From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-workers-return-25666-mason-zsh=primenet.com.au@sunsite.dk>
Received: (qmail 25809 invoked from network); 14 Sep 2008 07:30:04 -0000
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham
	version=3.2.5
Received: from news.dotsrc.org (HELO a.mx.sunsite.dk) (130.225.247.88)
  by ns1.primenet.com.au with SMTP; 14 Sep 2008 07:30:04 -0000
Received-SPF: none (ns1.primenet.com.au: domain at sunsite.dk does not designate permitted sender hosts)
Received: (qmail 37169 invoked from network); 14 Sep 2008 07:29:57 -0000
Received: from sunsite.dk (130.225.247.90)
  by a.mx.sunsite.dk with SMTP; 14 Sep 2008 07:29:57 -0000
Received: (qmail 2420 invoked by alias); 14 Sep 2008 07:29:48 -0000
Mailing-List: contact zsh-workers-help@sunsite.dk; run by ezmlm
Precedence: bulk
X-No-Archive: yes
X-Seq: 25666
Received: (qmail 2402 invoked from network); 14 Sep 2008 07:29:46 -0000
Received: from bifrost.dotsrc.org (130.225.254.106)
  by sunsite.dk with SMTP; 14 Sep 2008 07:29:46 -0000
Received: from cork.scru.org (cork.scru.org [209.20.67.2])
	by bifrost.dotsrc.org (Postfix) with ESMTPS id 17481802710A
	for <zsh-workers@sunsite.dk>; Sun, 14 Sep 2008 09:29:43 +0200 (CEST)
Received: by cork.scru.org (Postfix, from userid 1000)
	id 6D6F410409A; Sun, 14 Sep 2008 07:29:41 +0000 (UTC)
Date: Sun, 14 Sep 2008 07:29:41 +0000
From: Clint Adams <clint@zsh.org>
To: zsh-workers@sunsite.dk
Subject: PATCH: memory leak in parse_cadef
Message-ID: <20080914072941.GA21909@scru.org>
Mail-Followup-To: zsh-workers@sunsite.dk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.18 (2008-05-17)
X-Virus-Scanned: ClamAV 0.92.1/8235/Sun Sep 14 02:29:31 2008 on bifrost
X-Virus-Status: Clean

If you have a (broken) _arguments call like this, memory gets zalloc'd
to the variable xor because of the (-c), then not freed because 2Q is an
invalid argument number.

_arguments \
  '-c[blah]' \
  '(-c)2Q:blah:(one two three)'


Index: Src/Zle/computil.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/Zle/computil.c,v
retrieving revision 1.107
diff -u -r1.107 computil.c
--- Src/Zle/computil.c	8 Jun 2008 17:53:55 -0000	1.107
+++ Src/Zle/computil.c	14 Sep 2008 07:24:35 -0000
@@ -1549,6 +1549,8 @@
 	    if (*p != ':') {
 		freecadef(all);
 		zwarnnam(nam, "invalid argument: %s", *args);
+		if (xor)
+		    free(xor);
 		return NULL;
 	    }
 	    if (*++p == ':') {