Re: Fwd: Bug#924736: zsh 5.7.1 segfaults when three setopt options are in play [origin: wesley@schwengle.net]

[Peter Stephenson <p.stephenson@samsung.com>]

On Sat, 2019-03-16 at 22:41 +0100, Axel Beckert wrote:
> Have a zshrc with the following setopts:
> 
> setopt hist_reduce_blanks
> setopt hist_ignore_space
> setopt interactivecomments
> 
> * Run zsh -f
> * Now enter `     #`
> * You get a command not found error
> * Now source your zshrc
> * Again entery `     #`
> * Segfault

Yes, that's completely reproducible.

I think it's the logic within histreduceblanks() that's flaky in this
case, where there's a comment at the end of a line with no commands and
hence no words.  The final comment is a special case because the
positions of words aren't marked.  It can't possibly be correct to do
that copy at the end if the destination pointer is after the source
pointer, can it?  So I think the following ought to be safe.

If anyone else thinks the code here is trying to do something cleverer that this
may stop --- your guess is as good as mine at this point --- let me know
(but I think that's a much lesser problem).

pws

diff --git a/Src/hist.c b/Src/hist.c
index f7e53de..901cd3b 100644
--- a/Src/hist.c
+++ b/Src/hist.c
@@ -1198,8 +1198,9 @@ histreduceblanks(void)
 	chline[pos] = '\0';
     } else {
 	ptr = chline + pos;
-	while ((*ptr++ = *lastptr++))
-	    ;
+	if (ptr < lastptr)
+	    while ((*ptr++ = *lastptr++))
+		;
     }
 }