Re: Complex config triggering Segfault in pattern matching code.

[Bart Schaefer <schaefer@brasslantern.com>]

On Dec 15,  1:20pm, Jonathan H wrote:
}
} It usually is, but for some reason I can't get it to crash in
} valgrind.

That'll happen sometimes if the error is related to a signal being
handled or something like that.  Zsh isn't internally "multi-threaded"
so the only source of race conditions is signals (including child
process exits).

} Anyway, here's the STDERR from "valgrind -v -v".

That's probably more detail than is useful -- in fact, just "valgrind -q"
would probably suffice if you're going to run it for a long time.

} It shows some errors
} or something so maybe it's still of use. I'll post if I can get it to
} crash though.

==7806== 1 errors in context 1 of 2:
==7806== Source and destination overlap in strcpy(0x402bd24, 0x402bd51)
==7806==    at 0x4C2D766: __GI_strcpy (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7806==    by 0x488CD0: stringsubst (subst.c:301)

We can fix that one:

diff --git a/Src/subst.c b/Src/subst.c
index 43932c2..4100803 100644
--- a/Src/subst.c
+++ b/Src/subst.c
@@ -298,7 +298,7 @@ stringsubst(LinkList list, LinkNode node, int pf_flags, int asssub)
 	    if (endchar == Outpar)
 		str2--;
 	    if (!(s = (char *) ugetnode(pl))) {
-		str = strcpy(str2, str);
+		str = (char *)memmove(str2, str, strlen(str)+1);
 		continue;
 	    }
 	    if (!qt && (pf_flags & PREFORK_SINGLE) && isset(GLOBSUBST))


==7806== 2 errors in context 2 of 2:
==7806== Conditional jump or move depends on uninitialised value(s)
==7806==    at 0x65A79E7: execzlefunc (zle_main.c:1360)
==7806==    by 0x65B8B2C: bin_zle_call (zle_thingy.c:711)

I have no idea what to do with that one; that line is:

	Shfunc shf = (Shfunc) shfunctab->getnode(shfunctab, w->u.fnnam);