crashing bug here with LANG=C printf "%1.1f\n" 23.2

[Matthias Kopfermann <matthi@infodrom.north.de>]

Hi all,

for ((i=1;i<100;i+=.01)) ; { LANG=C printf "%1.1f\n" $i ; }
gives me a segfault instantly here.
the same can happen when just doing LANG='C' printf "%1.1f\n" 23.2

with message: BUG: attempt to free more than allocated.

when invoking gdb zsh core and doing bt, i get:


GNU gdb 6.1-debian
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux"...Using host libthread_db library "/lib/libthread_db.so.1".

Core was generated by `zsh'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libpcre.so.3...done.
Loaded symbols for /usr/lib/libpcre.so.3
Reading symbols from /lib/libncurses.so.5...done.
Loaded symbols for /lib/libncurses.so.5
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libnss_compat.so.2...done.
Loaded symbols for /lib/libnss_compat.so.2
Reading symbols from /lib/libnsl.so.1...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libnss_nis.so.2...done.
Loaded symbols for /lib/libnss_nis.so.2
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from /usr/local/lib/zsh/4.2.0-dev-1/zsh/parameter.so...done.
Loaded symbols for /usr/local/lib/zsh/4.2.0-dev-1/zsh/parameter.so
Reading symbols from /usr/local/lib/zsh/4.2.0-dev-1/zsh/zle.so...done.
Loaded symbols for /usr/local/lib/zsh/4.2.0-dev-1/zsh/zle.so
Reading symbols from /usr/local/lib/zsh/4.2.0-dev-1/zsh/complete.so...done.
Loaded symbols for /usr/local/lib/zsh/4.2.0-dev-1/zsh/complete.so
Reading symbols from /usr/local/lib/zsh/4.2.0-dev-1/zsh/zutil.so...done.
Loaded symbols for /usr/local/lib/zsh/4.2.0-dev-1/zsh/zutil.so
Reading symbols from /usr/local/lib/zsh/4.2.0-dev-1/zsh/complist.so...done.
Loaded symbols for /usr/local/lib/zsh/4.2.0-dev-1/zsh/complist.so
Reading symbols from /usr/local/lib/zsh/4.2.0-dev-1/zsh/pcre.so...done.
Loaded symbols for /usr/local/lib/zsh/4.2.0-dev-1/zsh/pcre.so
Reading symbols from /usr/local/lib/zsh/4.2.0-dev-1/zsh/rlimits.so...done.
Loaded symbols for /usr/local/lib/zsh/4.2.0-dev-1/zsh/rlimits.so
#0  0x400f33ab in memset () from /lib/libc.so.6
(gdb) bt
#0  0x400f33ab in memset () from /lib/libc.so.6
#1  0x0808eb30 in zfree (p=0x845cfc0, sz=2056) at mem.c:1179
#2  0x0808ee4c in zsfree (p=0x845cfc0 'ÿ' <repeats 200 times>...) at mem.c:1251
#3  0x0809cd7f in delenv (x=0x845cfc0 'ÿ' <repeats 200 times>...)
    at params.c:3467
#4  0x0806957d in save_params (state=0xbffff6e0, pc=0x40018b30, 
    restore_p=0xbffff108, remove_p=0xbffff10c) at exec.c:2524
#5  0x08068f65 in execcmd (state=0xbffff6e0, input=0, output=0, how=18, 
    last1=2) at exec.c:2369
#6  0x08065b96 in execpline2 (state=0xbffff6e0, pcode=131, how=18, input=0, 
    output=0, last1=0) at exec.c:1274
#7  0x080650ea in execpline (state=0xbffff6e0, slcode=8194, how=18, last1=0)
    at exec.c:1064
#8  0x08064a5d in execlist (state=0xbffff6e0, dont_change_job=1, exiting=0)
    at exec.c:870
#9  0x08087d2f in execfor (state=0xbffff6e0, do_exec=0) at loop.c:159
#10 0x08068eb0 in execcmd (state=0xbffff6e0, input=0, output=0, how=18, 
    last1=2) at exec.c:2359
#11 0x08065b96 in execpline2 (state=0xbffff6e0, pcode=131, how=18, input=0, 
    output=0, last1=0) at exec.c:1274
#12 0x080650ea in execpline (state=0xbffff6e0, slcode=15362, how=18, last1=0)
    at exec.c:1064
#13 0x08064a5d in execlist (state=0xbffff6e0, dont_change_job=0, exiting=0)
    at exec.c:870
#14 0x08064787 in execode (p=0x40018ae0, dont_change_job=0, exiting=0)
    at exec.c:771
#15 0x0807ada6 in loop (toplevel=1, justonce=0) at init.c:165
#16 0x0807d564 in zsh_main (argc=1, argv=0xbffff7d4) at init.c:1274
#17 0x0805272e in main (argc=1, argv=0xbffff7d4) at main.c:93

hope this is helpful,

	Matthias