Stack overflow with extended globs

Stack overflow with extended globs

[Christian Neukirchen]

Discussion in #zsh turned up this yesterday:

% gdb --args zsh -f
(gdb) r
Starting program: /bin/zsh -f
juno% echo $ZSH_VERSION 
5.0.2
juno% setopt extendedglob; echo *(#c3,)x*

Program received signal SIGSEGV, Segmentation fault.
0x000000000046ddad in ?? ()
(gdb) bt -30
#38793 0x000000000046e199 in ?? ()
#38794 0x000000000046e921 in ?? ()
#38795 0x000000000046e199 in ?? ()
#38796 0x000000000046e921 in ?? ()
#38797 0x000000000046e199 in ?? ()
#38798 0x000000000046e921 in ?? ()
#38799 0x000000000046e199 in ?? ()
#38800 0x000000000046e921 in ?? ()
#38801 0x000000000046e199 in ?? ()
#38802 0x000000000046e921 in ?? ()
#38803 0x000000000046e199 in ?? ()
#38804 0x000000000046e921 in ?? ()
#38805 0x000000000046e199 in ?? ()
#38806 0x000000000046e921 in ?? ()
#38807 0x000000000046e199 in ?? ()
#38808 0x000000000046dc91 in ?? ()
#38809 0x000000000046f12d in pattryrefs ()
#38810 0x000000000046f7f7 in pattry ()
#38811 0x0000000000431edb in ?? ()
#38812 0x000000000043301a in zglob ()
#38813 0x0000000000477656 in globlist ()
#38814 0x000000000042a2a6 in ?? ()
#38815 0x000000000042b866 in ?? ()
#38816 0x000000000042bdaf in ?? ()
#38817 0x000000000042cf5f in execlist ()
#38818 0x000000000042d47d in execode ()
#38819 0x000000000043d972 in loop ()
#38820 0x0000000000440b1e in zsh_main ()
#38821 0x00007ffff70eaa15 in __libc_start_main () from /usr/lib/libc.so.6
#38822 0x000000000040f3d1 in _start ()

-- 
Christian Neukirchen  <chneukirchen@gmail.com>  http://chneukirchen.org

Re: Stack overflow with extended globs

[Bart Schaefer]

On Mar 16,  5:28pm, Christian Neukirchen wrote:
}
} juno% setopt extendedglob; echo *(#c3,)x*
} 
} Program received signal SIGSEGV, Segmentation fault.

I think we want either this:

Index: Src/pattern.c
===================================================================
--- pattern.c	21 Dec 2010 16:41:16 -0000
+++ pattern.c	16 Mar 2013 18:21:36 -0000
@@ -1474,7 +1474,7 @@
     }
 
     /* too much at once doesn't currently work */
-    if (kshchar && pound)
+    if (kshchar && (pound || count))
 	return 0;
 
     if (kshchar == '*') {



Or this:

Index: Src/pattern.c
===================================================================
--- pattern.c	21 Dec 2010 16:41:16 -0000
+++ pattern.c	16 Mar 2013 18:23:53 -0000
@@ -1474,7 +1474,7 @@
     }
 
     /* too much at once doesn't currently work */
-    if (kshchar && pound)
+    if (kshchar && pound || kshchar < 0 && count)
 	return 0;
 
     if (kshchar == '*') {


But I'm not sure which.  I tend to think the former.