Crash if zsh exits with zftp module loaded

Crash if zsh exits with zftp module loaded

[Bart Schaefer]

This only reproduces with a debugging malloc library that detects the
double free:

#3  0x00007ffff6d00b26 in malloc_printerr (action=3, 
    str=0x7ffff6e007c8 "double free or corruption (fasttop)", 
    ptr=<optimized out>) at malloc.c:5051
#4  0x0000000000476a8f in zfree (p=0x7dfe80, sz=8) at mem.c:1820
#5  0x00000000004dfa86 in zftp_cleanup () at zftp.c:3154
#6  0x00000000004dfa9d in zftpexithook (d=0x7903c0, dummy=0x0) at zftp.c:3160
#7  0x00000000004780f4 in runhookdef (h=0x7903c0, d=0x0) at module.c:990
#8  0x0000000000431270 in zexit (val=0, from_where=0) at builtin.c:5229
#9  0x0000000000460077 in zsh_main (argc=2, argv=0x7fffffffe668) at init.c:1693
#10 0x000000000041b834 in main (argc=2, argv=0x7fffffffe668) at ./main.c:93

PATCH Re: Crash if zsh exits with zftp module loaded

[Bart Schaefer]

On Aug 8,  9:37pm, Bart Schaefer wrote:
}
} This only reproduces with a debugging malloc library that detects the
} double free:

So actually the problem is that the zsh/zftp module can't be loaded,
then unloaded, then loaded again without crashing either at reload or
somewhere else along the way.


diff --git a/Src/Modules/zftp.c b/Src/Modules/zftp.c
index 30f5176..bd51512 100644
--- a/Src/Modules/zftp.c
+++ b/Src/Modules/zftp.c
@@ -3149,9 +3149,11 @@ zftp_cleanup(void)
 	zfclose(zfsess != cursess);
     }
     zsfree(lastmsg);
+    lastmsg = NULL;
     zfunsetparam("ZFTP_SESSION");
     freelinklist(zfsessions, (FreeFunc) freesession);
     zfree(zfstatusp, sizeof(int)*zfsesscnt);
+    zfstatusp = NULL;
 }
 
 static int