From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 21890 invoked by alias); 18 Apr 2013 23:59:45 -0000 Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm Precedence: bulk X-No-Archive: yes List-Id: Zsh Workers List List-Post: List-Help: X-Seq: 31272 Received: (qmail 4137 invoked from network); 18 Apr 2013 23:59:44 -0000 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on f.primenet.com.au X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.2 Received-SPF: none (ns1.primenet.com.au: domain at closedmail.com does not designate permitted sender hosts) From: Bart Schaefer Message-id: <130418165936.ZM8756@torch.brasslantern.com> Date: Thu, 18 Apr 2013 16:59:36 -0700 In-reply-to: Comments: In reply to Nicholas Riley "compctl crash" (Apr 18, 5:01pm) References: X-Mailer: OpenZMail Classic (0.9.2 24April2005) To: zsh-workers@zsh.org Subject: Re: compctl crash MIME-version: 1.0 Content-type: text/plain; charset=us-ascii On Apr 18, 5:01pm, Nicholas Riley wrote: } } I misunderstood the documentation for compctl, so I tried this: } } compctl + } } This crashes zsh back to at least 4.3.9 and up to the current version in } Git. I had thought it would reset all the compctl-defined completions. No, it's just supposed to list all the completions, like "compctl" with no arguments at all. There is indeed a double free. There are only two calls to get_compctl() in the source, and as far as I can tell neither of them really wants to have it free an object passed in by the caller. The value of "cl" is always false, too, so there's a lot of dead code here. diff --git a/Src/Zle/compctl.c b/Src/Zle/compctl.c index 0143370..ab1857c 100644 --- a/Src/Zle/compctl.c +++ b/Src/Zle/compctl.c @@ -398,7 +398,6 @@ get_compctl(char *name, char ***av, Compctl cc, int first, int isdef, int cl) if (cl) return 1; else { - freecompctl(cc); cclist = COMP_REMOVE; return 0; }