* Core dump bug in ZSH version 3.0.7
@ 2001-11-12 18:28 Carl Feynman
2001-11-12 18:59 ` Bart Schaefer
0 siblings, 1 reply; 3+ messages in thread
From: Carl Feynman @ 2001-11-12 18:28 UTC (permalink / raw)
To: zsh-workers
I accidentally pasted a python program into zsh and it crashed it,
saying "Memory fault (core dumped)". I cut down the offending python
code to the following three lines, all of which seem to be required to
cause the bug:
if (len(sys.argv) > 1) :
mask = (1 << string.atoi(sys.argv[1])) - 1
key = string.atoi(sys.argv[2])
When I put these lines in a file, I can crash zsh by either 'zsh
bad-file' or, from within zsh, '. bad-file'. In both cases it prints
command not found: len(sys.argv) [1]
parse error near `)' [2]
Memory fault (core dumped)
This is happening in zsh version 3.0.7. Uname -a returns
Linux aleph 2.2.16-3 #1 Mon Jun 19 19:11:44 EDT 2000 i686 unknown
--Carl Feynman
Ab Initio Software Corporation
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Core dump bug in ZSH version 3.0.7
2001-11-12 18:28 Core dump bug in ZSH version 3.0.7 Carl Feynman
@ 2001-11-12 18:59 ` Bart Schaefer
2001-11-13 18:21 ` PATCH (4.0.x, 4.1.x): " Bart Schaefer
0 siblings, 1 reply; 3+ messages in thread
From: Bart Schaefer @ 2001-11-12 18:59 UTC (permalink / raw)
To: Carl Feynman, zsh-workers
On Nov 12, 1:28pm, Carl Feynman wrote:
}
} I cut down the offending python code to the following three lines, all
} of which seem to be required to cause the bug:
}
} if (len(sys.argv) > 1) :
} mask = (1 << string.atoi(sys.argv[1])) - 1
} key = string.atoi(sys.argv[2])
I can reproduce it with just the last two of those lines.
It doesn't crash 4.0.x/4.1.x, but it does get into a rather strange state,
trying to read a here-document whose start/end string is a single space,
which of course is impossible (so you're trapped in the here-document until
you interrupt somehow).
zagzig% mask = (1 << string.atoi(sys.argv[1])) - 1
zsh: parse error near `)'
zagzig% key = string.atoi(sys.argv[2])
heredoc>
--
Bart Schaefer Brass Lantern Enterprises
http://www.well.com/user/barts http://www.brasslantern.com
Zsh: http://www.zsh.org | PHPerl Project: http://phperl.sourceforge.net
^ permalink raw reply [flat|nested] 3+ messages in thread
* PATCH (4.0.x, 4.1.x): Re: Core dump bug in ZSH version 3.0.7
2001-11-12 18:59 ` Bart Schaefer
@ 2001-11-13 18:21 ` Bart Schaefer
0 siblings, 0 replies; 3+ messages in thread
From: Bart Schaefer @ 2001-11-13 18:21 UTC (permalink / raw)
To: Carl Feynman, zsh-workers
On Nov 12, 6:59pm, Bart Schaefer wrote:
} Subject: Re: Core dump bug in ZSH version 3.0.7
}
} It doesn't crash 4.0.x/4.1.x, but it does get into a rather strange state,
} trying to read a here-document whose start/end string is a single space,
} which of course is impossible (so you're trapped in the here-document until
} you interrupt somehow).
}
} zagzig% mask = (1 << string.atoi(sys.argv[1])) - 1
} zsh: parse error near `)'
At this point we've parsed this as the command "mask" with arguments "="
and "(1" and with here-document ending at "string.atoi(sys.argv[1])"; the
parse error is at the second parenthesis.
However, when zsh bailed out with the parse error, it failed to pop the
pending here-document off the queue of such documents. So then when it
begins parsing this:
} zagzig% key = string.atoi(sys.argv[2])
} heredoc>
Zsh now believes it is accepting input for the here-document started at
the previous command line. 4.0+ doesn't crash because it re-uses the
memory at which the here-document's name is pointing, so the document
merely seems to have a bogus name; 3.0.x crashes because the name pointer
in the here-document structure has become garbage.
The solution seems to be the following; I haven't checked whether it will
apply directly to 3.0.x, as this patch is based on 4.1.0-dev-2:
Index: Src/parse.c
===================================================================
--- Src/parse.c 2001/09/05 15:22:33 1.10
+++ Src/parse.c 2001/11/13 18:10:10
@@ -481,6 +481,11 @@
return 0;
}
yyerror(1);
+ while (hdocs) {
+ struct heredocs *next = hdocs->next;
+ zfree(hdocs, sizeof(struct heredocs));
+ hdocs = next;
+ }
herrflush();
if (noerrs != 2)
errflag = 1;
--
Bart Schaefer Brass Lantern Enterprises
http://www.well.com/user/barts http://www.brasslantern.com
Zsh: http://www.zsh.org | PHPerl Project: http://phperl.sourceforge.net
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2001-11-13 18:21 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2001-11-12 18:28 Core dump bug in ZSH version 3.0.7 Carl Feynman
2001-11-12 18:59 ` Bart Schaefer
2001-11-13 18:21 ` PATCH (4.0.x, 4.1.x): " Bart Schaefer
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).