From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-users-return-21858-mason-zsh=primenet.com.au@zsh.org>
Received: (qmail 15645 invoked by alias); 9 Sep 2016 13:09:06 -0000
Mailing-List: contact zsh-users-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Users List <zsh-users.zsh.org>
List-Post: <mailto:zsh-users@zsh.org>
List-Help: <mailto:zsh-users-help@zsh.org>
X-Seq: 21858
Received: (qmail 11823 invoked from network); 9 Sep 2016 13:09:05 -0000
X-Qmail-Scanner-Diagnostics: from mail-pa0-f47.google.com by f.primenet.com.au (envelope-from <paulo.cesar.pereira.de.andrade@gmail.com>, uid 7791) with qmail-scanner-2.11 
 (clamdscan: 0.99.2/21882. spamassassin: 3.4.1.  
 Clear:RC:0(209.85.220.47):SA:0(0.0/5.0):. 
 Processed in 1.119082 secs); 09 Sep 2016 13:09:05 -0000
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=0.0 required=5.0 tests=FREEMAIL_FROM,SPF_PASS,
	T_DKIM_INVALID autolearn=unavailable autolearn_force=no version=3.4.1
X-Envelope-From: paulo.cesar.pereira.de.andrade@gmail.com
X-Qmail-Scanner-Mime-Attachments: |
X-Qmail-Scanner-Zip-Files: |
Received-SPF: pass (ns1.primenet.com.au: SPF record at _netblocks.google.com designates 209.85.220.47 as permitted sender)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:from:date:message-id:subject:to;
        bh=KJ6SJusoX7cuOiHvQzEkot++hrJ/pgF1SVfwtCiwccM=;
        b=kewuztsrbs+amrih8Qf4bBtsiftnUAalLQ+w1J6Im6ej0AHNK2RM+Q9SB368CQK3RH
         AGJ/ZwaLRELn21U11hjIunkIoNtP/1IyrrPD4PTe0lGfSOPAYL5x8vWQSvNChwmH/1FR
         ghvD3Qcl4vVuTmyTopEuLYk/S9QuaS1JjtBONz8UNHzUnBnvKRYstcWwGEm7H0Xxs9Wq
         2MLBsK7ddEwhA1N20ZXXc1PqN8p0/Sqlpe2DOiF5GjDEgp2uS9qCFQQ9Gk4ZJxjSva6Y
         VYJSuwpLl6jxoD2mHtIHKrruxzVfz7y+nFFLLiFDqkFTC9eyAlg/rpCnrOh0BRJXm9Yo
         iZFA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
        bh=KJ6SJusoX7cuOiHvQzEkot++hrJ/pgF1SVfwtCiwccM=;
        b=CSJdo+VLBoJrdv3wxUm9UE03QNHxdoV0IqIhW7SVNLgQQ5n+fVtwJlZTabPW9ZzCK+
         s2jwOlVNSHPEG4xExw5baH8qUIkh1/KkyHTyPEcjVJfsxyZbMztOYovoZgvOdTDp9Ger
         RO9qacZIzQ7xEu1/jtCNxlbIVNXLyU25mhxuv/UXdFqsmRsCuuS3Sge0ksLugJ9QPT0P
         j/n6ZQQG2Xkvh3/wBNy9hvs0XB0qz6Bni6zUMlIKGeQjuJNDXTd+SmBze8f+KtAfy1cj
         mejFbmYykVRaEUW1z1AamBbue0mSTax3lo+EPnUe6oY3qTauMQ1afxxyRl2py34z4g6F
         XiJQ==
X-Gm-Message-State: AE9vXwN4Sil1t84gqUr3ESpbrMUcfYQDa2ccyQK3r75ymA181fGgBxiZqxwRZ/J21+qLhVYVJ7vzL7Wd9C7Hng==
X-Received: by 10.66.7.33 with SMTP id g1mr6337296paa.92.1473426054902; Fri,
 09 Sep 2016 06:00:54 -0700 (PDT)
MIME-Version: 1.0
From: =?UTF-8?Q?Paulo_C=C3=A9sar_Pereira_de_Andrade?= <paulo.cesar.pereira.de.andrade@gmail.com>
Date: Fri, 9 Sep 2016 10:00:54 -0300
Message-ID: <CAHAq8pEm1FHNvoUJUq2t86P-QKtMdT3uScDUGn-dCscJUGvWew@mail.gmail.com>
Subject: zsh heredoc crash
To: zsh-users@zsh.org
Content-Type: text/plain; charset=UTF-8

  Hi,

  zsh (tested on 5.0.2) can be made to crash with a pattern
like this:

---8<---
#!/usr/bin/zsh

cat >> /tmp/try <<EOF
export A="$(tr '\n' ' ' <<BLDARC
content
BLDARC)"
EOF
---8<---

  It will also crash with a simpler (but wrong) version:
---8<---
cat >> /tmp/try <<EOF
foo
EOF)
---8<---

  With this patch:
---8<---
diff -up zsh-5.0.2/Src/exec.c.orig zsh-5.0.2/Src/exec.c
--- zsh-5.0.2/Src/exec.c.orig    2016-09-06 15:10:19.394565181 -0300
+++ zsh-5.0.2/Src/exec.c    2016-09-06 15:10:36.300551444 -0300
@@ -3631,16 +3631,16 @@ gethere(char **strp, int typ)
     *bptr++ = '\n';
     }
     *t = '\0';
+    s = dupstring(buf);
+    zfree(buf, bsiz);
     if (!qt) {
     int ef = errflag;

-    parsestr(buf);
+    parsestr(s);

     if (!errflag)
         errflag = ef;
     }
-    s = dupstring(buf);
-    zfree(buf, bsiz);
     return s;
 }

---8<---
it will just print something like:
/tmp/a.sh:8: parse error

  The problem is that the buf vector is allocated with
zalloc, and when calling parsestr it will call hrealloc
on the zalloc'ed buffer.

  The patch just works around the crash, but a better
error message may be shown for this pattern. Ksh
allows it silently, and bash prints a warning but also
allow it.

  The workaround in the script would be to not add
anything after the heredoc delimiter.

Thanks,
Paulo