	return 1;
+    }
     do {
 	/*
 	 * This is supposed to make the yankpop loop

Setting kctbuf to NULL on failure prevents the user from getting a
yanked value out of two consecutive alt-y keystrokes in the case where a
ctrl-y was performed at some point in the past (but not immediately
prior to the alt-y).

I'll commit this to CVS.

..wayne..