From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-workers-return-33976-mason-zsh=primenet.com.au@zsh.org>
Received: (qmail 17930 invoked by alias); 15 Dec 2014 23:39:41 -0000
Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Workers List <zsh-workers.zsh.org>
List-Post: <mailto:zsh-workers@zsh.org>
List-Help: <mailto:zsh-workers-help@zsh.org>
X-Seq: 33976
Received: (qmail 9626 invoked from network); 15 Dec 2014 23:39:32 -0000
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE
	autolearn=ham version=3.3.2
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.1 cv=B94OC1pJ c=1 sm=1 tr=0	a=FT8er97JFeGWzr5TCOCO5w==:117
 a=kj9zAlcOel0A:10 a=q2GGsy2AAAAA:8	a=oR5dmqMzAAAA:8 a=-9mUelKeXuEA:10
 a=A92cGCtB03wA:10	a=-XWMYKpqLy6jHA7zwk8A:9 a=CjuIK1q_8ugA:10
From: Bart Schaefer <schaefer@brasslantern.com>
Message-id: <141215153936.ZM17826@torch.brasslantern.com>
Date: Mon, 15 Dec 2014 15:39:36 -0800
In-reply-to:
 <CAAW2-Zft+xzCfSYF4O9F5TnaYqODdr8P_ZisPTPHQK8qyeGuVw@mail.gmail.com>
Comments: In reply to Jonathan H <pythonnut@gmail.com>
 "Re: Complex config triggering Segfault in pattern matching code." (Dec 15,
 1:20pm)
References:
 <CAAW2-Zf8azHg+pWfSYEWQhBgagqY7cPQNbjB7x+q76j7fQDT8g@mail.gmail.com>
	<141213152840.ZM16632@torch.brasslantern.com>
	<CAAW2-ZdW+j655-8dnzTYr-qK6bee0is806E+S3QG-bZumz70Ww@mail.gmail.com>
	<141213204032.ZM16766@torch.brasslantern.com>
	<20141214182021.1944bbcd@pws-pc.ntlworld.com>
	<CAAW2-Zft+xzCfSYF4O9F5TnaYqODdr8P_ZisPTPHQK8qyeGuVw@mail.gmail.com>
X-Mailer: OpenZMail Classic (0.9.2 24April2005)
To: <zsh-workers@zsh.org>
Subject: Re: Complex config triggering Segfault in pattern matching code.
MIME-version: 1.0
Content-type: text/plain; charset=us-ascii

On Dec 15,  1:20pm, Jonathan H wrote:
}
} It usually is, but for some reason I can't get it to crash in
} valgrind.

That'll happen sometimes if the error is related to a signal being
handled or something like that.  Zsh isn't internally "multi-threaded"
so the only source of race conditions is signals (including child
process exits).

} Anyway, here's the STDERR from "valgrind -v -v".

That's probably more detail than is useful -- in fact, just "valgrind -q"
would probably suffice if you're going to run it for a long time.

} It shows some errors
} or something so maybe it's still of use. I'll post if I can get it to
} crash though.

==7806== 1 errors in context 1 of 2:
==7806== Source and destination overlap in strcpy(0x402bd24, 0x402bd51)
==7806==    at 0x4C2D766: __GI_strcpy (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7806==    by 0x488CD0: stringsubst (subst.c:301)

We can fix that one:

diff --git a/Src/subst.c b/Src/subst.c
index 43932c2..4100803 100644
--- a/Src/subst.c
+++ b/Src/subst.c
@@ -298,7 +298,7 @@ stringsubst(LinkList list, LinkNode node, int pf_flags, int asssub)
 	    if (endchar == Outpar)
 		str2--;
 	    if (!(s = (char *) ugetnode(pl))) {
-		str = strcpy(str2, str);
+		str = (char *)memmove(str2, str, strlen(str)+1);
 		continue;
 	    }
 	    if (!qt && (pf_flags & PREFORK_SINGLE) && isset(GLOBSUBST))


==7806== 2 errors in context 2 of 2:
==7806== Conditional jump or move depends on uninitialised value(s)
==7806==    at 0x65A79E7: execzlefunc (zle_main.c:1360)
==7806==    by 0x65B8B2C: bin_zle_call (zle_thingy.c:711)

I have no idea what to do with that one; that line is:

	Shfunc shf = (Shfunc) shfunctab->getnode(shfunctab, w->u.fnnam);