Memory access bug with negative subscripts

Memory access bug with negative subscripts

[Bart Schaefer]

This bug appears at least as far back as zsh 3.0.5, and probably longer
ago.  Still happens in the latest CVS co from SourceForge.

x=x
x[-10]=y
print $x

I can't predict what you'll see, but unless you get very lucky it won't
be what you ought to see.  For example,

torch% x[-$RANDOM]=z
torch% print $x
zpasswd

I imagine running that under ElectricFence or some similar memory checker
would be instructive.

Re: Memory access bug with negative subscripts

[Peter Stephenson]

On Tue, 24 Jul 2007 21:52:22 -0700
Bart Schaefer <schaefer@brasslantern.com> wrote:
> This bug appears at least as far back as zsh 3.0.5, and probably longer
> ago.  Still happens in the latest CVS co from SourceForge.
> 
> x=x
> x[-10]=y
> print $x
> 
> I can't predict what you'll see, but unless you get very lucky it won't
> be what you ought to see.

The only sensible choice seems to be to make this do what arrays do,
add the element at the start.  This is inconistent with assignments
to subscript 0 which now cause an error, but that was quite specifically to
deal with the removal of fake KSH_ARRAYS and detect an incorrect assumption
of zero-offset addressing.  There isn't really a logical link, anyway,
since negative offsets count from the end.

Index: Src/params.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/params.c,v
retrieving revision 1.132
diff -u -r1.132 params.c
--- Src/params.c	6 Jul 2007 21:52:39 -0000	1.132
+++ Src/params.c	25 Jul 2007 09:16:26 -0000
@@ -2076,8 +2076,11 @@
 	    }
 	    if (v->start > zlen)
 		v->start = zlen;
-	    if (v->end < 0)
+	    if (v->end < 0) {
 		v->end += zlen + 1;
+		if (v->end < 0)
+		    v->end = 0;
+	    }
 	    else if (v->end > zlen)
 		v->end = zlen;
 	    x = (char *) zalloc(v->start + strlen(val) + zlen - v->end + 1);
Index: Test/D04parameter.ztst
===================================================================
RCS file: /cvsroot/zsh/zsh/Test/D04parameter.ztst,v
retrieving revision 1.26
diff -u -r1.26 D04parameter.ztst
--- Test/D04parameter.ztst	6 Jul 2007 13:10:45 -0000	1.26
+++ Test/D04parameter.ztst	25 Jul 2007 09:16:27 -0000
@@ -920,3 +920,20 @@
 0:Numeric sorting
 >a6 a17 a117 b6 b17 b117
 >b117 b17 b6 a117 a17 a6
+
+  x=sprodj
+  x[-10]=scrumf
+  print $x
+0:Out of range negative scalar subscripts
+>scrumfsprodj
+
+  a=(some sunny day)
+  a[-10]=(we\'ll meet again)
+  print -l $a
+0:Out of range negative array subscripts
+>we'll
+>meet
+>again
+>some
+>sunny
+>day


-- 
Peter Stephenson <pws@csr.com>                  Software Engineer
CSR PLC, Churchill House, Cambridge Business Park, Cowley Road
Cambridge, CB4 0WZ, UK                          Tel: +44 (0)1223 692070


.