segfault in tab-completion menu if terminal is only one line tall

segfault in tab-completion menu if terminal is only one line tall

[Axel Beckert]

Hi,

this is a forward of http://bugs.debian.org/527110

--->8---
zsh version 4.3.9 segfaults when I have a terminal emulator open with
only one window available for the term and then do a tab completion.
Steps to reproduce below.

It should be mentioned that I've tried to reproduce the bug with 'zsh
-f', but I can't. Therefore I am attaching the output from the
Util/reporter script. The reason I'm mentioning this is because it
says bugs should be reproduced with the -f flag (in the README from
the source root dir) and if it can't the output from the Util/reporter
script (also from source root dir) should be included.

I can, however, reproduce the bug every time when not using the -f
flag. Steps to reproduce:

1. Open terminal emulator

2. Resize window so that there's only one line for the shell (i.e.
where the prompt also is).

3. Enter: ls <tab><tab> (that is, begin typing the 'ls' command, then
press tabulator twice to tab complete.)

[…]
---8<---

Later in the thread it became clear that the following commands are
necessary, too, if starting with just "zsh -f":

zstyle ':completion:*' menu select=long-list select=0
zstyle ':completion:*' select-prompt '%SScrolling active - %l%s'
autoload -Uz compinit
compinit

I can reproduce this issue with 5.0.5 as currently in Debian
Unstable/Testing. It initially has been reported against zsh 4.3.9.

		Kind regards, Axel
-- 
/~\  Plain Text Ribbon Campaign                   | Axel Beckert
\ /  Say No to HTML in E-Mail and News            | abe@deuxchevaux.org  (Mail)
 X   See http://www.nonhtmlmail.org/campaign.html | abe@noone.org (Mail+Jabber)
/ \  I love long mails: http://email.is-not-s.ms/ | http://noone.org/abe/ (Web)

Re: segfault in tab-completion menu if terminal is only one line tall

[Bart Schaefer]

On Jan 18,  1:37am, Axel Beckert wrote:
}
} 1. Open terminal emulator
} 
} 2. Resize window so that there's only one line for the shell (i.e.
} where the prompt also is).
} 
} 3. Enter: ls <tab><tab> (that is, begin typing the 'ls' command, then
} press tabulator twice to tab complete.)

I was able to reproduce if I start zsh in an 80x1 terminal emulator, but
not after resizing a larger terminal where zsh is already running down
to 1 line.  Possibly something is getting initialized differently in the
two cases.

Other strange things happen if I size the window down to 1 line, try a
completion, and then stretch back to a larger size again; e.g., repainting
the prompt above the select menu doesn't work properly.

} zstyle ':completion:*' menu select=long-list select=0
} zstyle ':completion:*' select-prompt '%SScrolling active - %l%s'

Yes, those are necessary (or at least the first one is) because the crash
occurs in the zsh/complist module which is used for "menu select=long".

The following patch stops the crash I was able to reproduce, but there
may be other ways to tickle it in different circumstances.  This might
also fix the prompt redisplay problem I mentioned above, but I'm not
confident of my steps to reproduce that one.


diff --git a/Src/Zle/complist.c b/Src/Zle/complist.c
index bcf3561..b852ee9 100644
--- a/Src/Zle/complist.c
+++ b/Src/Zle/complist.c
@@ -2500,7 +2500,7 @@ domenuselect(Hookdef dummy, Chdata dat)
 		mlbeg--;
 	    }
 	}
-	if ((space = zterm_lines - pl - mhasstat))
+	if ((space = zterm_lines - pl - mhasstat) > 0)
 	    while (mline >= mlbeg + space)
 		if ((mlbeg += step) + space > mlines)
 		    mlbeg = mlines - space;

-- 
Barton E. Schaefer