SIGSEGV in patmatch() -- Fedora bug #1245116

SIGSEGV in patmatch() -- Fedora bug #1245116

[Kamil Dudka]

A user of Fedora reported a crash of zsh-5.0.8 in patmatch():

https://bugzilla.redhat.com/1245116

The automatically recorded backtrace:

https://bugzilla.redhat.com/attachment.cgi?id=1054236

... shows that 'chrop' and 'chrend' pointed off the allocated memory
at this line:

http://repo.or.cz/w/zsh/mirror.git/blob/a0862f63:/Src/pattern.c#l2541

My guess is that the invalid addresses were loaded from 'exactpos' and 
'exactend' but static variables are not captured in the backtrace to
actually confirm it.

Unfortunately, I was not successful in reproducing the crash locally,
neither the original reporter was able to trigger it on demand.  Hence,
I am sharing it here in case anybody recognized the actual cause just
from the backtrace.

Kamil

Re: SIGSEGV in patmatch() -- Fedora bug #1245116

[Bart Schaefer]

On Jul 21,  6:01pm, Kamil Dudka wrote:
}
} Unfortunately, I was not successful in reproducing the crash locally,
} neither the original reporter was able to trigger it on demand.  Hence,
} I am sharing it here in case anybody recognized the actual cause just
} from the backtrace.

It's yet another crash from region highlighting, so you're probably not
going to be able to reproduce it without replicating some of the fancy
coloring that is applied by packages like oh-my-zsh and/or prezto.

Beyond that I don't recognize anything interesting.