Re: [PATCH] jp: fix segfaults during parameter expansion

[Bart Schaefer <schaefer@brasslantern.com>]

On Jan 20,  5:16pm, Daniel Tameling wrote:
} 
} while working through my email backlog, I noticed that my zsh didn't
} segfault. I used git bisect, and it looks like commit
} 4b8db48c6bd3c0230a5d81f49e478857adf9cda8 introduced it.

This is a bit of a red herring -- the fault is actually in the handling
of the (P) flag.  What this commit changed was the handling of the (A)
flag, to make it independent of the ${name=value} syntax.

The potential bug in handling of (P) has always been there, but we never
attempted to convert the scalar into an array in that context before.

My patch in workers/42268 addresses the thing that crashes.  However,
I think the following may be better:

torch% : ${${(PAA)p[foo]}::=x}
zsh: parameter name reference used with array


diff --git a/Src/subst.c b/Src/subst.c
index d027e3d..042ef28 100644
--- a/Src/subst.c
+++ b/Src/subst.c
@@ -2423,7 +2423,7 @@ paramsubst(LinkList l, LinkNode n, char **str, int qt, int pf_flags,
 	     * substitution.
 	     */
 	    if (isarr) {
-		if (aval[0] && aval[1]) {
+		if (!aval[0] || (aval[0] && aval[1])) {
 		    zerr("parameter name reference used with array");
 		    return NULL;
 		}