From: Bart Schaefer <schaefer@brasslantern.com>
To: zsh-workers@zsh.org
Subject: Re: Obscure zsh history overflow with segfault
Date: Tue, 24 Jan 2012 12:28:19 -0800 [thread overview]
Message-ID: <120124122819.ZM31632@torch.brasslantern.com> (raw)
In-Reply-To: <20120121023957.GA2643@daniel3.local>
On Jan 21, 4:39am, Daniel Shahaf wrote:
}
} Apparently, 'r 100 foo' should re-execute the portion of your history
} from event #100 to event 'foo'.
}
} Sounds like a bad idea...
Interesting. Here we are:
1516 /*
1517 * Nasty behaviour results if we use the current history
1518 * line here. Treat it as if it doesn't exist, unless
1519 * that gives us an empty range.
1520 */
1521 if (last >= curhist) {
1522 last = curhist - 1;
1523 if (first > last) {
1524 unqueue_signals();
1525 zwarnnam("fc",
1526 "current history line would recurse endlessly, aborted");
1527 fclose(out);
1528 unlink(fil);
1529 return 1;
1530 }
1531 }
In the situation in this bug, first > last is true but last >= curhist
is false. I believe that means that even though this is an infinite
loop, we don't detect that it will be.
However, it's worse than that: If HIST_NO_STORE is not set, then even
when last < curhist and first <= last, its possible for the history to
contain an "r" command, which will be executed, retrieving a history
that contains an "r" command, which ...
One possible approach is for bin_fc to refuse to recursively run the
"r" command (same for "fc -e -"). However, it's then still possible
for the user to shoot himself with "fc -e cat ..." (or any other no-op
editor command); so short of disallowing any sort of recursive entry
into "fc" when -l is not given, this probably has to be treated as a
user error.
next prev parent reply other threads:[~2012-01-24 20:28 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-20 19:42 Christian Neukirchen
2012-01-21 2:39 ` Daniel Shahaf
2012-01-24 20:28 ` Bart Schaefer [this message]
2012-01-26 20:57 ` Peter Stephenson
2012-01-27 4:59 ` Bart Schaefer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=120124122819.ZM31632@torch.brasslantern.com \
--to=schaefer@brasslantern.com \
--cc=zsh-workers@zsh.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/zsh/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).