Zsh segfault with process substitution

Zsh segfault with process substitution

[Eric P. Mangold]

Hi, I was just fooling around today and managed to segfault zsh in a way
that is reliable to reproduce. Some other folks on IRC were able to
reproduce on zsh 4.3.10 and recent git builds - on Linux and OpenBSD.

Sapphire ~/code % zsh
Sapphire ~/code % cat =(echo foo)
foo
Sapphire ~/code % cat tree=${:-=(echo 'C,D),(F,G)'}
zsh: oops.
zsh: segmentation fault (core dumped)  zsh

Let me know if I can be of further assistance.

    -teratorn

Re: Zsh segfault with process substitution

[Peter Stephenson]

On Wed, 17 Aug 2011 18:28:02 +0000
"Eric P. Mangold" <eric@teratorn.org> wrote:
> zsh: oops.

Er, indeed.

Index: Src/exec.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/exec.c,v
retrieving revision 1.202
diff -p -u -r1.202 exec.c
--- Src/exec.c	14 Aug 2011 18:34:28 -0000	1.202
+++ Src/exec.c	17 Aug 2011 19:20:07 -0000
@@ -3755,7 +3755,15 @@ parsecmd(char *cmd, char **eptr)
 
     for (str = cmd + 2; *str && *str != Outpar; str++);
     if (!*str || cmd[1] != Inpar) {
-	zerr("oops.");
+	/*
+	 * This can happen if the expression is being parsed
+	 * inside another construct, e.g. as a value within ${..:..} etc.
+	 * So print a proper error message instead of the not very
+	 * useful but traditional "oops".
+ 	 */
+	char *errstr = dupstrpfx(cmd, 2);
+	untokenize(errstr);
+	zerr("unterminated `%s...)'", errstr);
 	return NULL;
     }
     *str = '\0';
Index: Src/subst.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/subst.c,v
retrieving revision 1.127
diff -p -u -r1.127 subst.c
--- Src/subst.c	1 Jul 2011 15:23:03 -0000	1.127
+++ Src/subst.c	17 Aug 2011 19:20:07 -0000
@@ -162,6 +162,8 @@ stringsubst(LinkList list, LinkNode node
 		subst = getproc(str, &rest);	/* <(...) or >(...) */
 	    else
 		subst = getoutputfile(str, &rest);	/* =(...) */
+	    if (errflag)
+		return NULL;
 	    if (!subst)
 		subst = "";
 
Index: Test/D03procsubst.ztst
===================================================================
RCS file: /cvsroot/zsh/zsh/Test/D03procsubst.ztst,v
retrieving revision 1.5
diff -p -u -r1.5 D03procsubst.ztst
--- Test/D03procsubst.ztst	13 Nov 2008 21:18:15 -0000	1.5
+++ Test/D03procsubst.ztst	17 Aug 2011 19:20:07 -0000
@@ -84,3 +84,7 @@
   )
 0:=(...) preceded by other stuff has no special effect
 >everything,=(here is left),alone
+
+  print something=${:-=(echo 'C,D),(F,G)'}
+1: Graceful handling of bad substitution in enclosed context
+?(eval):1: unterminated `=(...)'

-- 
Peter Stephenson <p.w.stephenson@ntlworld.com>
Web page now at http://homepage.ntlworld.com/p.w.stephenson/