zsh heredoc crash

zsh heredoc crash

[Paulo César Pereira de Andrade]

  Hi,

  zsh (tested on 5.0.2) can be made to crash with a pattern
like this:

---8<---
#!/usr/bin/zsh

cat >> /tmp/try <<EOF
export A="$(tr '\n' ' ' <<BLDARC
content
BLDARC)"
EOF
---8<---

  It will also crash with a simpler (but wrong) version:
---8<---
cat >> /tmp/try <<EOF
foo
EOF)
---8<---

  With this patch:
---8<---
diff -up zsh-5.0.2/Src/exec.c.orig zsh-5.0.2/Src/exec.c
--- zsh-5.0.2/Src/exec.c.orig    2016-09-06 15:10:19.394565181 -0300
+++ zsh-5.0.2/Src/exec.c    2016-09-06 15:10:36.300551444 -0300
@@ -3631,16 +3631,16 @@ gethere(char **strp, int typ)
     *bptr++ = '\n';
     }
     *t = '\0';
+    s = dupstring(buf);
+    zfree(buf, bsiz);
     if (!qt) {
     int ef = errflag;

-    parsestr(buf);
+    parsestr(s);

     if (!errflag)
         errflag = ef;
     }
-    s = dupstring(buf);
-    zfree(buf, bsiz);
     return s;
 }

---8<---
it will just print something like:
/tmp/a.sh:8: parse error

  The problem is that the buf vector is allocated with
zalloc, and when calling parsestr it will call hrealloc
on the zalloc'ed buffer.

  The patch just works around the crash, but a better
error message may be shown for this pattern. Ksh
allows it silently, and bash prints a warning but also
allow it.

  The workaround in the script would be to not add
anything after the heredoc delimiter.

Thanks,
Paulo

Re: zsh heredoc crash

[Kamil Dudka]

On Friday, September 09, 2016 10:00:54 Paulo César Pereira de Andrade wrote:
>   Hi,
> 
>   zsh (tested on 5.0.2) can be made to crash with a pattern
> like this:
> 
> ---8<---
> #!/usr/bin/zsh
> 
> cat >> /tmp/try <<EOF
> export A="$(tr '\n' ' ' <<BLDARC
> content
> BLDARC)"
> EOF
> ---8<---

I was not able to make upstream zsh 5.0.2 crash with the above reproducer.

The bug seems to be introduced with the following commit:

https://sourceforge.net/p/zsh/code/ci/c0d01a6f

... and fixed with the following commit:

https://sourceforge.net/p/zsh/code/ci/c6c9f5da

Kamil

Re: zsh heredoc crash

[Peter Stephenson]

On Fri, 9 Sep 2016 16:33:19 +0200
Kamil Dudka <kdudka@redhat.com> wrote:
> On Friday, September 09, 2016 10:00:54 Paulo César Pereira de Andrade wrote:
> > ---8<---
> > #!/usr/bin/zsh
> > 
> > cat >> /tmp/try <<EOF
> > export A="$(tr '\n' ' ' <<BLDARC
> > content
> > BLDARC)"
> > EOF
> > ---8<---
> 
> I was not able to make upstream zsh 5.0.2 crash with the above reproducer.
> 
> The bug seems to be introduced with the following commit:
> 
> https://sourceforge.net/p/zsh/code/ci/c0d01a6f
> 
> ... and fixed with the following commit:
> 
> https://sourceforge.net/p/zsh/code/ci/c6c9f5da

That's the underlying bug Paulo is talking about, yes
(zsh-workers/34322).

pws