zsh segfaul in 5.0.2, known bug?

zsh segfaul in 5.0.2, known bug?

[Sam Roberts]

% (export path=$PATH; unset PATH; date)
export: can't assign new value for array path
zsh: segmentation fault (core dumped)  ( export path=$PATH; unset PATH; date; )

% cat /etc/issue
Ubuntu 13.10 \n \l

% zsh --version
zsh 5.0.2 (x86_64-pc-linux-gnu)

Re: zsh segfaul in 5.0.2, known bug?

[Axel Beckert]

Hi,

On Mon, Dec 30, 2013 at 04:07:10PM -0800, Sam Roberts wrote:
> % (export path=$PATH; unset PATH; date)
> export: can't assign new value for array path
> zsh: segmentation fault (core dumped)  ( export path=$PATH; unset PATH; date; )

Looks fixed in 5.0.4:

% (export path=$PATH; unset PATH; date)
export: can't assign new value for array path
zsh: command not found: date
% zsh --version
zsh 5.0.4 (x86_64-pc-linux-gnu)
% 

		Kind regards, Axel
-- 
/~\  Plain Text Ribbon Campaign                   | Axel Beckert
\ /  Say No to HTML in E-Mail and News            | abe@deuxchevaux.org  (Mail)
 X   See http://www.asciiribbon.org/              | abe@noone.org (Mail+Jabber)
/ \  I love long mails: http://email.is-not-s.ms/ | http://noone.org/abe/ (Web)

Re: zsh segfaul in 5.0.2, known bug?

[Bart Schaefer]

On Dec 30,  4:07pm, Sam Roberts wrote:
}
} % (export path=$PATH; unset PATH; date)
} export: can't assign new value for array path
} zsh: segmentation fault (core dumped)  ( export path=$PATH; unset PATH; date; )

Hmm, this is a sneaky one.  The "export" is entirely irrelevant.

If the command is "unset path", then we first unset the path array, and
then unset the PATH scalar, which repairs the environment and thereby
resets an internal pointer that tracks how much of the path array has
been searched.

However, when the command is "unset PATH", we first unset the scalar,
which resets the internal pointer, but then unset the array, which
leaves that other pointer aimed at the freed memory that formerly
held the path.

*Except* that unsetting the path array immediately re-allocates it as
an array with no elements.  In most cases this re-uses the same block
that was just freed, so by accident the other pointer becomes valid
again.  If the malloc() library routine happens to have the property
that it might not return that same most-recently-freed block, then the
other pointer remains invalid and a crash results when the next path
search tries to pick up where the previous one left off.  (There was no
previous search, but it can't tell that because the pointer is bad.)

The ZSH_MEM_DEBUG library happens *to* re-use the most-recently-freed
block, so a typical debugger session does not reveal the problem.  I
found it with valgrind and then puzzled out the order of operations.

The following fixes the crash, but it's exposing in arrvarsetfn() some
knowledge that was previously confined to arrfixenv(), so there may be
a cleaner way to handle it.

diff --git a/Src/params.c b/Src/params.c
index 26ad6b2..ad9e347 100644
--- a/Src/params.c
+++ b/Src/params.c
@@ -3380,8 +3380,12 @@ arrvarsetfn(Param pm, char **x)
 	*dptr = mkarray(NULL);
     else
 	*dptr = x;
-    if (pm->ename && x)
-	arrfixenv(pm->ename, x);
+    if (pm->ename) {
+	if (x)
+	    arrfixenv(pm->ename, x);
+	else if (*dptr == path)
+	    pathchecked = path;
+    }
 }
 
 /**/